diff --git a/DEPS b/DEPS
index f626df2..f6c1fbd 100644
--- a/DEPS
+++ b/DEPS

@@ -105,7 +105,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'cd8689f0042727666e468dc18bdb4d65b02b6fd9',
+  'skia_revision': 'bc414ed5dec50cd31210a430d87c9d638560220d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -129,7 +129,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': 'd5e282648a08a0b68c30edce51fafeeb5d76db7b',
+  'pdfium_revision': '21068062a038db72b5ee40512fe638acbdd17c3d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -153,7 +153,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling NaCl
   # and whatever else without interference from each other.
-  'nacl_revision': 'cadf5787452659b381450733c9260e065842fe05',
+  'nacl_revision': '6e5fd1672be57aafb05bf0a1f1bbdc9107e0c58b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling freetype
   # and whatever else without interference from each other.
@@ -552,7 +552,7 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + 'e5f282cb55b2366f57f0904546374843c98e3dc9',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '3f621b000733d8ce54fa6092eeeaf4223cbc91d1',
       'condition': 'checkout_linux',
   },
 
@@ -577,7 +577,7 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '95fb6dc810348da9dd261a4f7ac2d66c5743da86',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + 'ed0d273bfa5155ffb2a41525210c154ace0662a8',
 
   'src/third_party/devtools-node-modules':
     Var('chromium_git') + '/external/github.com/ChromeDevTools/devtools-node-modules' + '@' + Var('devtools_node_modules_revision'),
@@ -1049,7 +1049,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + '7ca87fb1d3da3b3d2060886e8c58e726d74c8219',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + 'b005087a8cac6afda03b0b100f7a9f5b26ebeac4',
+    Var('webrtc_git') + '/src.git' + '@' + '984f1a80c00105b9c9e19765fb6118d49ce9f34e',
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
@@ -1083,7 +1083,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@bb6c3f056b91997bc895ceb79884f1ab39975bc1',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@f04be3a84fddddfd3dd39c0735c69945aaed3885',
     'condition': 'checkout_src_internal',
   },
 

diff --git a/ash/BUILD.gn b/ash/BUILD.gn
index 6d3147b..82b3157 100644
--- a/ash/BUILD.gn
+++ b/ash/BUILD.gn

@@ -2190,8 +2190,6 @@
     "display/screen_orientation_controller_test_api.h",
     "highlighter/highlighter_controller_test_api.cc",
     "highlighter/highlighter_controller_test_api.h",
-    "ime/test_ime_controller.cc",
-    "ime/test_ime_controller.h",
     "ime/test_ime_controller_client.cc",
     "ime/test_ime_controller_client.h",
     "keyboard/test_keyboard_ui.cc",

diff --git a/ash/app_list/views/apps_container_view.cc b/ash/app_list/views/apps_container_view.cc
index 8564471..c1ccc10 100644
--- a/ash/app_list/views/apps_container_view.cc
+++ b/ash/app_list/views/apps_container_view.cc

@@ -413,7 +413,7 @@
       kSearchBoxBottomPadding;
   if (drag_amount <= (peeking_height - shelf_height)) {
     // App list is dragged from collapsed to peeking, which moved up at most
-    // |peeking_height - kShelfSize| (272px). The top padding of apps
+    // |peeking_height - shelf_size| (272px). The top padding of apps
     // container view changes from |-kSearchBoxFullscreenBottomPadding| to
     // |kSearchBoxPeekingTopPadding + kSearchBoxPreferredHeight +
     // kSearchBoxPeekingBottomPadding - kSearchBoxFullscreenBottomPadding|.

diff --git a/ash/public/cpp/app_list/app_list_features.cc b/ash/public/cpp/app_list/app_list_features.cc
index 7f92783..c4ab816 100644
--- a/ash/public/cpp/app_list/app_list_features.cc
+++ b/ash/public/cpp/app_list/app_list_features.cc

@@ -33,6 +33,10 @@
     "EnableZeroStateSuggestions", base::FEATURE_DISABLED_BY_DEFAULT};
 const base::Feature kEnableAppListSearchAutocomplete{
     "EnableAppListSearchAutocomplete", base::FEATURE_DISABLED_BY_DEFAULT};
+const base::Feature kEnableSearchResultRankerTrain{
+    "EnableSearchResultRankerTrain", base::FEATURE_DISABLED_BY_DEFAULT};
+const base::Feature kEnableSearchResultRankerInfer{
+    "EnableSearchResultRankerInfer", base::FEATURE_DISABLED_BY_DEFAULT};
 
 bool IsAnswerCardEnabled() {
   // Not using local static variable to allow tests to change this value.
@@ -80,6 +84,14 @@
   return base::FeatureList::IsEnabled(kEnableAppListSearchAutocomplete);
 }
 
+bool IsSearchResultRankerTrainEnabled() {
+  return base::FeatureList::IsEnabled(kEnableSearchResultRankerTrain);
+}
+
+bool IsSearchResultRankerInferEnabled() {
+  return base::FeatureList::IsEnabled(kEnableSearchResultRankerInfer);
+}
+
 std::string AnswerServerUrl() {
   const std::string experiment_url =
       base::GetFieldTrialParamValueByFeature(kEnableAnswerCard, "ServerUrl");
@@ -93,5 +105,14 @@
                                                 "QuerySuffix");
 }
 
+std::string SearchResultRankerPredictorName() {
+  const std::string predictor_name = base::GetFieldTrialParamValueByFeature(
+      kEnableSearchResultRankerTrain,
+      "app_search_result_ranker_predictor_name");
+  if (!predictor_name.empty())
+    return predictor_name;
+  return std::string("MrfuAppLaunchPredictor");
+}
+
 }  // namespace features
 }  // namespace app_list

diff --git a/ash/public/cpp/app_list/app_list_features.h b/ash/public/cpp/app_list/app_list_features.h
index 3654e8b..8c353f5 100644
--- a/ash/public/cpp/app_list/app_list_features.h
+++ b/ash/public/cpp/app_list/app_list_features.h

@@ -56,6 +56,14 @@
 // Enables the feature to autocomplete text typed in the AppList search box.
 ASH_PUBLIC_EXPORT extern const base::Feature kEnableAppListSearchAutocomplete;
 
+// Enables the feature to rank app search result using AppSearchResultRanker
+// (only training).
+ASH_PUBLIC_EXPORT extern const base::Feature kEnableSearchResultRankerTrain;
+
+// Enables the feature to rank app search result using AppSearchResultRanker
+// (only inferencing).
+ASH_PUBLIC_EXPORT extern const base::Feature kEnableSearchResultRankerInfer;
+
 bool ASH_PUBLIC_EXPORT IsAnswerCardEnabled();
 bool ASH_PUBLIC_EXPORT IsAppShortcutSearchEnabled();
 bool ASH_PUBLIC_EXPORT IsBackgroundBlurEnabled();
@@ -67,8 +75,12 @@
 bool ASH_PUBLIC_EXPORT IsContinueReadingEnabled();
 bool ASH_PUBLIC_EXPORT IsZeroStateSuggestionsEnabled();
 bool ASH_PUBLIC_EXPORT IsAppListSearchAutocompleteEnabled();
+bool ASH_PUBLIC_EXPORT IsSearchResultRankerTrainEnabled();
+bool ASH_PUBLIC_EXPORT IsSearchResultRankerInferEnabled();
+
 std::string ASH_PUBLIC_EXPORT AnswerServerUrl();
 std::string ASH_PUBLIC_EXPORT AnswerServerQuerySuffix();
+std::string ASH_PUBLIC_EXPORT SearchResultRankerPredictorName();
 
 }  // namespace features
 }  // namespace app_list

diff --git a/ash/shelf/app_list_button.cc b/ash/shelf/app_list_button.cc
index 390ab2d..3688acb2 100644
--- a/ash/shelf/app_list_button.cc
+++ b/ash/shelf/app_list_button.cc

@@ -70,6 +70,7 @@
   Shell::Get()->AddShellObserver(this);
   Shell::Get()->session_controller()->AddObserver(this);
 
+  const int shelf_size = ShelfConstants::shelf_size();
   mojom::VoiceInteractionObserverPtr ptr;
   voice_interaction_binding_.Bind(mojo::MakeRequest(&ptr));
   Shell::Get()->voice_interaction_controller()->AddObserver(std::move(ptr));
@@ -78,7 +79,7 @@
   set_ink_drop_visible_opacity(kShelfInkDropVisibleOpacity);
   SetAccessibleName(
       l10n_util::GetStringUTF16(IDS_ASH_SHELF_APP_LIST_LAUNCHER_TITLE));
-  SetSize(gfx::Size(kShelfSize, kShelfSize));
+  SetSize(gfx::Size(shelf_size, shelf_size));
   SetFocusPainter(TrayPopupUtils::CreateFocusPainter());
   set_notify_action(Button::NOTIFY_ON_PRESS);
 
@@ -200,10 +201,11 @@
 
 std::unique_ptr<views::InkDropRipple> AppListButton::CreateInkDropRipple()
     const {
+  const int app_list_button_radius = ShelfConstants::app_list_button_radius();
   gfx::Point center = GetCenterPoint();
-  gfx::Rect bounds(center.x() - kAppListButtonRadius,
-                   center.y() - kAppListButtonRadius, 2 * kAppListButtonRadius,
-                   2 * kAppListButtonRadius);
+  gfx::Rect bounds(center.x() - app_list_button_radius,
+                   center.y() - app_list_button_radius,
+                   2 * app_list_button_radius, 2 * app_list_button_radius);
   return std::make_unique<views::FloodFillInkDropRipple>(
       size(), GetLocalBounds().InsetsFrom(bounds),
       GetInkDropCenterBasedOnLastEvent(), GetInkDropBaseColor(),
@@ -232,8 +234,8 @@
 }
 
 std::unique_ptr<views::InkDropMask> AppListButton::CreateInkDropMask() const {
-  return std::make_unique<views::CircleInkDropMask>(size(), GetCenterPoint(),
-                                                    kAppListButtonRadius);
+  return std::make_unique<views::CircleInkDropMask>(
+      size(), GetCenterPoint(), ShelfConstants::app_list_button_radius());
 }
 
 void AppListButton::PaintButtonContents(gfx::Canvas* canvas) {

diff --git a/ash/shelf/back_button.cc b/ash/shelf/back_button.cc
index 5aed690f..59f1892 100644
--- a/ash/shelf/back_button.cc
+++ b/ash/shelf/back_button.cc

@@ -33,8 +33,9 @@
   set_ink_drop_base_color(kShelfInkDropBaseColor);
   set_ink_drop_visible_opacity(kShelfInkDropVisibleOpacity);
 
+  const int shelf_size = ShelfConstants::shelf_size();
   SetAccessibleName(l10n_util::GetStringUTF16(IDS_ASH_SHELF_BACK_BUTTON_TITLE));
-  SetSize(gfx::Size(kShelfSize, kShelfSize));
+  SetSize(gfx::Size(shelf_size, shelf_size));
   SetFocusPainter(TrayPopupUtils::CreateFocusPainter());
 }
 
@@ -69,7 +70,9 @@
 
 std::unique_ptr<views::InkDropRipple> BackButton::CreateInkDropRipple() const {
   return std::make_unique<views::FloodFillInkDropRipple>(
-      size(), gfx::Insets(kShelfButtonSize / 2 - kAppListButtonRadius),
+      size(),
+      gfx::Insets(ShelfConstants::button_size() / 2 -
+                  ShelfConstants::app_list_button_radius()),
       GetInkDropCenterBasedOnLastEvent(), GetInkDropBaseColor(),
       ink_drop_visible_opacity());
 }
@@ -82,8 +85,8 @@
 }
 
 std::unique_ptr<views::InkDropMask> BackButton::CreateInkDropMask() const {
-  return std::make_unique<views::CircleInkDropMask>(size(), GetCenterPoint(),
-                                                    kAppListButtonRadius);
+  return std::make_unique<views::CircleInkDropMask>(
+      size(), GetCenterPoint(), ShelfConstants::app_list_button_radius());
 }
 
 void BackButton::PaintButtonContents(gfx::Canvas* canvas) {

diff --git a/ash/shelf/overflow_button.cc b/ash/shelf/overflow_button.cc
index 283c72c..2d88458 100644
--- a/ash/shelf/overflow_button.cc
+++ b/ash/shelf/overflow_button.cc

@@ -155,7 +155,7 @@
 std::unique_ptr<views::InkDropMask> OverflowButton::CreateInkDropMask() const {
   gfx::Insets insets = GetLocalBounds().InsetsFrom(CalculateButtonBounds());
   return std::make_unique<views::RoundRectInkDropMask>(
-      size(), insets, kOverflowButtonCornerRadius);
+      size(), insets, ShelfConstants::overflow_button_corner_radius());
 }
 
 void OverflowButton::PaintButtonContents(gfx::Canvas* canvas) {
@@ -169,7 +169,8 @@
   cc::PaintFlags flags;
   flags.setAntiAlias(true);
   flags.setColor(background_color_);
-  canvas->DrawRoundRect(bounds, kOverflowButtonCornerRadius, flags);
+  canvas->DrawRoundRect(bounds, ShelfConstants::overflow_button_corner_radius(),
+                        flags);
 }
 
 void OverflowButton::PaintForeground(gfx::Canvas* canvas,
@@ -187,16 +188,17 @@
 }
 
 gfx::Rect OverflowButton::CalculateButtonBounds() const {
+  const int overflow_button_size = ShelfConstants::overflow_button_size();
   ShelfAlignment alignment = shelf_->alignment();
   gfx::Rect content_bounds = GetContentsBounds();
   // Align the button to the top of a bottom-aligned shelf, to the right edge
   // a left-aligned shelf, and to the left edge of a right-aligned shelf.
-  const int inset = (kShelfSize - kOverflowButtonSize) / 2;
+  const int inset = (ShelfConstants::shelf_size() - overflow_button_size) / 2;
   const int x = alignment == SHELF_ALIGNMENT_LEFT
-                    ? content_bounds.right() - inset - kOverflowButtonSize
+                    ? content_bounds.right() - inset - overflow_button_size
                     : content_bounds.x() + inset;
-  return gfx::Rect(x, content_bounds.y() + inset, kOverflowButtonSize,
-                   kOverflowButtonSize);
+  return gfx::Rect(x, content_bounds.y() + inset, overflow_button_size,
+                   overflow_button_size);
 }
 
 }  // namespace ash

diff --git a/ash/shelf/shelf_button.cc b/ash/shelf/shelf_button.cc
index 67c3865e..6cb9d4d 100644
--- a/ash/shelf/shelf_button.cc
+++ b/ash/shelf/shelf_button.cc

@@ -36,10 +36,8 @@
 
 namespace {
 
-constexpr int kIconSize = 32;
 constexpr int kStatusIndicatorAttentionThrobDurationMS = 800;
 constexpr int kStatusIndicatorMaxAnimationSeconds = 10;
-constexpr int kStatusIndicatorOffsetFromBottom = 3;
 constexpr int kStatusIndicatorRadiusDip = 2;
 constexpr int kStatusIndicatorMaxSize = 10;
 constexpr int kStatusIndicatorActiveSize = 8;
@@ -52,11 +50,6 @@
 constexpr int kInkDropSmallSize = 48;
 constexpr int kInkDropLargeSize = 60;
 
-// Padding from the edge of the shelf to the application icon when the shelf
-// is horizontally and vertically aligned, respectively.
-constexpr int kIconPaddingHorizontal = 7;
-constexpr int kIconPaddingVertical = 8;
-
 // The time threshold before an item can be dragged.
 constexpr int kDragTimeThresholdMs = 300;
 
@@ -377,13 +370,20 @@
     return;
   }
 
+  const int icon_size = ShelfConstants::button_icon_size();
+
+  if (icon_size > image.width() || icon_size > image.height()) {
+    LOG(WARNING) << "An icon of size " << image.width() << "x" << image.height()
+                 << "is being scaled up and will look blurry.";
+  }
+
   // Resize the image maintaining our aspect ratio.
   float aspect_ratio =
       static_cast<float>(image.width()) / static_cast<float>(image.height());
-  int height = kIconSize;
+  int height = icon_size;
   int width = static_cast<int>(aspect_ratio * height);
-  if (width > kIconSize) {
-    width = kIconSize;
+  if (width > icon_size) {
+    width = icon_size;
     height = static_cast<int>(width / aspect_ratio);
   }
 
@@ -530,21 +530,28 @@
 }
 
 void ShelfButton::Layout() {
+  // TODO: Find out why there is an extra pixel of padding between each item
+  // and the inner side of the shelf.
+  int icon_padding =
+      (ShelfConstants::shelf_size() - ShelfConstants::button_icon_size()) / 2 -
+      1;
+  const int icon_size = ShelfConstants::button_icon_size();
+  const int status_indicator_offet_from_shelf_edge =
+      ShelfConstants::status_indicator_offset_from_edge();
+
   const gfx::Rect button_bounds(GetContentsBounds());
   Shelf* shelf = shelf_view_->shelf();
   const bool is_horizontal_shelf = shelf->IsHorizontalAlignment();
-  const int icon_pad =
-      is_horizontal_shelf ? kIconPaddingHorizontal : kIconPaddingVertical;
-  int x_offset = is_horizontal_shelf ? 0 : icon_pad;
-  int y_offset = is_horizontal_shelf ? icon_pad : 0;
+  int x_offset = is_horizontal_shelf ? 0 : icon_padding;
+  int y_offset = is_horizontal_shelf ? icon_padding : 0;
 
-  int icon_width = std::min(kIconSize, button_bounds.width() - x_offset);
-  int icon_height = std::min(kIconSize, button_bounds.height() - y_offset);
+  int icon_width = std::min(icon_size, button_bounds.width() - x_offset);
+  int icon_height = std::min(icon_size, button_bounds.height() - y_offset);
 
   // If on the left or top 'invert' the inset so the constant gap is on
   // the interior (towards the center of display) edge of the shelf.
   if (SHELF_ALIGNMENT_LEFT == shelf->alignment())
-    x_offset = button_bounds.width() - (kIconSize + icon_pad);
+    x_offset = button_bounds.width() - (icon_size + icon_padding);
 
   // Center icon with respect to the secondary axis.
   if (is_horizontal_shelf)
@@ -577,24 +584,24 @@
   // Icon size has been incorrect when running
   // PanelLayoutManagerTest.PanelAlignmentSecondDisplay on valgrind bot, see
   // http://crbug.com/234854.
-  DCHECK_LE(icon_width, kIconSize);
-  DCHECK_LE(icon_height, kIconSize);
+  DCHECK_LE(icon_width, icon_size);
+  DCHECK_LE(icon_height, icon_size);
 
   switch (shelf->alignment()) {
     case SHELF_ALIGNMENT_BOTTOM:
     case SHELF_ALIGNMENT_BOTTOM_LOCKED:
       indicator_midpoint.set_y(button_bounds.bottom() -
                                kStatusIndicatorRadiusDip -
-                               kStatusIndicatorOffsetFromBottom);
+                               status_indicator_offet_from_shelf_edge);
       break;
     case SHELF_ALIGNMENT_LEFT:
       indicator_midpoint.set_x(button_bounds.x() + kStatusIndicatorRadiusDip +
-                               kStatusIndicatorOffsetFromBottom);
+                               status_indicator_offet_from_shelf_edge);
       break;
     case SHELF_ALIGNMENT_RIGHT:
       indicator_midpoint.set_x(button_bounds.right() -
                                kStatusIndicatorRadiusDip -
-                               kStatusIndicatorOffsetFromBottom);
+                               status_indicator_offet_from_shelf_edge);
       break;
   }
 

diff --git a/ash/shelf/shelf_constants.h b/ash/shelf/shelf_constants.h
index 25a1414..6067258 100644
--- a/ash/shelf/shelf_constants.h
+++ b/ash/shelf/shelf_constants.h

@@ -6,13 +6,21 @@
 #define ASH_SHELF_SHELF_CONSTANTS_H_
 
 #include "ash/ash_export.h"
+#include "chromeos/chromeos_switches.h"
 #include "third_party/skia/include/core/SkColor.h"
 
 namespace ash {
 
+// TODO: Once the new shelf UI is on everywhere, clean-up duplicate constants.
+
 // Size of the shelf when visible (height when the shelf is horizontal and
 // width when the shelf is vertical).
-ASH_EXPORT constexpr int kShelfSize = 48;
+constexpr int kShelfSize = 48;
+constexpr int kShelfSizeNewUi = 56;
+
+// Size of the icons within shelf buttons.
+constexpr int kShelfButtonIconSize = 32;
+constexpr int kShelfButtonIconSizeNewUi = 44;
 
 // We reserve a small area on the edge of the workspace area to ensure that
 // the resize handle at the edge of the window can be hit.
@@ -34,6 +42,7 @@
 
 // Size allocated for each app button on the shelf.
 ASH_EXPORT constexpr int kShelfButtonSize = 48;
+ASH_EXPORT constexpr int kShelfButtonSizeNewUi = 56;
 
 // Size of the space between buttons on the shelf.
 ASH_EXPORT constexpr int kShelfButtonSpacing = 16;
@@ -68,16 +77,67 @@
 
 // The width and height of the material design overflow button.
 constexpr int kOverflowButtonSize = 32;
+constexpr int kOverflowButtonSizeNewUi = 40;
 
 // The radius of the rounded corners of the overflow button.
-constexpr int kOverflowButtonCornerRadius = 2;
+constexpr int kOverflowButtonCornerRadiusOldUi = 2;
 
-// The radius of the circular material design app list button.
-constexpr int kAppListButtonRadius = kOverflowButtonSize / 2;
+// The distance between the edge of the shelf and the status indicators.
+constexpr int kStatusIndicatorOffsetFromShelfEdge = 3;
+constexpr int kStatusIndicatorOffsetFromShelfEdgeNewUi = 2;
 
 // The direction of the focus cycling.
 enum CycleDirection { CYCLE_FORWARD, CYCLE_BACKWARD };
 
+class ShelfConstants {
+ public:
+  // Size of the shelf when visible (height when the shelf is horizontal and
+  // width when the shelf is vertical).
+  static int shelf_size() { return UseNewUi() ? kShelfSizeNewUi : kShelfSize; }
+
+  // Size allocated for each app button on the shelf.
+  static int button_size() {
+    return UseNewUi() ? kShelfButtonSizeNewUi : kShelfButtonSize;
+  }
+
+  // Size of the space between buttons on the shelf.
+  static int button_spacing() {
+    return UseNewUi() ? kShelfButtonSpacingNewUi : kShelfButtonSpacing;
+  }
+
+  // Size of the icons within shelf buttons.
+  static int button_icon_size() {
+    return UseNewUi() ? kShelfButtonIconSizeNewUi : kShelfButtonIconSize;
+  }
+
+  // The width and height of the material design overflow button.
+  static int overflow_button_size() {
+    return UseNewUi() ? kOverflowButtonSizeNewUi : kOverflowButtonSize;
+  }
+
+  // The radius of the rounded corners of the overflow button.
+  static int overflow_button_corner_radius() {
+    return UseNewUi() ? overflow_button_size() / 2
+                      : kOverflowButtonCornerRadiusOldUi;
+  }
+
+  // The radius of the circular material design app list button.
+  static int app_list_button_radius() { return overflow_button_size() / 2; }
+
+  // The distance between the edge of the shelf and the status indicators.
+  static int status_indicator_offset_from_edge() {
+    return UseNewUi() ? kStatusIndicatorOffsetFromShelfEdgeNewUi
+                      : kStatusIndicatorOffsetFromShelfEdge;
+  }
+
+ private:
+  static bool UseNewUi() {
+    static bool use_new_ui = chromeos::switches::ShouldUseShelfNewUi();
+    return use_new_ui;
+  }
+  DISALLOW_IMPLICIT_CONSTRUCTORS(ShelfConstants);
+};
+
 }  // namespace ash
 
 #endif  // ASH_SHELF_SHELF_CONSTANTS_H_

diff --git a/ash/shelf/shelf_layout_manager.cc b/ash/shelf/shelf_layout_manager.cc
index ccebe52..13bfcb2 100644
--- a/ash/shelf/shelf_layout_manager.cc
+++ b/ash/shelf/shelf_layout_manager.cc

@@ -202,12 +202,13 @@
 }
 
 gfx::Rect ShelfLayoutManager::GetIdealBounds() {
+  const int shelf_size = ShelfConstants::shelf_size();
   aura::Window* shelf_window = shelf_widget_->GetNativeWindow();
   gfx::Rect rect(screen_util::GetDisplayBoundsInParent(shelf_window));
   return SelectValueForShelfAlignment(
-      gfx::Rect(rect.x(), rect.bottom() - kShelfSize, rect.width(), kShelfSize),
-      gfx::Rect(rect.x(), rect.y(), kShelfSize, rect.height()),
-      gfx::Rect(rect.right() - kShelfSize, rect.y(), kShelfSize,
+      gfx::Rect(rect.x(), rect.bottom() - shelf_size, rect.width(), shelf_size),
+      gfx::Rect(rect.x(), rect.y(), shelf_size, rect.height()),
+      gfx::Rect(rect.right() - shelf_size, rect.y(), shelf_size,
                 rect.height()));
 }
 
@@ -746,7 +747,7 @@
 
 void ShelfLayoutManager::CalculateTargetBounds(const State& state,
                                                TargetBounds* target_bounds) {
-  int shelf_size = kShelfSize;
+  int shelf_size = ShelfConstants::shelf_size();
   if (state.visibility_state == SHELF_AUTO_HIDE &&
       state.auto_hide_state == SHELF_AUTO_HIDE_HIDDEN) {
     // Auto-hidden shelf always starts with the default size. If a gesture-drag
@@ -779,9 +780,9 @@
   gfx::Size status_size(
       shelf_widget_->status_area_widget()->GetWindowBoundsInScreen().size());
   if (shelf_->IsHorizontalAlignment())
-    status_size.set_height(kShelfSize);
+    status_size.set_height(shelf_size);
   else
-    status_size.set_width(kShelfSize);
+    status_size.set_width(shelf_size);
 
   gfx::Point status_origin = SelectValueForShelfAlignment(
       gfx::Point(0, 0),
@@ -856,7 +857,7 @@
     // changed since then, e.g. because the tray-menu was shown because of the
     // drag), then allow the drag some resistance-free region at first to make
     // sure the shelf sticks with the finger until the shelf is visible.
-    resistance_free_region = kShelfSize - kShelfAutoHideSize;
+    resistance_free_region = ShelfConstants::shelf_size() - kShelfAutoHideSize;
   }
 
   bool resist = SelectValueForShelfAlignment(
@@ -905,7 +906,8 @@
       target_bounds->status_bounds_in_shelf.set_x(0);
     } else {
       target_bounds->status_bounds_in_shelf.set_x(
-          target_bounds->shelf_bounds_in_root.width() - kShelfSize);
+          target_bounds->shelf_bounds_in_root.width() -
+          ShelfConstants::shelf_size());
     }
   }
 }
@@ -1345,13 +1347,14 @@
   float shelf_opacity = shelf_widget_->GetBackgroundAlphaValue(
                             shelf_background_type_before_drag_) /
                         static_cast<float>(ShelfBackgroundAnimator::kMaxAlpha);
-  if (launcher_above_shelf_bottom_amount_ < kShelfSize)
+  const int shelf_size = ShelfConstants::shelf_size();
+  if (launcher_above_shelf_bottom_amount_ < shelf_size)
     return shelf_opacity;
   float launcher_above_shelf_amount =
-      std::max(0.f, launcher_above_shelf_bottom_amount_ - kShelfSize);
+      std::max(0.f, launcher_above_shelf_bottom_amount_ - shelf_size);
   float coefficient =
       std::min(launcher_above_shelf_amount /
-                   (app_list::AppListView::kNumOfShelfSize * kShelfSize),
+                   (app_list::AppListView::kNumOfShelfSize * shelf_size),
                1.0f);
   float app_list_view_opacity =
       is_background_blur_enabled_

diff --git a/ash/shelf/shelf_view.cc b/ash/shelf/shelf_view.cc
index 4e21cd3..8689a2a 100644
--- a/ash/shelf/shelf_view.cc
+++ b/ash/shelf/shelf_view.cc

@@ -81,6 +81,9 @@
 constexpr int kSeparatorSize = 20;
 constexpr int kSeparatorThickness = 1;
 
+// The margin between the app list button and the first shelf item.
+constexpr int kAppListButtonMargin = 32;
+
 // White with ~20% opacity.
 constexpr SkColor kSeparatorColor = SkColorSetARGB(0x32, 0xFF, 0xFF, 0xFF);
 
@@ -903,11 +906,11 @@
   for (ShelfItem item : model_->items()) {
     if (item.type == TYPE_PINNED_APP || item.type == TYPE_APP ||
         item.type == TYPE_BROWSER_SHORTCUT) {
-      size += kShelfButtonSize;
+      size += ShelfConstants::button_size();
       added_items++;
     }
   }
-  size += (added_items - 1) * kShelfButtonSpacingNewUi;
+  size += (added_items - 1) * ShelfConstants::button_spacing();
   return size;
 }
 
@@ -939,9 +942,8 @@
 void ShelfView::CalculateIdealBounds(gfx::Rect* overflow_bounds) const {
   DCHECK(model_->item_count() == view_model_->view_size());
 
-  const int button_spacing = chromeos::switches::ShouldUseShelfNewUi()
-                                 ? kShelfButtonSpacingNewUi
-                                 : kShelfButtonSpacing;
+  const int button_spacing = ShelfConstants::button_spacing();
+  const int button_size = ShelfConstants::button_size();
 
   const int available_size = shelf_->PrimaryAxisValue(width(), height());
   const int separator_index = GetSeparatorIndex();
@@ -954,8 +956,8 @@
   int x = 0;
   int y = 0;
 
-  int w = shelf_->PrimaryAxisValue(kShelfButtonSize, width());
-  int h = shelf_->PrimaryAxisValue(height(), kShelfButtonSize);
+  int w = shelf_->PrimaryAxisValue(button_size, width());
+  int h = shelf_->PrimaryAxisValue(height(), button_size);
 
   for (int i = 0; i < view_model_->view_size(); ++i) {
     if (i < first_visible_index_) {
@@ -975,7 +977,8 @@
           status_widget->GetWindowBoundsInScreen().height());
       int padding_for_centering =
           (available_size + status_widget_size - centered_shelf_items_size) / 2;
-      if (padding_for_centering > app_list_button_position + button_spacing) {
+      if (padding_for_centering >
+          app_list_button_position + kAppListButtonMargin) {
         // Only shift buttons to the right, never let them interfere with the
         // left-aligned system buttons.
         x = shelf_->PrimaryAxisValue(padding_for_centering, 0);
@@ -996,14 +999,22 @@
     x = shelf_->PrimaryAxisValue(x + w + (i == 0 ? 0 : button_spacing), x);
     y = shelf_->PrimaryAxisValue(y, y + h + button_spacing);
 
-    if (i == kAppListButtonIndex)
+    if (i == kAppListButtonIndex) {
       app_list_button_position = shelf_->PrimaryAxisValue(x, y);
+      if (chromeos::switches::ShouldUseShelfNewUi()) {
+        // In the new UI, a larger minimum padding after the app list button
+        // is required: increment with the necessary extra amount.
+        x += shelf_->PrimaryAxisValue(kAppListButtonMargin - button_spacing, 0);
+        y += shelf_->PrimaryAxisValue(0, kAppListButtonMargin - button_spacing);
+      }
+    }
 
     if (i == separator_index) {
       // Place the separator halfway between the two icons it separates,
       // vertically centered.
       int half_space = button_spacing / 2;
-      int secondary_offset = (kShelfSize - kSeparatorSize) / 2;
+      int secondary_offset =
+          (ShelfConstants::shelf_size() - kSeparatorSize) / 2;
       x -= shelf_->PrimaryAxisValue(half_space, 0);
       y -= shelf_->PrimaryAxisValue(0, half_space);
       separator_->SetBounds(
@@ -1619,9 +1630,11 @@
     }
 
     if (shelf_->IsHorizontalAlignment()) {
-      preferred_size = gfx::Size(last_button_bounds.right(), kShelfSize);
+      preferred_size =
+          gfx::Size(last_button_bounds.right(), ShelfConstants::shelf_size());
     } else {
-      preferred_size = gfx::Size(kShelfSize, last_button_bounds.bottom());
+      preferred_size =
+          gfx::Size(ShelfConstants::shelf_size(), last_button_bounds.bottom());
     }
   }
   gfx::Point origin(GetMirroredXWithWidthInView(0, preferred_size.width()), 0);
@@ -1687,12 +1700,13 @@
   const gfx::Rect last_button_bounds =
       last_button_index >= first_visible_index_
           ? view_model_->ideal_bounds(last_button_index)
-          : gfx::Rect(gfx::Size(kShelfSize, kShelfSize));
+          : gfx::Rect(gfx::Size(ShelfConstants::shelf_size(),
+                                ShelfConstants::shelf_size()));
 
   if (shelf_->IsHorizontalAlignment())
-    return gfx::Size(last_button_bounds.right(), kShelfSize);
+    return gfx::Size(last_button_bounds.right(), ShelfConstants::shelf_size());
 
-  return gfx::Size(kShelfSize, last_button_bounds.bottom());
+  return gfx::Size(ShelfConstants::shelf_size(), last_button_bounds.bottom());
 }
 
 void ShelfView::OnBoundsChanged(const gfx::Rect& previous_bounds) {
@@ -1724,6 +1738,7 @@
   if (overflow_mode_)
     return;
 
+  const int app_list_button_radius = ShelfConstants::app_list_button_radius();
   cc::PaintFlags flags;
   flags.setColor(shelf_item_background_color_);
   flags.setAntiAlias(true);
@@ -1736,20 +1751,22 @@
       gfx::Vector2d(GetAppListButton()->GetCenterPoint().x(),
                     GetAppListButton()->GetCenterPoint().y()));
   if (GetBackButton()->layer()->opacity() <= 0.f) {
-    canvas->DrawCircle(circle_center, kAppListButtonRadius, flags);
+    canvas->DrawCircle(circle_center, app_list_button_radius, flags);
     return;
   }
 
+  const int button_size = ShelfConstants::button_size();
   const gfx::PointF back_center(
-      GetMirroredRect(GetBackButton()->bounds()).x() + kShelfButtonSize / 2,
-      GetBackButton()->bounds().y() + kShelfButtonSize / 2);
+      GetMirroredRect(GetBackButton()->bounds()).x() + button_size / 2,
+      GetBackButton()->bounds().y() + button_size / 2);
   const gfx::RectF background_bounds(
-      std::min(back_center.x(), circle_center.x()) - kAppListButtonRadius,
-      back_center.y() - kAppListButtonRadius,
-      std::abs(circle_center.x() - back_center.x()) + 2 * kAppListButtonRadius,
-      2 * kAppListButtonRadius);
+      std::min(back_center.x(), circle_center.x()) - app_list_button_radius,
+      back_center.y() - app_list_button_radius,
+      std::abs(circle_center.x() - back_center.x()) +
+          2 * app_list_button_radius,
+      2 * app_list_button_radius);
 
-  canvas->DrawRoundRect(background_bounds, kAppListButtonRadius, flags);
+  canvas->DrawRoundRect(background_bounds, app_list_button_radius, flags);
 }
 
 views::FocusTraversable* ShelfView::GetPaneFocusTraversable() {

diff --git a/ash/system/message_center/ash_popup_alignment_delegate.cc b/ash/system/message_center/ash_popup_alignment_delegate.cc
index 0cb6439..49de6d0 100644
--- a/ash/system/message_center/ash_popup_alignment_delegate.cc
+++ b/ash/system/message_center/ash_popup_alignment_delegate.cc

@@ -63,7 +63,7 @@
   // should be reduced by the height of shelf's shown height.
   if (shelf_->GetVisibilityState() == SHELF_AUTO_HIDE &&
       shelf_->GetAutoHideState() == SHELF_AUTO_HIDE_SHOWN) {
-    tray_bubble_height_ -= kShelfSize;
+    tray_bubble_height_ -= ShelfConstants::shelf_size();
   }
 
   if (tray_bubble_height_ > 0)

diff --git a/ash/system/network/network_list.cc b/ash/system/network/network_list.cc
index 6996966d..5779add 100644
--- a/ash/system/network/network_list.cc
+++ b/ash/system/network/network_list.cc

@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "ash/metrics/user_metrics_recorder.h"
+#include "ash/public/cpp/ash_features.h"
 #include "ash/public/cpp/ash_view_ids.h"
 #include "ash/resources/vector_icons/vector_icons.h"
 #include "ash/session/session_controller.h"
@@ -947,8 +948,10 @@
   // Set up layout and apply sticky row property.
   TriView* connection_warning = TrayPopupUtils::CreateDefaultRowView();
   TrayPopupUtils::ConfigureAsStickyHeader(connection_warning);
-  connection_warning->SetBackground(
-      views::CreateSolidBackground(kHeaderBackgroundColor));
+  if (!features::IsSystemTrayUnifiedEnabled()) {
+    connection_warning->SetBackground(
+        views::CreateSolidBackground(kHeaderBackgroundColor));
+  }
 
   // Set 'info' icon on left side.
   views::ImageView* image_view = TrayPopupUtils::CreateMainImageView();

diff --git a/ash/system/status_area_widget_delegate.cc b/ash/system/status_area_widget_delegate.cc
index 1772ce3e..8bcc202c 100644
--- a/ash/system/status_area_widget_delegate.cc
+++ b/ash/system/status_area_widget_delegate.cc

@@ -195,7 +195,7 @@
                                                 bool extend_border_to_edge) {
   // Tray views are laid out right-to-left or bottom-to-top.
   const bool horizontal_alignment = shelf_->IsHorizontalAlignment();
-  const int padding = (kShelfSize - kTrayItemSize) / 2;
+  const int padding = (ShelfConstants::shelf_size() - kTrayItemSize) / 2;
 
   const int top_edge = horizontal_alignment ? padding : 0;
   const int left_edge = horizontal_alignment ? 0 : padding;

diff --git a/ash/system/tray/tray_background_view.cc b/ash/system/tray/tray_background_view.cc
index 150e307..644ff923 100644
--- a/ash/system/tray/tray_background_view.cc
+++ b/ash/system/tray/tray_background_view.cc

@@ -366,15 +366,16 @@
   // underneath the items instead.
   const gfx::Rect local_bounds = GetLocalBounds();
   const SkColor color = SkColorSetA(SK_ColorWHITE, 0x4D);
+  const int shelf_size = ShelfConstants::shelf_size();
 
   if (shelf_->IsHorizontalAlignment()) {
     const gfx::PointF point(
         base::i18n::IsRTL() ? 0 : (local_bounds.width() - kSeparatorWidth),
-        (kShelfSize - kTrayItemSize) / 2);
+        (shelf_size - kTrayItemSize) / 2);
     const gfx::Vector2dF vector(0, kTrayItemSize);
     canvas->Draw1pxLine(point, point + vector, color);
   } else {
-    const gfx::PointF point((kShelfSize - kTrayItemSize) / 2,
+    const gfx::PointF point((shelf_size - kTrayItemSize) / 2,
                             local_bounds.height() - kSeparatorWidth);
     const gfx::Vector2dF vector(kTrayItemSize, 0);
     canvas->Draw1pxLine(point, point + vector, color);

diff --git a/base/BUILD.gn b/base/BUILD.gn
index afd66c3..1b9cb36c 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn

@@ -29,7 +29,7 @@
 import("//build/config/sysroot.gni")
 import("//build/config/ui.gni")
 import("//build/nocompile.gni")
-import("//build/util/lastchange.gni")
+import("//build/timestamp.gni")
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//testing/test.gni")
 
@@ -181,6 +181,7 @@
     "android/content_uri_utils.h",
     "android/cpu_features.cc",
     "android/early_trace_event_binding.cc",
+    "android/early_trace_event_binding.h",
     "android/event_log.cc",
     "android/event_log.h",
     "android/field_trial_list.cc",
@@ -617,6 +618,8 @@
     "metrics/sparse_histogram.h",
     "metrics/statistics_recorder.cc",
     "metrics/statistics_recorder.h",
+    "metrics/ukm_source_id.cc",
+    "metrics/ukm_source_id.h",
     "metrics/user_metrics.cc",
     "metrics/user_metrics.h",
     "metrics/user_metrics_action.h",
@@ -2768,22 +2771,14 @@
 action("build_date") {
   script = "//build/write_build_date_header.py"
 
-  # Force recalculation if there's been a change.
-  inputs = [
-    lastchange_file,
-  ]
   outputs = [
     "$target_gen_dir/generated_build_date.h",
   ]
 
-  args =
-      [ rebase_path("$target_gen_dir/generated_build_date.h", root_build_dir) ]
-
-  if (is_official_build) {
-    args += [ "official" ]
-  } else {
-    args += [ "default" ]
-  }
+  args = [
+    rebase_path("$target_gen_dir/generated_build_date.h", root_build_dir),
+    build_timestamp,
+  ]
 }
 
 if (enable_nocompile_tests) {

diff --git a/base/android/early_trace_event_binding.cc b/base/android/early_trace_event_binding.cc
index bf6b910..d5f5e79c 100644
--- a/base/android/early_trace_event_binding.cc
+++ b/base/android/early_trace_event_binding.cc

@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/android/early_trace_event_binding.h"
+
 #include <stdint.h>
 
 #include "base/android/jni_string.h"
@@ -63,5 +65,17 @@
       base::TimeTicks() + base::TimeDelta::FromMicroseconds(timestamp_us));
 }
 
+bool GetBackgroundStartupTracingFlag() {
+  JNIEnv* env = base::android::AttachCurrentThread();
+  return base::android::Java_EarlyTraceEvent_getBackgroundStartupTracingFlag(
+      env);
+}
+
+void SetBackgroundStartupTracingFlag(bool enabled) {
+  JNIEnv* env = base::android::AttachCurrentThread();
+  base::android::Java_EarlyTraceEvent_setBackgroundStartupTracingFlag(env,
+                                                                      enabled);
+}
+
 }  // namespace android
 }  // namespace base

diff --git a/base/android/early_trace_event_binding.h b/base/android/early_trace_event_binding.h
new file mode 100644
index 0000000..617f804
--- /dev/null
+++ b/base/android/early_trace_event_binding.h

@@ -0,0 +1,24 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_ANDROID_EARLY_TRACE_EVENT_BINDING_H_
+#define BASE_ANDROID_EARLY_TRACE_EVENT_BINDING_H_
+
+#include "base/base_export.h"
+
+namespace base {
+namespace android {
+
+// Returns true if background startup tracing flag was set on the previous
+// startup.
+BASE_EXPORT bool GetBackgroundStartupTracingFlag();
+
+// Sets a flag to chrome application preferences to enable startup tracing next
+// time the app is started.
+BASE_EXPORT void SetBackgroundStartupTracingFlag(bool enabled);
+
+}  // namespace android
+}  // namespace base
+
+#endif  // BASE_ANDROID_EARLY_TRACE_EVENT_BINDING_H_

diff --git a/base/android/java/src/org/chromium/base/EarlyTraceEvent.java b/base/android/java/src/org/chromium/base/EarlyTraceEvent.java
index 0f64fc2..25cef80 100644
--- a/base/android/java/src/org/chromium/base/EarlyTraceEvent.java
+++ b/base/android/java/src/org/chromium/base/EarlyTraceEvent.java

@@ -10,6 +10,7 @@
 import android.os.StrictMode;
 import android.os.SystemClock;
 
+import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.annotations.MainDex;
 
@@ -100,6 +101,9 @@
     @VisibleForTesting static final int STATE_FINISHING = 2;
     @VisibleForTesting static final int STATE_FINISHED = 3;
 
+    private static final String BACKGROUND_STARTUP_TRACING_ENABLED_KEY = "bg_startup_tracing";
+    private static boolean sCachedBackgroundStartupTracingFlag = false;
+
     // Locks the fields below.
     private static final Object sLock = new Object();
 
@@ -115,6 +119,7 @@
      */
     static void maybeEnable() {
         ThreadUtils.assertOnUiThread();
+        if (sState != STATE_DISABLED) return;
         boolean shouldEnable = false;
         // Checking for the trace config filename touches the disk.
         StrictMode.ThreadPolicy oldPolicy = StrictMode.allowThreadDiskReads();
@@ -128,6 +133,18 @@
                     // Access denied, not enabled.
                 }
             }
+            if (ContextUtils.getAppSharedPreferences().getBoolean(
+                        BACKGROUND_STARTUP_TRACING_ENABLED_KEY, false)) {
+                if (shouldEnable) {
+                    // If user has enabled tracing, then force disable background tracing for this
+                    // session.
+                    setBackgroundStartupTracingFlag(false);
+                    sCachedBackgroundStartupTracingFlag = false;
+                } else {
+                    sCachedBackgroundStartupTracingFlag = true;
+                    shouldEnable = true;
+                }
+            }
         } finally {
             StrictMode.setThreadPolicy(oldPolicy);
         }
@@ -175,6 +192,28 @@
         return sState == STATE_ENABLED;
     }
 
+    /**
+     * Sets the background startup tracing enabled in app preferences for next startup.
+     */
+    @CalledByNative
+    static void setBackgroundStartupTracingFlag(boolean enabled) {
+        ContextUtils.getAppSharedPreferences()
+                .edit()
+                .putBoolean(BACKGROUND_STARTUP_TRACING_ENABLED_KEY, enabled)
+                .apply();
+    }
+
+    /**
+     * Returns true if the background startup tracing flag is set.
+     *
+     * This does not return the correct value if called before maybeEnable() was called. But that is
+     * called really early in startup.
+     */
+    @CalledByNative
+    public static boolean getBackgroundStartupTracingFlag() {
+        return sCachedBackgroundStartupTracingFlag;
+    }
+
     /** @see {@link TraceEvent#begin()}. */
     public static void begin(String name) {
         // begin() and end() are going to be called once per TraceEvent, this avoids entering a

diff --git a/base/android/javatests/src/org/chromium/base/EarlyTraceEventTest.java b/base/android/javatests/src/org/chromium/base/EarlyTraceEventTest.java
index 59a478ac..dfd2320 100644
--- a/base/android/javatests/src/org/chromium/base/EarlyTraceEventTest.java
+++ b/base/android/javatests/src/org/chromium/base/EarlyTraceEventTest.java

@@ -269,4 +269,37 @@
         EarlyTraceEvent.Event event = EarlyTraceEvent.sCompletedEvents.get(0);
         Assert.assertEquals(threadId[0], event.mThreadId);
     }
+
+    @Test
+    @SmallTest
+    @Feature({"Android-AppBase"})
+    public void testEnableAtStartup() {
+        ThreadUtils.setThreadAssertsDisabledForTesting(true);
+        EarlyTraceEvent.maybeEnable();
+        Assert.assertFalse(EarlyTraceEvent.enabled());
+        EarlyTraceEvent.setBackgroundStartupTracingFlag(false);
+        Assert.assertFalse(EarlyTraceEvent.enabled());
+
+        EarlyTraceEvent.setBackgroundStartupTracingFlag(true);
+        EarlyTraceEvent.maybeEnable();
+        Assert.assertTrue(EarlyTraceEvent.getBackgroundStartupTracingFlag());
+        Assert.assertTrue(EarlyTraceEvent.enabled());
+        EarlyTraceEvent.disable();
+        EarlyTraceEvent.setBackgroundStartupTracingFlag(false);
+    }
+
+    @Test
+    @SmallTest
+    @Feature({"Android-AppBase"})
+    public void testUserOverrideBackgroundTracing() {
+        ThreadUtils.setThreadAssertsDisabledForTesting(true);
+        // Setting command line should disable the background tracing flag.
+        CommandLine.getInstance().appendSwitch("trace-startup");
+        EarlyTraceEvent.setBackgroundStartupTracingFlag(true);
+        EarlyTraceEvent.maybeEnable();
+        Assert.assertFalse(EarlyTraceEvent.getBackgroundStartupTracingFlag());
+        Assert.assertTrue(EarlyTraceEvent.enabled());
+        EarlyTraceEvent.disable();
+        EarlyTraceEvent.setBackgroundStartupTracingFlag(false);
+    }
 }

diff --git a/base/metrics/ukm_source_id.cc b/base/metrics/ukm_source_id.cc
new file mode 100644
index 0000000..220cffa
--- /dev/null
+++ b/base/metrics/ukm_source_id.cc

@@ -0,0 +1,50 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/metrics/ukm_source_id.h"
+
+#include "base/atomic_sequence_num.h"
+#include "base/logging.h"
+#include "base/rand_util.h"
+
+namespace base {
+
+namespace {
+
+const int64_t kLowBitsMask = (INT64_C(1) << 32) - 1;
+const int64_t kNumTypeBits = 2;
+const int64_t kTypeMask = (INT64_C(1) << kNumTypeBits) - 1;
+
+}  // namespace
+
+// static
+UkmSourceId UkmSourceId::New() {
+  // Generate some bits which are unique to this process, so we can generate
+  // IDs independently in different processes. IDs generated by this method may
+  // collide, but it should be sufficiently rare enough to not impact data
+  // quality.
+  const static int64_t process_id_bits =
+      static_cast<int64_t>(RandUint64()) & ~kLowBitsMask;
+  // Generate some bits which are unique within the process, using a counter.
+  static AtomicSequenceNumber seq;
+  UkmSourceId local_id = FromOtherId(seq.GetNext() + 1, UkmSourceId::Type::UKM);
+  // Combine the local and process bits to generate a unique ID.
+  return UkmSourceId((local_id.value_ & kLowBitsMask) | process_id_bits);
+}
+
+// static
+UkmSourceId UkmSourceId::FromOtherId(int64_t other_id, UkmSourceId::Type type) {
+  const int64_t type_bits = static_cast<int64_t>(type);
+  DCHECK_EQ(type_bits, type_bits & kTypeMask);
+  // Stores the the type ID in the low bits of the source id, and shift the rest
+  // of the ID to make room.  This could cause the original ID to overflow, but
+  // that should be rare enough that it won't matter for UKM's purposes.
+  return UkmSourceId((other_id << kNumTypeBits) | type_bits);
+}
+
+UkmSourceId::Type UkmSourceId::GetType() const {
+  return static_cast<UkmSourceId::Type>(value_ & kTypeMask);
+}
+
+}  // namespace base

diff --git a/base/metrics/ukm_source_id.h b/base/metrics/ukm_source_id.h
new file mode 100644
index 0000000..fd3ad2f8
--- /dev/null
+++ b/base/metrics/ukm_source_id.h

@@ -0,0 +1,73 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_METRICS_UKM_SOURCE_ID_H_
+#define BASE_METRICS_UKM_SOURCE_ID_H_
+
+#include <stdint.h>
+
+#include "base/base_export.h"
+
+namespace base {
+
+// An ID used to identify a Source to UKM, for recording information about it.
+// These objects are copyable, assignable, and occupy 64-bits per instance.
+// Prefer passing them by value.
+class BASE_EXPORT UkmSourceId {
+ public:
+  enum class Type : int64_t {
+    UKM = 0,
+    NAVIGATION_ID = 1,
+    APP_ID = 2,
+  };
+
+  // Default constructor has the invalid value.
+  constexpr UkmSourceId() : value_(0) {}
+
+  constexpr UkmSourceId& operator=(UkmSourceId other) {
+    value_ = other.value_;
+    return *this;
+  }
+
+  // Allow identity comparisons.
+  constexpr bool operator==(UkmSourceId other) const {
+    return value_ == other.value_;
+  }
+  constexpr bool operator!=(UkmSourceId other) const {
+    return value_ != other.value_;
+  }
+
+  // Allow coercive comparisons to simplify test migration.
+  // TODO(crbug/873866): Remove these once callers are migrated.
+  constexpr bool operator==(int64_t other) const { return value_ == other; }
+  constexpr bool operator!=(int64_t other) const { return value_ == other; }
+
+  // Extract the Type of the SourceId.
+  Type GetType() const;
+
+  // Return the ID as an int64.
+  constexpr int64_t ToInt64() const { return value_; }
+
+  // Convert an int64 ID value to an ID.
+  static constexpr UkmSourceId FromInt64(int64_t internal_value) {
+    return UkmSourceId(internal_value);
+  }
+
+  // Get a new UKM-Type SourceId, which is unique within the scope of a
+  // browser session.
+  static UkmSourceId New();
+
+  // Utility for converting other unique ids to source ids.
+  static UkmSourceId FromOtherId(int64_t value, Type type);
+
+ private:
+  constexpr explicit UkmSourceId(int64_t value) : value_(value) {}
+  int64_t value_;
+};
+
+constexpr UkmSourceId kInvalidUkmSourceId = UkmSourceId();
+
+}  // namespace base
+
+#endif  // BASE_METRICS_UKM_SOURCE_ID_H_

diff --git a/build/android/gyp/util/build_utils.py b/build/android/gyp/util/build_utils.py
index 4fe15767..f1764b9 100644
--- a/build/android/gyp/util/build_utils.py
+++ b/build/android/gyp/util/build_utils.py

@@ -322,8 +322,7 @@
   zip_file.writestr(zipinfo, data, compress_type)
 
 
-def DoZip(inputs, output, base_dir=None, compress_fn=None,
-          zip_prefix_path=None):
+def DoZip(inputs, output, base_dir=None, compress_fn=None):
   """Creates a zip file from a list of files.
 
   Args:
@@ -332,7 +331,6 @@
     base_dir: Prefix to strip from inputs.
     compress_fn: Applied to each input to determine whether or not to compress.
         By default, items will be |zipfile.ZIP_STORED|.
-    zip_prefix_path: Path prepended to file path in zip file.
   """
   input_tuples = []
   for tup in inputs:
@@ -344,13 +342,11 @@
   input_tuples.sort(key=lambda tup: tup[0])
   with zipfile.ZipFile(output, 'w') as outfile:
     for zip_path, fs_path in input_tuples:
-      if zip_prefix_path:
-        zip_path = os.path.join(zip_prefix_path, zip_path)
       compress = compress_fn(zip_path) if compress_fn else None
       AddToZipHermetic(outfile, zip_path, src_path=fs_path, compress=compress)
 
 
-def ZipDir(output, base_dir, compress_fn=None, zip_prefix_path=None):
+def ZipDir(output, base_dir, compress_fn=None):
   """Creates a zip file from a directory."""
   inputs = []
   for root, _, files in os.walk(base_dir):
@@ -358,8 +354,7 @@
       inputs.append(os.path.join(root, f))
 
   with AtomicOutput(output) as f:
-    DoZip(inputs, f, base_dir, compress_fn=compress_fn,
-          zip_prefix_path=zip_prefix_path)
+    DoZip(inputs, f, base_dir, compress_fn=compress_fn)
 
 
 def MatchesGlob(path, filters):

diff --git a/build/compute_build_timestamp.py b/build/compute_build_timestamp.py
new file mode 100755
index 0000000..a7191bb
--- /dev/null
+++ b/build/compute_build_timestamp.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+"""Returns a timestamp that approximates the build date.
+
+build_type impacts the timestamp generated, both relative to the date of the
+last recent commit:
+- default: the build date is set to the most recent first Sunday of a month at
+  5:00am. The reason is that it is a time where invalidating the build cache
+  shouldn't have major reprecussions (due to lower load).
+- official: the build date is set to the current date at 5:00am, or the day
+  before if the current time is before 5:00am.
+Either way, it is guaranteed to be in the past and always in UTC.
+"""
+
+# The requirements for the timestamp:
+# (1) for the purposes of continuous integration, longer duration
+#     between cache invalidation is better, but >=1mo is preferable.
+# (2) for security purposes, timebombs would ideally be as close to
+#     the actual time of the build as possible. It must be in the past.
+# (3) HSTS certificate pinning is valid for 70 days. To make CI builds enforce
+#     HTST pinning, <=1mo is preferable.
+#
+# On Windows, the timestamp is also written in the PE/COFF file header of
+# executables of dlls.  That timestamp and the executable's file size are
+# the only two pieces of information that identify a given executable on
+# the symbol server, so rarely changing timestamps can cause conflicts there
+# as well. We only upload symbols for official builds to the symbol server.
+
+import argparse
+import calendar
+import datetime
+import doctest
+import os
+import sys
+
+
+THIS_DIR = os.path.abspath(os.path.dirname(__file__))
+
+
+def GetFirstSundayOfMonth(year, month):
+  """Returns the first sunday of the given month of the given year.
+
+  >>> GetFirstSundayOfMonth(2016, 2)
+  7
+  >>> GetFirstSundayOfMonth(2016, 3)
+  6
+  >>> GetFirstSundayOfMonth(2000, 1)
+  2
+  """
+  weeks = calendar.Calendar().monthdays2calendar(year, month)
+  # Return the first day in the first week that is a Sunday.
+  return [date_day[0] for date_day in weeks[0] if date_day[1] == 6][0]
+
+
+def GetBuildDate(build_type, utc_now):
+  """Gets the approximate build date given the specific build type.
+
+  >>> GetBuildDate('default', datetime.datetime(2016, 2, 6, 1, 2, 3))
+  datetime.datetime(2016, 1, 3, 1, 2, 3)
+  >>> GetBuildDate('default', datetime.datetime(2016, 2, 7, 5))
+  datetime.datetime(2016, 2, 7, 5, 0)
+  >>> GetBuildDate('default', datetime.datetime(2016, 2, 8, 5))
+  datetime.datetime(2016, 2, 7, 5, 0)
+  >>> GetBuildDate('official', datetime.datetime(2016, 2, 8, 5))
+  datetime.datetime(2016, 2, 8, 5, 0)
+  """
+  day = utc_now.day
+  month = utc_now.month
+  year = utc_now.year
+  if build_type != 'official':
+    first_sunday = GetFirstSundayOfMonth(year, month)
+    # If our build is after the first Sunday, we've already refreshed our build
+    # cache on a quiet day, so just use that day.
+    # Otherwise, take the first Sunday of the previous month.
+    if day >= first_sunday:
+      day = first_sunday
+    else:
+      month -= 1
+      if month == 0:
+        month = 12
+        year -= 1
+      day = GetFirstSundayOfMonth(year, month)
+  return datetime.datetime(
+      year, month, day, utc_now.hour, utc_now.minute, utc_now.second)
+
+
+def main():
+  if doctest.testmod()[0]:
+    return 1
+  argument_parser = argparse.ArgumentParser()
+  argument_parser.add_argument(
+      'build_type', help='The type of build', choices=('official', 'default'))
+  args = argument_parser.parse_args()
+
+  # The mtime of the revision in build/util/LASTCHANGE is stored in a file
+  # next to it. Read it, to get a deterministic time close to "now".
+  # That date is then modified as described at the top of the file so that
+  # it changes less frequently than with every commit.
+  # This intentionally always uses build/util/LASTCHANGE's commit time even if
+  # use_dummy_lastchange is set.
+  lastchange_file = os.path.join(THIS_DIR, 'util', 'LASTCHANGE.committime')
+  last_commit_timestamp = int(open(lastchange_file).read())
+  now = datetime.datetime.utcfromtimestamp(last_commit_timestamp)
+
+  if now.hour < 5:
+    # The time is locked at 5:00 am in UTC to cause the build cache
+    # invalidation to not happen exactly at midnight. Use the same calculation
+    # as the day before.
+    # See //base/build_time.cc.
+    now = now - datetime.timedelta(days=1)
+  now = datetime.datetime(now.year, now.month, now.day, 5, 0, 0)
+  build_date = GetBuildDate(args.build_type, now)
+  print int(calendar.timegm(build_date.utctimetuple()))
+  return 0
+
+
+if __name__ == '__main__':
+  sys.exit(main())

diff --git a/build/config/win/BUILD.gn b/build/config/win/BUILD.gn
index 5dcc9ef5..98389b6 100644
--- a/build/config/win/BUILD.gn
+++ b/build/config/win/BUILD.gn

@@ -8,6 +8,7 @@
 import("//build/config/compiler/compiler.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build/config/win/visual_studio_version.gni")
+import("//build/timestamp.gni")
 import("//build/toolchain/goma.gni")
 import("//build/toolchain/toolchain.gni")
 
@@ -106,12 +107,23 @@
     cflags += [ "/Brepro" ]
   }
 
+  ldflags = []
+
+  if (use_lld) {
+    # lld defaults to writing the current time in the pe/coff header.
+    # For build reproducibility, pass an explicit timestamp. See
+    # build/compute_build_timestamp.py for how the timestamp is chosen.
+    # (link.exe also writes the current time, but it doesn't have a flag to
+    # override that behavior.)
+    ldflags += [ "/TIMESTAMP:" + build_timestamp ]
+  }
+
   if (!is_debug && !is_component_build) {
     # Enable standard linker optimizations like GC (/OPT:REF) and ICF in static
     # release builds. These are implied by /PROFILE below, but /PROFILE is
     # incompatible with /debug:fastlink and LLD ignores it as of this writing.
     # Release builds always want these optimizations, so enable them explicitly.
-    ldflags = [
+    ldflags += [
       "/OPT:REF",
       "/OPT:ICF",
       "/INCREMENTAL:NO",

diff --git a/build/dotfile_settings.gni b/build/dotfile_settings.gni
index 8382c75..4242ec6 100644
--- a/build/dotfile_settings.gni
+++ b/build/dotfile_settings.gni

@@ -24,6 +24,7 @@
     "//build/config/sysroot.gni",
     "//build/config/win/BUILD.gn",
     "//build/config/win/visual_studio_version.gni",
+    "//build/timestamp.gni",
     "//build/toolchain/BUILD.gn",
     "//build/toolchain/concurrent_links.gni",
     "//build/toolchain/mac/BUILD.gn",

diff --git a/build/fuchsia/net_test_server.py b/build/fuchsia/net_test_server.py
index cc4e2413..e4e6c86 100644
--- a/build/fuchsia/net_test_server.py
+++ b/build/fuchsia/net_test_server.py

@@ -137,8 +137,8 @@
   logging.debug('Starting test server.')
   spawning_server = chrome_test_server_spawner.SpawningServer(
       0, SSHPortForwarder(target), test_concurrency)
-  forwarded_port = _ConnectPortForwardingTask(
-      target, spawning_server.server_port)
+  scheme = ForwardingScheme(spawning_server.server_port, 0, True)
+  forwarded_port = _ConnectPortForwardingTask(target, scheme)
   spawning_server.Start()
 
   logging.debug('Test server listening for connections (port=%d)' %

diff --git a/build/timestamp.gni b/build/timestamp.gni
new file mode 100644
index 0000000..857ff100
--- /dev/null
+++ b/build/timestamp.gni

@@ -0,0 +1,23 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# Defines the build_timestamp variable.
+
+import("//build/util/lastchange.gni")
+
+if (is_official_build) {
+  official_name = "official"
+} else {
+  official_name = "default"
+}
+
+# This will return a timestamp that's different each day (official builds)
+# of each month (regular builds).  Just rely on gn rerunning due to other
+# changes to keep this up to date.  (Bots run gn on each build, and for devs
+# the timestamp being 100% accurate doesn't matter.)
+# See compute_build_timestamp.py for tradeoffs for picking the timestamp.
+build_timestamp = exec_script("compute_build_timestamp.py",
+                              [ official_name ],
+                              "trim string",
+                              [ lastchange_file ])

diff --git a/build/toolchain/linux/unbundle/README.md b/build/toolchain/linux/unbundle/README.md
index ac5808a8..17b93c9 100644
--- a/build/toolchain/linux/unbundle/README.md
+++ b/build/toolchain/linux/unbundle/README.md

@@ -28,7 +28,7 @@
 host_toolchain="//build/toolchain/linux/unbundle:default"
 ```
 
-See [more docs on GN](https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/quick_start.md).
+See [more docs on GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md).
 
 To cross-compile (not fully tested), add the following:
 

diff --git a/build/write_build_date_header.py b/build/write_build_date_header.py
index 6628d663..7738828 100755
--- a/build/write_build_date_header.py
+++ b/build/write_build_date_header.py

@@ -2,110 +2,25 @@
 # Copyright (c) 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
-"""Writes a file that contains a define that approximates the build date.
-
-build_type impacts the timestamp generated:
-- default: the build date is set to the most recent first Sunday of a month at
-  5:00am. The reason is that it is a time where invalidating the build cache
-  shouldn't have major repercussions (due to lower load).
-- official: the build date is set to the current date at 5:00am, or the day
-  before if the current time is before 5:00am.
-Either way, it is guaranteed to be in the past and always in UTC.
-
-It is also possible to explicitly set a build date to be used.
-"""
+"""Takes a timestamp and writes it in as readable text to a .h file."""
 
 import argparse
-import calendar
 import datetime
-import doctest
 import os
 import sys
 
 
-THIS_DIR = os.path.abspath(os.path.dirname(__file__))
-
-
-def GetFirstSundayOfMonth(year, month):
-  """Returns the first sunday of the given month of the given year.
-
-  >>> GetFirstSundayOfMonth(2016, 2)
-  7
-  >>> GetFirstSundayOfMonth(2016, 3)
-  6
-  >>> GetFirstSundayOfMonth(2000, 1)
-  2
-  """
-  weeks = calendar.Calendar().monthdays2calendar(year, month)
-  # Return the first day in the first week that is a Sunday.
-  return [date_day[0] for date_day in weeks[0] if date_day[1] == 6][0]
-
-
-def GetBuildDate(build_type, utc_now):
-  """Gets the approximate build date given the specific build type.
-
-  >>> GetBuildDate('default', datetime.datetime(2016, 2, 6, 1, 2, 3))
-  'Jan 03 2016 01:02:03'
-  >>> GetBuildDate('default', datetime.datetime(2016, 2, 7, 5))
-  'Feb 07 2016 05:00:00'
-  >>> GetBuildDate('default', datetime.datetime(2016, 2, 8, 5))
-  'Feb 07 2016 05:00:00'
-  """
-  day = utc_now.day
-  month = utc_now.month
-  year = utc_now.year
-  if build_type != 'official':
-    first_sunday = GetFirstSundayOfMonth(year, month)
-    # If our build is after the first Sunday, we've already refreshed our build
-    # cache on a quiet day, so just use that day.
-    # Otherwise, take the first Sunday of the previous month.
-    if day >= first_sunday:
-      day = first_sunday
-    else:
-      month -= 1
-      if month == 0:
-        month = 12
-        year -= 1
-      day = GetFirstSundayOfMonth(year, month)
-  now = datetime.datetime(
-      year, month, day, utc_now.hour, utc_now.minute, utc_now.second)
-  return '{:%b %d %Y %H:%M:%S}'.format(now)
-
-
 def main():
-  if doctest.testmod()[0]:
-    return 1
-  argument_parser = argparse.ArgumentParser(
-      description=sys.modules[__name__].__doc__,
-      formatter_class=argparse.RawDescriptionHelpFormatter)
+  argument_parser = argparse.ArgumentParser()
   argument_parser.add_argument('output_file', help='The file to write to')
-  argument_parser.add_argument(
-      'build_type', help='The type of build', choices=('official', 'default'))
+  argument_parser.add_argument('timestamp')
   args = argument_parser.parse_args()
 
-  # The mtime of the revision in build/util/LASTCHANGE is stored in a file
-  # next to it. Read it, to get a deterministic time close to "now".
-  # That date is then modified as described at the top of the file so that
-  # it changes less frequently than with every commit.
-  # This intentionally always uses build/util/LASTCHANGE's commit time even if
-  # use_dummy_lastchange is set.
-  lastchange_file = os.path.join(THIS_DIR, 'util', 'LASTCHANGE.committime')
-  last_commit_timestamp = int(open(lastchange_file).read())
-  now = datetime.datetime.utcfromtimestamp(last_commit_timestamp)
-
-  if now.hour < 5:
-    # The time is locked at 5:00 am in UTC to cause the build cache
-    # invalidation to not happen exactly at midnight. Use the same calculation
-    # as the day before.
-    # See //base/build_time.cc.
-    now = now - datetime.timedelta(days=1)
-  now = datetime.datetime(now.year, now.month, now.day, 5, 0, 0)
-  build_date = GetBuildDate(args.build_type, now)
-
+  date = datetime.datetime.utcfromtimestamp(int(args.timestamp))
   output = ('// Generated by //build/write_build_date_header.py\n'
            '#ifndef BUILD_DATE\n'
-           '#define BUILD_DATE "{}"\n'
-           '#endif // BUILD_DATE\n'.format(build_date))
+           '#define BUILD_DATE "{:%b %d %Y %H:%M:%S}"\n'
+           '#endif // BUILD_DATE\n'.format(date))
 
   current_contents = ''
   if os.path.isfile(args.output_file):

diff --git a/cc/layers/surface_layer.cc b/cc/layers/surface_layer.cc
index b2a3e68..7f90bd5d 100644
--- a/cc/layers/surface_layer.cc
+++ b/cc/layers/surface_layer.cc

@@ -68,15 +68,8 @@
 }
 
 void SurfaceLayer::SetFallbackSurfaceId(const viz::SurfaceId& surface_id) {
-  if (surface_range_.start() == surface_id) {
-    // TODO(samans): This was added to fix https://crbug.com/827242. Remove this
-    // once fallback SurfaceIds aren't tied to SurfaceReferences, and
-    // viz::Display can handle missing fallbacks. https://crbug.com/857575
-    if (layer_tree_host())
-      layer_tree_host()->SetNeedsCommitWithForcedRedraw();
+  if (surface_range_.start() == surface_id)
     return;
-  }
-
   TRACE_EVENT_WITH_FLOW2(
       TRACE_DISABLED_BY_DEFAULT("viz.surface_id_flow"),
       "LocalSurfaceId.Submission.Flow",

diff --git a/cc/scheduler/scheduler_state_machine.cc b/cc/scheduler/scheduler_state_machine.cc
index 327e907..e259ec0 100644
--- a/cc/scheduler/scheduler_state_machine.cc
+++ b/cc/scheduler/scheduler_state_machine.cc

@@ -1123,9 +1123,6 @@
   if (active_tree_needs_first_draw_)
     return true;
 
-  if (!needs_redraw_)
-    return false;
-
   // This is used to prioritize impl-thread draws when the main thread isn't
   // producing anything, e.g., after an aborted commit. We also check that we
   // don't have a pending tree -- otherwise we should give it a chance to

diff --git a/chrome/VERSION b/chrome/VERSION
index b619aba..e7a5b66a 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=70
 MINOR=0
-BUILD=3525
+BUILD=3526
 PATCH=0

diff --git a/chrome/android/java/res/layout/keyboard_accessory.xml b/chrome/android/java/res/layout/keyboard_accessory.xml
index a99ddc40..d0c9528 100644
--- a/chrome/android/java/res/layout/keyboard_accessory.xml
+++ b/chrome/android/java/res/layout/keyboard_accessory.xml

@@ -17,7 +17,9 @@
     android:layout_height="@dimen/keyboard_accessory_height"
     android:layout_width="match_parent"
     android:paddingEnd="0dp"
-    android:paddingStart="@dimen/keyboard_accessory_padding">
+    android:paddingStart="@dimen/keyboard_accessory_padding"
+    android:clickable="true"
+    android:focusable="true">
 
     <android.support.design.widget.TabLayout
         android:id="@+id/tabs"

diff --git a/chrome/android/java/res/layout/keyboard_accessory_sheet.xml b/chrome/android/java/res/layout/keyboard_accessory_sheet.xml
index 094ed4f0..4d26fc8f 100644
--- a/chrome/android/java/res/layout/keyboard_accessory_sheet.xml
+++ b/chrome/android/java/res/layout/keyboard_accessory_sheet.xml

@@ -8,7 +8,7 @@
     android:id="@+id/keyboard_accessory_sheet"
     android:background="@android:color/white"
     android:fillViewport="true"
-    android:paddingTop="@dimen/keyboard_accessory_height"
+    android:paddingTop="0dp"
     android:layout_gravity="start|top"
     android:layout_height="@dimen/keyboard_accessory_sheet_height"
     android:layout_width="match_parent"

diff --git a/chrome/android/java/res/layout/main.xml b/chrome/android/java/res/layout/main.xml
index 34700ec3..dfd940d 100644
--- a/chrome/android/java/res/layout/main.xml
+++ b/chrome/android/java/res/layout/main.xml

@@ -25,24 +25,23 @@
             android:id="@+id/bottom_container"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_gravity="start|bottom">
+            android:layout_gravity="start|bottom" />
 
-            <ViewStub
-                android:id="@+id/keyboard_accessory_stub"
-                android:inflatedId="@+id/keyboard_accessory"
-                android:layout="@layout/keyboard_accessory"
-                android:layout_height="@dimen/keyboard_accessory_height"
-                android:layout_width="match_parent"
-                android:layout_gravity="start|top"/>
-            <ViewStub
-                android:id="@+id/keyboard_accessory_sheet_stub"
-                android:inflatedId="@+id/keyboard_accessory_sheet"
-                android:layout="@layout/keyboard_accessory_sheet"
-                android:layout_height="@dimen/keyboard_accessory_sheet_height"
-                android:layout_width="match_parent"
-                android:layout_gravity="start|bottom"/>
+        <ViewStub
+            android:id="@+id/keyboard_accessory_stub"
+            android:inflatedId="@+id/keyboard_accessory"
+            android:layout="@layout/keyboard_accessory"
+            android:layout_height="@dimen/keyboard_accessory_height"
+            android:layout_width="match_parent"
+            android:layout_gravity="start|bottom"/>
 
-        </org.chromium.chrome.browser.snackbar.BottomContainer>
+        <ViewStub
+            android:id="@+id/keyboard_accessory_sheet_stub"
+            android:inflatedId="@+id/keyboard_accessory_sheet"
+            android:layout="@layout/keyboard_accessory_sheet"
+            android:layout_height="@dimen/keyboard_accessory_sheet_height"
+            android:layout_width="match_parent"
+            android:layout_gravity="start|bottom"/>
 
         <ViewStub
             android:id="@+id/bottombar_stub"

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetCoordinator.java
index c217e017..f9434b6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetCoordinator.java

@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.autofill.keyboard_accessory;
 
 import android.support.annotation.Nullable;
+import android.support.annotation.Px;
 import android.support.v4.view.PagerAdapter;
 import android.support.v4.view.ViewPager;
 import android.view.ViewStub;
@@ -96,13 +97,21 @@
 
     /**
      * Sets the height of the accessory sheet (i.e. adapts to keyboard heights).
-     * @param height The height of the sheet.
+     * @param height The height of the sheet in pixels.
      */
-    public void setHeight(int height) {
+    public void setHeight(@Px int height) {
         mMediator.setHeight(height);
     }
 
     /**
+     * Gets the height of the accessory sheet (even if not visible).
+     * @return The height of the sheet in pixels.
+     */
+    public @Px int getHeight() {
+        return mMediator.getHeight();
+    }
+
+    /**
      * Shows the Accessory Sheet.
      */
     public void show() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetMediator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetMediator.java
index e9cd455..11cecee 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetMediator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/AccessorySheetMediator.java

@@ -7,6 +7,7 @@
 import static org.chromium.chrome.browser.autofill.keyboard_accessory.AccessorySheetModel.NO_ACTIVE_TAB;
 
 import android.support.annotation.Nullable;
+import android.support.annotation.Px;
 
 import org.chromium.base.VisibleForTesting;
 import org.chromium.chrome.browser.modelutil.PropertyObservable;
@@ -43,6 +44,10 @@
         mModel.setHeight(height);
     }
 
+    public @Px int getHeight() {
+        return mModel.getHeight();
+    }
+
     void hide() {
         mModel.setVisible(false);
     }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryCoordinator.java
index 2d65f14..357f7c5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryCoordinator.java

@@ -4,6 +4,7 @@
 
 package org.chromium.chrome.browser.autofill.keyboard_accessory;
 
+import android.support.annotation.Px;
 import android.support.v4.view.ViewPager;
 import android.view.ViewStub;
 
@@ -15,7 +16,6 @@
 import org.chromium.chrome.browser.modelutil.PropertyModelChangeProcessor;
 import org.chromium.chrome.browser.modelutil.RecyclerViewAdapter;
 import org.chromium.chrome.browser.modelutil.SimpleRecyclerViewMcp;
-import org.chromium.ui.base.WindowAndroid;
 
 /**
  * Creates and owns all elements which are part of the keyboard accessory component.
@@ -34,18 +34,11 @@
     public interface VisibilityDelegate {
         /**
          * Is triggered when a tab in the accessory was selected and the sheet needs to change.
-         * If the sheet needs to also be opened, {@link VisibilityDelegate#onOpenAccessorySheet()}
-         * is called right after this method.
          * @param tabIndex The index of the selected tab in the tab bar.
          */
         void onChangeAccessorySheet(int tabIndex);
 
         /**
-         * Called when the sheet needs to be opened.
-         */
-        void onOpenAccessorySheet();
-
-        /**
          * Called when the sheet needs to be hidden.
          */
         void onCloseAccessorySheet();
@@ -55,18 +48,21 @@
          * sheet manually because they didn't find a suitable suggestion).
          */
         void onOpenKeyboard();
+
+        /**
+         * Called when the keyboard accessory or a sheet changes visibility or size.
+         */
+        void onBottomControlSpaceChanged();
     }
 
     /**
      * Initializes the component as soon as the native library is loaded by e.g. starting to listen
      * to keyboard visibility events.
-     * @param windowAndroid The window connected to the activity this component lives in.
      * @param viewStub the stub that will become the accessory.
      */
-    public KeyboardAccessoryCoordinator(
-            WindowAndroid windowAndroid, ViewStub viewStub, VisibilityDelegate visibilityDelegate) {
+    public KeyboardAccessoryCoordinator(ViewStub viewStub, VisibilityDelegate visibilityDelegate) {
         KeyboardAccessoryModel model = new KeyboardAccessoryModel();
-        mMediator = new KeyboardAccessoryMediator(model, windowAndroid, visibilityDelegate);
+        mMediator = new KeyboardAccessoryMediator(model, visibilityDelegate);
         mViewHolder = new LazyViewBinderAdapter.StubHolder<>(viewStub);
 
         model.addObserver(new PropertyModelChangeProcessor<>(model, mViewHolder,
@@ -154,13 +150,6 @@
     }
 
     /**
-     * Used to clean up the accessory by e.g. unregister listeners to keyboard visibility.
-     */
-    public void destroy() {
-        mMediator.destroy();
-    }
-
-    /**
      * Dismisses the accessory by hiding it's view, clearing potentially left over suggestions and
      * hiding the keyboard.
      */
@@ -168,6 +157,49 @@
         mMediator.dismiss();
     }
 
+    /**
+     * Sets the offset to the end of the activity - which is usually 0, the height of the keyboard
+     * or the height of a bottom sheet.
+     * @param bottomOffset The offset in pixels.
+     */
+    public void setBottomOffset(@Px int bottomOffset) {
+        mMediator.setBottomOffset(bottomOffset);
+    }
+
+    /**
+     * Closes the accessory bar. This sends signals to close the active tab and recalculate bottom
+     * offsets.
+     */
+    public void close() {
+        mMediator.close();
+    }
+
+    /**
+     * Triggers the accessory to be shown if there are contents to be shown. Effect might therefore
+     * be delayed until contents (e.g. tabs, actions, chips) arrive.
+     */
+    public void requestShowing() {
+        mMediator.requestShowing();
+    }
+
+    /**
+     * Returns the visibility of the the accessory. The returned property reflects the latest change
+     * while the view might still be in progress of being updated accordingly.
+     * @return True if the accessory should be visible, false otherwise.
+     */
+    public boolean isShown() {
+        return mMediator.isShown();
+    }
+
+    /**
+     * Returns whether the active tab is non-null. The returned property reflects the latest change
+     * while the view might still be in progress of being updated accordingly.
+     * @return True if the accessory has an active tab, false otherwise.
+     */
+    public boolean hasActiveTab() {
+        return mMediator.hasActiveTab();
+    }
+
     @VisibleForTesting
     KeyboardAccessoryMediator getMediatorForTesting() {
         return mMediator;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMediator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMediator.java
index bed1591..c5d3d3d0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMediator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMediator.java

@@ -7,6 +7,7 @@
 import static org.chromium.chrome.browser.autofill.keyboard_accessory.AccessorySheetTrigger.MANUAL_CLOSE;
 
 import android.support.annotation.Nullable;
+import android.support.annotation.Px;
 import android.support.design.widget.TabLayout;
 
 import org.chromium.base.VisibleForTesting;
@@ -14,7 +15,6 @@
 import org.chromium.chrome.browser.autofill.keyboard_accessory.KeyboardAccessoryData.Action;
 import org.chromium.chrome.browser.modelutil.ListObservable;
 import org.chromium.chrome.browser.modelutil.PropertyObservable;
-import org.chromium.ui.base.WindowAndroid;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -29,25 +29,18 @@
  * callback to trigger when selecting them.
  */
 class KeyboardAccessoryMediator
-        implements WindowAndroid.KeyboardVisibilityListener, ListObservable.ListObserver<Void>,
+        implements ListObservable.ListObserver<Void>,
                    PropertyObservable.PropertyObserver<KeyboardAccessoryModel.PropertyKey>,
                    KeyboardAccessoryData.Observer<KeyboardAccessoryData.Action>,
                    TabLayout.OnTabSelectedListener {
     private final KeyboardAccessoryModel mModel;
-    private final WindowAndroid mWindowAndroid;
     private final VisibilityDelegate mVisibilityDelegate;
 
-    // TODO(fhorschig): Look for stronger signals than |keyboardVisibilityChanged|.
-    // This variable remembers the last state of |keyboardVisibilityChanged| which might not be
-    // sufficient for edge cases like hardware keyboards, floating keyboards, etc.
-    private boolean mIsKeyboardVisible;
+    private boolean mShowIfNotEmpty;
 
-    KeyboardAccessoryMediator(KeyboardAccessoryModel model, WindowAndroid windowAndroid,
-            VisibilityDelegate visibilityDelegate) {
+    KeyboardAccessoryMediator(KeyboardAccessoryModel model, VisibilityDelegate visibilityDelegate) {
         mModel = model;
-        mWindowAndroid = windowAndroid;
         mVisibilityDelegate = visibilityDelegate;
-        windowAndroid.addKeyboardVisibilityListener(this);
 
         // Add mediator as observer so it can use model changes as signal for accessory visibility.
         mModel.addObserver(this);
@@ -56,10 +49,6 @@
         mModel.setTabSelectionCallbacks(this);
     }
 
-    void destroy() {
-        mWindowAndroid.removeKeyboardVisibilityListener(this);
-    }
-
     @Override
     public void onItemsAvailable(int typeId, KeyboardAccessoryData.Action[] actions) {
         assert typeId != DEFAULT_TYPE : "Did not specify which Action type has been updated.";
@@ -76,10 +65,13 @@
         mModel.setActions(retainedActions.toArray(new Action[retainedActions.size()]));
     }
 
-    @Override
-    public void keyboardVisibilityChanged(boolean isShowing) {
-        if (isShowing) closeActiveTab();
-        mIsKeyboardVisible = isShowing;
+    void requestShowing() {
+        mShowIfNotEmpty = true;
+        updateVisibility();
+    }
+
+    void close() {
+        mShowIfNotEmpty = false;
         updateVisibility();
     }
 
@@ -96,7 +88,7 @@
     }
 
     void dismiss() {
-        mModel.setActiveTab(null);
+        closeActiveTab();
         updateVisibility();
     }
 
@@ -135,7 +127,8 @@
         // Update the visibility only if we haven't set it just now.
         if (propertyKey == KeyboardAccessoryModel.PropertyKey.VISIBLE) {
             // When the accessory just (dis)appeared, there should be no active tab.
-            mModel.setActiveTab(null);
+            closeActiveTab();
+            mVisibilityDelegate.onBottomControlSpaceChanged();
             if (!mModel.isVisible()) {
                 // TODO(fhorschig|ioanap): Maybe the generation bridge should take care of that.
                 onItemsAvailable(AccessoryAction.GENERATE_PASSWORD_AUTOMATIC, new Action[0]);
@@ -146,13 +139,14 @@
             Integer activeTab = mModel.activeTab();
             if (activeTab == null) {
                 mVisibilityDelegate.onCloseAccessorySheet();
+                updateVisibility();
                 return;
             }
             mVisibilityDelegate.onChangeAccessorySheet(activeTab);
-            mVisibilityDelegate.onOpenAccessorySheet();
             return;
         }
-        if (propertyKey == KeyboardAccessoryModel.PropertyKey.TAB_SELECTION_CALLBACKS) {
+        if (propertyKey == KeyboardAccessoryModel.PropertyKey.BOTTOM_OFFSET
+                || propertyKey == KeyboardAccessoryModel.PropertyKey.TAB_SELECTION_CALLBACKS) {
             return;
         }
         assert false : "Every property update needs to be handled explicitly!";
@@ -173,17 +167,28 @@
         } else {
             KeyboardAccessoryMetricsRecorder.recordSheetTrigger(
                     mModel.getTabList().get(mModel.activeTab()).getRecordingType(), MANUAL_CLOSE);
-            mModel.setActiveTab(null);
-            mVisibilityDelegate.onOpenKeyboard();
+            mVisibilityDelegate.onOpenKeyboard(); // This will close the active tab gently.
         }
     }
 
     private boolean shouldShowAccessory() {
-        if (!mIsKeyboardVisible && mModel.activeTab() == null) return false;
+        if (!mShowIfNotEmpty && mModel.activeTab() == null) return false;
         return mModel.getActionList().size() > 0 || mModel.getTabList().size() > 0;
     }
 
     private void updateVisibility() {
         mModel.setVisible(shouldShowAccessory());
     }
+
+    public void setBottomOffset(@Px int bottomOffset) {
+        mModel.setBottomOffset(bottomOffset);
+    }
+
+    public boolean isShown() {
+        return mModel.isVisible();
+    }
+
+    public boolean hasActiveTab() {
+        return mModel.isVisible() && mModel.activeTab() != null;
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMetricsRecorder.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMetricsRecorder.java
index 661890a..e5625a0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMetricsRecorder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryMetricsRecorder.java

@@ -73,6 +73,7 @@
                 return;
             }
             if (propertyKey == KeyboardAccessoryModel.PropertyKey.ACTIVE_TAB
+                    || propertyKey == KeyboardAccessoryModel.PropertyKey.BOTTOM_OFFSET
                     || propertyKey == KeyboardAccessoryModel.PropertyKey.TAB_SELECTION_CALLBACKS) {
                 return;
             }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryModel.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryModel.java
index 69db3e93..2e5a893d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryModel.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryModel.java

@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.autofill.keyboard_accessory;
 
 import android.support.annotation.Nullable;
+import android.support.annotation.Px;
 import android.support.design.widget.TabLayout;
 
 import org.chromium.chrome.browser.modelutil.ListModel;
@@ -29,6 +30,7 @@
         static final List<PropertyKey> ALL_PROPERTIES = new ArrayList<>();
 
         static final PropertyKey VISIBLE = new PropertyKey();
+        static final PropertyKey BOTTOM_OFFSET = new PropertyKey();
         static final PropertyKey ACTIVE_TAB = new PropertyKey();
         static final PropertyKey TAB_SELECTION_CALLBACKS = new PropertyKey();
 
@@ -40,6 +42,7 @@
     private ListModel<KeyboardAccessoryData.Action> mActionListObservable;
     private ListModel<KeyboardAccessoryData.Tab> mTabListObservable;
     private boolean mVisible;
+    private @Px int mBottomOffset;
     private @Nullable Integer mActiveTab;
     private TabLayout.OnTabSelectedListener mTabSelectionCallbacks;
 
@@ -86,6 +89,17 @@
         return mVisible;
     }
 
+    void setBottomOffset(@Px int bottomOffset) {
+        if (mBottomOffset == bottomOffset) return; // Nothing to do here: same value.
+        mBottomOffset = bottomOffset;
+        notifyPropertyChanged(PropertyKey.BOTTOM_OFFSET);
+    }
+
+    @Px
+    int bottomOffset() {
+        return mBottomOffset;
+    }
+
     @SuppressWarnings("ReferenceEquality") // No action if both are null or exact same object.
     void setActiveTab(@Nullable Integer activeTab) {
         if (activeTab == mActiveTab) return;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryView.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryView.java
index d084837..fa52318 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryView.java

@@ -75,6 +75,12 @@
         }
     }
 
+    public void setBottomOffset(int bottomOffset) {
+        MarginLayoutParams params = (MarginLayoutParams) getLayoutParams();
+        params.setMargins(params.leftMargin, params.topMargin, params.rightMargin, bottomOffset);
+        setLayoutParams(params);
+    }
+
     void setActionsAdapter(RecyclerView.Adapter adapter) {
         mActionsView.setAdapter(adapter);
     }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryViewBinder.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryViewBinder.java
index fd0f97f7..b488ddb8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryViewBinder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryViewBinder.java

@@ -131,6 +131,10 @@
             view.setActiveTabColor(model.activeTab());
             return;
         }
+        if (propertyKey == PropertyKey.BOTTOM_OFFSET) {
+            view.setBottomOffset(model.bottomOffset());
+            return;
+        }
         if (propertyKey == PropertyKey.TAB_SELECTION_CALLBACKS) {
             // Don't add null as listener. It's a valid state but an invalid argument.
             if (model.getTabSelectionCallbacks() == null) return;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingCoordinator.java
index 6bc858e..a86d5880 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingCoordinator.java

@@ -7,7 +7,6 @@
 import android.view.ViewStub;
 
 import org.chromium.base.VisibleForTesting;
-import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.autofill.keyboard_accessory.KeyboardAccessoryData.Provider;
 import org.chromium.ui.DropdownPopupWindow;
 import org.chromium.ui.base.WindowAndroid;
@@ -25,19 +24,17 @@
 
     /**
      * Creates a the manual filling controller.
-     * @param windowAndroid The window needed to set up the sub components.
+     * @param windowAndroid The window needed to listen to the keyboard and to connect to activity.
      * @param keyboardAccessoryStub The view stub for keyboard accessory bar.
      * @param accessorySheetStub The view stub for the keyboard accessory bottom sheet.
      */
     public ManualFillingCoordinator(WindowAndroid windowAndroid, ViewStub keyboardAccessoryStub,
             ViewStub accessorySheetStub) {
-        assert windowAndroid.getActivity().get() != null;
         KeyboardAccessoryCoordinator keyboardAccessory =
-                new KeyboardAccessoryCoordinator(windowAndroid, keyboardAccessoryStub, mMediator);
+                new KeyboardAccessoryCoordinator(keyboardAccessoryStub, mMediator);
         AccessorySheetCoordinator accessorySheet = new AccessorySheetCoordinator(
                 accessorySheetStub, keyboardAccessory::getPageChangeListener);
-        mMediator.initialize(keyboardAccessory, accessorySheet,
-                (ChromeActivity) windowAndroid.getActivity().get());
+        mMediator.initialize(keyboardAccessory, accessorySheet, windowAndroid);
     }
 
     /**
@@ -71,7 +68,7 @@
      * is a NoOp.
      */
     public void closeAccessorySheet() {
-        mMediator.getKeyboardAccessory().closeActiveTab();
+        mMediator.onCloseAccessorySheet();
     }
 
     /**

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingMediator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingMediator.java
index 99132d7..fa078c36 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingMediator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingMediator.java

@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.autofill.keyboard_accessory;
 
 import android.support.annotation.Nullable;
+import android.support.annotation.Px;
 import android.view.View;
 
 import org.chromium.base.VisibleForTesting;
@@ -24,6 +25,7 @@
 import org.chromium.chrome.browser.tabmodel.TabModelSelectorTabModelObserver;
 import org.chromium.ui.DropdownPopupWindow;
 import org.chromium.ui.UiUtils;
+import org.chromium.ui.base.WindowAndroid;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -34,6 +36,11 @@
  */
 class ManualFillingMediator
         extends EmptyTabObserver implements KeyboardAccessoryCoordinator.VisibilityDelegate {
+    private WindowAndroid mWindowAndroid;
+    private @Px int mPreviousControlHeight = 0;
+    private final WindowAndroid.KeyboardVisibilityListener mVisibilityListener =
+            this::onKeyboardVisibilityChanged;
+
     /**
      * Provides a cache for a given Provider which can repeat the last notification to all
      * observers.
@@ -125,21 +132,25 @@
     };
 
     void initialize(KeyboardAccessoryCoordinator keyboardAccessory,
-            AccessorySheetCoordinator accessorySheet, ChromeActivity activity) {
+            AccessorySheetCoordinator accessorySheet, WindowAndroid windowAndroid) {
+        assert windowAndroid.getActivity().get() != null;
+        mWindowAndroid = windowAndroid;
         mKeyboardAccessory = keyboardAccessory;
         mAccessorySheet = accessorySheet;
-        mActivity = activity;
-        if (activity instanceof ChromeTabbedActivity) {
+        mActivity = (ChromeActivity) windowAndroid.getActivity().get();
+        if (mActivity instanceof ChromeTabbedActivity) {
             // This object typically lives as long as the layout manager, so there is no need to
             // unsubscribe which would occasionally use an invalidated object.
-            ((ChromeTabbedActivity) activity)
+            ((ChromeTabbedActivity) mActivity)
                     .getLayoutManager()
                     .addSceneChangeObserver(mTabSwitcherObserver);
         }
+        windowAndroid.addKeyboardVisibilityListener(mVisibilityListener);
         mTabModelObserver = new TabModelSelectorTabModelObserver(mActivity.getTabModelSelector()) {
             @Override
             public void didSelectTab(Tab tab, @TabModel.TabSelectionType int type, int lastId) {
                 mActiveBrowserTab = tab;
+                mPreviousControlHeight = mActivity.getFullscreenManager().getBottomControlsHeight();
                 restoreCachedState(tab);
             }
 
@@ -149,13 +160,35 @@
                 restoreCachedState(mActiveBrowserTab);
             }
         };
-        Tab currentTab = activity.getTabModelSelector().getCurrentTab();
+        Tab currentTab = mActivity.getTabModelSelector().getCurrentTab();
         if (currentTab != null) {
             mTabModelObserver.didSelectTab(
                     currentTab, TabModel.TabSelectionType.FROM_USER, Tab.INVALID_TAB_ID);
         }
     }
 
+    // TODO(fhorschig): Look for stronger signals than |keyboardVisibilityChanged|.
+    // This variable remembers the last state of |keyboardVisibilityChanged| which might not be
+    // sufficient for edge cases like hardware keyboards, floating keyboards, etc.
+    private void onKeyboardVisibilityChanged(boolean isShowing) {
+        if (isShowing) {
+            mKeyboardAccessory.requestShowing();
+            mActivity.getFullscreenManager().setBottomControlsHeight(calculateAccessoryBarHeight());
+            mKeyboardAccessory.closeActiveTab();
+            mKeyboardAccessory.setBottomOffset(0);
+            mAccessorySheet.hide();
+        } else {
+            mKeyboardAccessory.close();
+            if (mKeyboardAccessory.hasActiveTab()) {
+                mKeyboardAccessory.setBottomOffset(mAccessorySheet.getHeight());
+                mAccessorySheet.show();
+                onBottomControlSpaceChanged();
+            } else {
+                mActivity.getFullscreenManager().setBottomControlsHeight(mPreviousControlHeight);
+            }
+        }
+    }
+
     void registerPasswordProvider(Provider<KeyboardAccessoryData.Item> itemProvider) {
         assert getPasswordAccessorySheet() != null : "No password sheet available!";
         getPasswordAccessorySheet().registerItemProvider(itemProvider);
@@ -169,8 +202,10 @@
     }
 
     void destroy() {
+        if (mWindowAndroid != null) {
+            mWindowAndroid.removeKeyboardVisibilityListener(mVisibilityListener);
+        }
         mTabModelObserver.destroy();
-        mKeyboardAccessory.destroy();
     }
 
     boolean handleBackPress() {
@@ -200,33 +235,46 @@
 
     @Override
     public void onChangeAccessorySheet(int tabIndex) {
-        mAccessorySheet.setActiveTab(tabIndex);
-    }
-
-    @Override
-    public void onOpenAccessorySheet() {
         assert mActivity != null : "ManualFillingMediator needs initialization.";
+        mAccessorySheet.setActiveTab(tabIndex);
         if (mPopup != null && mPopup.isShowing()) mPopup.dismiss();
         // If there is a keyboard, update the accessory sheet's height and hide the keyboard.
         View focusedView = mActivity.getCurrentFocus();
-        if (focusedView != null && UiUtils.isKeyboardShowing(mActivity, focusedView)) {
+        if (focusedView != null) {
             mAccessorySheet.setHeight(calculateAccessorySheetHeight(focusedView.getRootView()));
             UiUtils.hideKeyboard(focusedView);
         }
-        mAccessorySheet.show();
     }
 
     @Override
     public void onCloseAccessorySheet() {
+        View focusedView = mActivity.getCurrentFocus();
+        if (focusedView == null || UiUtils.isKeyboardShowing(mActivity, focusedView)) {
+            return; // If the keyboard is showing or is starting to show, the sheet closes gently.
+        }
+        mActivity.getFullscreenManager().setBottomControlsHeight(mPreviousControlHeight);
+        mKeyboardAccessory.closeActiveTab();
+        mKeyboardAccessory.setBottomOffset(0);
         mAccessorySheet.hide();
     }
 
     @Override
     public void onOpenKeyboard() {
         assert mActivity != null : "ManualFillingMediator needs initialization.";
+        mActivity.getFullscreenManager().setBottomControlsHeight(calculateAccessoryBarHeight());
         UiUtils.showKeyboard(mActivity.getCurrentFocus());
     }
 
+    @Override
+    public void onBottomControlSpaceChanged() {
+        @Px
+        int newControlsHeight = calculateAccessoryBarHeight();
+        if (mAccessorySheet.isShown()) {
+            newControlsHeight += mAccessorySheet.getHeight();
+        }
+        mActivity.getFullscreenManager().setBottomControlsHeight(newControlsHeight);
+    }
+
     private AccessoryState getOrCreateAccessoryState(Tab tab) {
         AccessoryState state = mModel.get(tab);
         if (state != null) return state;
@@ -251,14 +299,18 @@
         mAccessorySheet.setTabs(new KeyboardAccessoryData.Tab[0]);
     }
 
-    private int calculateAccessorySheetHeight(View rootView) {
-        int accessoryHeight = mActivity.getResources().getDimensionPixelSize(
-                org.chromium.chrome.R.dimen.keyboard_accessory_height);
+    private @Px int calculateAccessorySheetHeight(View rootView) {
         int accessorySheetSuggestionHeight = mActivity.getResources().getDimensionPixelSize(
                 org.chromium.chrome.R.dimen.keyboard_accessory_suggestion_height);
-        // Ensure that the minimum height is always sufficient to display the bar and a suggestion.
-        return Math.max(accessoryHeight + accessorySheetSuggestionHeight,
-                UiUtils.calculateKeyboardHeight(mActivity, rootView) + accessoryHeight);
+        // Ensure that the minimum height is always sufficient to display a suggestion.
+        return Math.max(accessorySheetSuggestionHeight,
+                UiUtils.calculateKeyboardHeight(mActivity, rootView));
+    }
+
+    private @Px int calculateAccessoryBarHeight() {
+        if (!mKeyboardAccessory.isShown()) return 0;
+        return mActivity.getResources().getDimensionPixelSize(
+                org.chromium.chrome.R.dimen.keyboard_accessory_suggestion_height);
     }
 
     @VisibleForTesting

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadInfoBarController.java b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadInfoBarController.java
index d0a9989..2a2b39ff 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadInfoBarController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadInfoBarController.java

@@ -31,6 +31,7 @@
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.toolbar.ToolbarButtonInProductHelpController;
 import org.chromium.chrome.browser.util.FeatureUtilities;
+import org.chromium.chrome.browser.widget.bottomsheet.BottomSheet;
 import org.chromium.components.download.DownloadState;
 import org.chromium.components.feature_engagement.FeatureConstants;
 import org.chromium.components.offline_items_collection.ContentId;
@@ -348,6 +349,10 @@
     public IPHInfoBarSupport.TrackerParameters getTrackerParameters() {
         if (getDownloadCount().inProgress == 0) return null;
 
+        BottomSheet bottomSheet =
+                getCurrentTab() == null ? null : getCurrentTab().getActivity().getBottomSheet();
+        if (bottomSheet != null && bottomSheet.isSheetOpen()) return null;
+
         return new IPHInfoBarSupport.TrackerParameters(
                 FeatureConstants.DOWNLOAD_INFOBAR_DOWNLOADS_ARE_FASTER_FEATURE,
                 R.string.iph_download_infobar_downloads_are_faster_text,

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/media/MediaLauncherActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/media/MediaLauncherActivity.java
index 90061a4..605d156 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/media/MediaLauncherActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/media/MediaLauncherActivity.java

@@ -5,16 +5,19 @@
 package org.chromium.chrome.browser.media;
 
 import android.app.Activity;
+import android.content.ContentResolver;
 import android.content.Intent;
 import android.net.Uri;
 import android.os.Bundle;
 import android.support.annotation.IntDef;
+import android.webkit.MimeTypeMap;
 
 import org.chromium.base.metrics.CachedMetrics;
 import org.chromium.chrome.browser.util.IntentUtils;
 
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
+import java.util.Locale;
 
 /**
  * The MediaLauncherActivity handles media-viewing Intents from other apps. It takes the given
@@ -43,7 +46,7 @@
 
         Intent input = IntentUtils.sanitizeIntent(getIntent());
         Uri contentUri = input.getData();
-        String mimeType = getContentResolver().getType(contentUri);
+        String mimeType = getMIMEType(contentUri);
         int mediaType = MediaViewerUtils.getMediaTypeFromMIMEType(mimeType);
 
         sMediaTypeHistogram.record(mediaType);
@@ -64,4 +67,36 @@
 
         finish();
     }
+
+    private String getMIMEType(Uri uri) {
+        // With a content URI, we can just query the ContentResolver.
+        if (uri.getScheme().equals(ContentResolver.SCHEME_CONTENT)) {
+            return getContentResolver().getType(uri);
+        }
+
+        // Otherwise, use the file extension.
+        String filteredUri = filterURI(uri);
+        String fileExtension = MimeTypeMap.getFileExtensionFromUrl(filteredUri);
+        return MimeTypeMap.getSingleton().getMimeTypeFromExtension(
+                fileExtension.toLowerCase(Locale.ROOT));
+    }
+
+    // MimeTypeMap.getFileExtensionFromUrl fails when the file name includes certain special
+    // characters, so we filter those out of the URI when determining the MIME type.
+    protected static String filterURI(Uri uri) {
+        String uriString = uri.toString();
+        int filterIndex = uriString.length();
+
+        int fragmentIndex = uriString.lastIndexOf('#', filterIndex);
+        if (fragmentIndex >= 0) filterIndex = fragmentIndex;
+
+        int queryIndex = uriString.lastIndexOf('?', filterIndex);
+        if (queryIndex >= 0) filterIndex = queryIndex;
+
+        int extensionIndex = uriString.lastIndexOf('.', filterIndex);
+        if (extensionIndex >= 0) filterIndex = extensionIndex;
+
+        return uriString.substring(0, filterIndex).replaceAll("['$!]", "")
+                + uriString.substring(filterIndex);
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/media/MediaViewerUtils.java b/chrome/android/java/src/org/chromium/chrome/browser/media/MediaViewerUtils.java
index 77015793..f98d8ca 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/media/MediaViewerUtils.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/media/MediaViewerUtils.java

@@ -6,6 +6,7 @@
 
 import android.app.PendingIntent;
 import android.content.ComponentName;
+import android.content.ContentResolver;
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.PackageManager;
@@ -79,10 +80,15 @@
         }
 
         // Create a PendingIntent that shares the file with external apps.
-        PendingIntent pendingShareIntent = PendingIntent.getActivity(context, 0,
-                createShareIntent(contentUri, mimeType), PendingIntent.FLAG_CANCEL_CURRENT);
-        builder.setActionButton(
-                shareIcon, context.getString(R.string.share), pendingShareIntent, true);
+        // If the URI is a file URI and the Android version is N or later, this will throw a
+        // FileUriExposedException. In this case, we just don't add the share button.
+        if (!contentUri.getScheme().equals(ContentResolver.SCHEME_FILE)
+                || Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
+            PendingIntent pendingShareIntent = PendingIntent.getActivity(context, 0,
+                    createShareIntent(contentUri, mimeType), PendingIntent.FLAG_CANCEL_CURRENT);
+            builder.setActionButton(
+                    shareIcon, context.getString(R.string.share), pendingShareIntent, true);
+        }
 
         // The color of the media viewer is dependent on the file type.
         int backgroundRes;

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingIntegrationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingIntegrationTest.java
index f7f88190..524a858b 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingIntegrationTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingIntegrationTest.java

@@ -12,14 +12,16 @@
 import static android.support.test.espresso.matcher.ViewMatchers.withId;
 
 import static org.hamcrest.Matchers.is;
+import static org.junit.Assert.assertNotNull;
 
 import static org.chromium.chrome.browser.autofill.keyboard_accessory.ManualFillingTestHelper.selectTabAtPosition;
 import static org.chromium.chrome.browser.autofill.keyboard_accessory.ManualFillingTestHelper.whenDisplayed;
 
 import android.support.test.espresso.Espresso;
 import android.support.test.filters.SmallTest;
+import android.view.View;
+import android.view.ViewGroup;
 
-import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -34,10 +36,12 @@
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
 import org.chromium.chrome.test.ChromeTabbedActivityTestRule;
 import org.chromium.chrome.test.util.browser.Features;
+import org.chromium.content.browser.test.util.CriteriaHelper;
 import org.chromium.ui.DropdownPopupWindowInterface;
 
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicReference;
 
 /**
  * Integration tests for password accessory views. This integration test currently stops testing at
@@ -59,13 +63,13 @@
         mHelper.loadTestPage(false);
         mHelper.createTestTab();
 
-        Assert.assertNotNull("Controller for Manual filling should be available.",
+        assertNotNull("Controller for Manual filling should be available.",
                 mActivityTestRule.getActivity().getManualFillingController());
-        Assert.assertNotNull("Keyboard accessory should have an instance.",
+        assertNotNull("Keyboard accessory should have an instance.",
                 mActivityTestRule.getActivity()
                         .getManualFillingController()
                         .getKeyboardAccessory());
-        Assert.assertNotNull("Accessory Sheet should have an instance.",
+        assertNotNull("Accessory Sheet should have an instance.",
                 mActivityTestRule.getActivity()
                         .getManualFillingController()
                         .getMediatorForTesting()
@@ -131,6 +135,8 @@
     @SmallTest
     public void testAccessorySheetHiddenWhenRefocusingField()
             throws InterruptedException, TimeoutException {
+        AtomicReference<ViewGroup.MarginLayoutParams> accessoryMargins = new AtomicReference<>();
+        AtomicReference<View> accessorySheetView = new AtomicReference<>();
         mHelper.loadTestPage(false);
         mHelper.createTestTab();
 
@@ -139,17 +145,27 @@
         mHelper.waitForKeyboard();
 
         // Check that ONLY the accessory is there but the sheet is still hidden.
-        whenDisplayed(withId(R.id.keyboard_accessory));
+        whenDisplayed(withId(R.id.keyboard_accessory)).check((view, e) -> {
+            accessoryMargins.set((ViewGroup.MarginLayoutParams) view.getLayoutParams());
+            assertThat(accessoryMargins.get().bottomMargin, is(0)); // Attached to keyboard.
+        });
         onView(withId(R.id.keyboard_accessory_sheet)).check(doesNotExist());
 
         // Trigger the sheet and wait for it to open and the keyboard to disappear.
         onView(withId(R.id.tabs)).perform(selectTabAtPosition(0));
         mHelper.waitForKeyboardToDisappear();
-        whenDisplayed(withId(R.id.keyboard_accessory_sheet));
+        whenDisplayed(withId(R.id.keyboard_accessory_sheet)).check((view, e) -> {
+            accessorySheetView.set(view);
+        });
+        // The accessory bar is now pushed up by the accessory.
+        CriteriaHelper.pollUiThread(() -> {
+            return accessoryMargins.get().bottomMargin == accessorySheetView.get().getHeight();
+        });
 
         mHelper.clickPasswordField();
         mHelper.waitForKeyboard();
         mHelper.waitToBeHidden(withId(R.id.keyboard_accessory_sheet));
+        CriteriaHelper.pollUiThread(() -> accessoryMargins.get().bottomMargin == 0);
     }
 
     @Test
@@ -284,6 +300,4 @@
         mHelper.waitToBeHidden(withId(R.id.keyboard_accessory_sheet));
         mHelper.waitToBeHidden(withId(R.id.keyboard_accessory));
     }
-
-    // TODO(fhorschig): Check that it overlays info bars.
 }

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetViewTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetViewTest.java
index be8994eb..5c0a9c7 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetViewTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetViewTest.java

@@ -70,6 +70,9 @@
                 });
         accessorySheet.addTab(
                 new KeyboardAccessoryData.Tab(null, null, layout, AccessoryTabType.ALL, listener));
+        accessorySheet.setHeight(
+                mActivityTestRule.getActivity().getResources().getDimensionPixelSize(
+                        R.dimen.keyboard_accessory_sheet_height));
         ThreadUtils.runOnUiThreadBlocking(accessorySheet::show);
     }
 

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/media/MediaLauncherActivityTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/media/MediaLauncherActivityTest.java
index 9d911e9b..98f1cafd 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/media/MediaLauncherActivityTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/media/MediaLauncherActivityTest.java

@@ -11,14 +11,18 @@
 import android.os.Build;
 import android.support.test.InstrumentationRegistry;
 import android.support.test.filters.SmallTest;
+import android.util.Pair;
 
 import org.junit.After;
+import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import org.chromium.base.CollectionUtil;
 import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.base.test.util.UrlUtils;
 import org.chromium.chrome.browser.ChromeSwitches;
 import org.chromium.chrome.browser.customtabs.SeparateTaskCustomTabActivity;
 import org.chromium.chrome.browser.customtabs.SeparateTaskCustomTabActivity0;
@@ -30,6 +34,7 @@
 import org.chromium.content.browser.test.util.Criteria;
 import org.chromium.content.browser.test.util.CriteriaHelper;
 
+import java.util.List;
 import java.util.concurrent.Callable;
 
 /**
@@ -75,6 +80,30 @@
         expectMediaToBeHandled(url, "image/png");
     }
 
+    @Test
+    @SmallTest
+    public void testHandleFileURIIntent() throws Exception {
+        String url = UrlUtils.getTestFileUrl("google.png");
+        expectMediaToBeHandled(url, "image/png");
+    }
+
+    @Test
+    @SmallTest
+    public void testFilterURI() throws Exception {
+        List<Pair<String, String>> testCases = CollectionUtil.newArrayList(
+                new Pair<>("file:///test.jpg", "file:///test.jpg"),
+                new Pair<>("file:///test.jp!g", "file:///test.jp!g"),
+                new Pair<>("file:///test!$'.jpg", "file:///test.jpg"),
+                new Pair<>("file:///test!$'.jpg?x=y", "file:///test.jpg?x=y"),
+                new Pair<>("file:///test!$'.jpg?x=y#fragment!", "file:///test.jpg?x=y#fragment!"));
+
+        for (Pair<String, String> testCase : testCases) {
+            String testInput = testCase.first;
+            String expected = testCase.second;
+            Assert.assertEquals(expected, MediaLauncherActivity.filterURI(Uri.parse(testInput)));
+        }
+    }
+
     private void expectMediaToBeHandled(String url, String mimeType) throws Exception {
         Uri uri = Uri.parse(url);
         ComponentName componentName = new ComponentName(mContext, MediaLauncherActivity.class);

diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryControllerTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryControllerTest.java
index 2d028419..280c0773 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryControllerTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/KeyboardAccessoryControllerTest.java

@@ -34,7 +34,6 @@
 import org.chromium.chrome.browser.autofill.keyboard_accessory.KeyboardAccessoryData.PropertyProvider;
 import org.chromium.chrome.browser.modelutil.ListObservable;
 import org.chromium.chrome.browser.modelutil.PropertyObservable.PropertyObserver;
-import org.chromium.ui.base.WindowAndroid;
 
 /**
  * Controller tests for the keyboard accessory component.
@@ -52,8 +51,6 @@
     @Mock
     private KeyboardAccessoryCoordinator.VisibilityDelegate mMockVisibilityDelegate;
     @Mock
-    private WindowAndroid mMockWindow;
-    @Mock
     private ViewStub mMockViewStub;
     @Mock
     private KeyboardAccessoryView mMockView;
@@ -70,8 +67,7 @@
         ShadowRecordHistogram.reset();
         MockitoAnnotations.initMocks(this);
         when(mMockViewStub.inflate()).thenReturn(mMockView);
-        mCoordinator = new KeyboardAccessoryCoordinator(
-                mMockWindow, mMockViewStub, mMockVisibilityDelegate);
+        mCoordinator = new KeyboardAccessoryCoordinator(mMockViewStub, mMockVisibilityDelegate);
         mMediator = mCoordinator.getMediatorForTesting();
         mModel = mMediator.getModelForTesting();
     }
@@ -81,7 +77,6 @@
         assertThat(mCoordinator, is(notNullValue()));
         assertThat(mMediator, is(notNullValue()));
         assertThat(mModel, is(notNullValue()));
-        verify(mMockWindow).addKeyboardVisibilityListener(mMediator);
     }
 
     @Test
@@ -175,9 +170,9 @@
         // Without suggestions, the accessory should remain invisible - even if the keyboard shows.
         assertThat(mModel.getActionList().size(), is(0));
         assertThat(mModel.isVisible(), is(false));
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
         assertThat(mModel.isVisible(), is(false));
-        mMediator.keyboardVisibilityChanged(false);
+        mCoordinator.close();
 
         // Adding suggestions doesn't change the visibility by itself.
         autofillSuggestionProvider.notifyObservers(new Action[] {suggestion, suggestion});
@@ -185,7 +180,7 @@
         assertThat(mModel.isVisible(), is(false));
 
         // But as soon as the keyboard comes up, it should be showing.
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
         assertThat(mModel.isVisible(), is(true));
     }
 
@@ -201,7 +196,7 @@
         assertThat(mModel.getActionList().size(), is(0));
 
         // If the keyboard comes up, but there are no suggestions set, keep the accessory hidden.
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
         assertThat(mModel.isVisible(), is(false));
 
         // Adding suggestions while the keyboard is visible triggers the accessory.
@@ -214,7 +209,7 @@
     public void testIsVisibleWithActions() {
         // Without any actions, the accessory should remain invisible.
         assertThat(mModel.getActionList().size(), is(0));
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
         assertThat(mModel.isVisible(), is(false));
 
         // Adding actions while the keyboard is visible triggers the accessory.
@@ -276,11 +271,11 @@
     @Test
     public void testActionsRemovedWhenNotVisible() {
         // Make the accessory visible and add an action to it.
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
         mModel.getActionList().add(new Action(null, 0, null));
 
         // Hiding the accessory should also remove actions.
-        mMediator.keyboardVisibilityChanged(false);
+        mCoordinator.close();
         assertThat(mModel.getActionList().size(), is(0));
     }
 
@@ -288,7 +283,7 @@
     public void testIsVisibleWithTabs() {
         // Without any actions, the accessory should remain invisible.
         assertThat(mModel.getActionList().size(), is(0));
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
         assertThat(mModel.isVisible(), is(false));
 
         // Adding actions while the keyboard is visible triggers the accessory.
@@ -327,28 +322,28 @@
 
         // Adding a tab contributes to the tabs and the total bucket.
         mCoordinator.addTab(mTestTab);
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
 
         assertThat(getShownMetricsCount(AccessoryBarContents.WITH_TABS), is(1));
         assertThat(getShownMetricsCount(AccessoryBarContents.ANY_CONTENTS), is(1));
 
         // Adding an action contributes to the actions bucket. Tabs and total are logged again.
-        mMediator.keyboardVisibilityChanged(false); // Hide, so it's brought up again.
+        mCoordinator.close(); // Hide, so it's brought up again.
         mModel.getActionList().add(new Action(null, 0, null));
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
 
         assertThat(getShownMetricsCount(AccessoryBarContents.WITH_ACTIONS), is(1));
         assertThat(getShownMetricsCount(AccessoryBarContents.WITH_TABS), is(2));
         assertThat(getShownMetricsCount(AccessoryBarContents.ANY_CONTENTS), is(2));
 
         // Adding suggestions adds to the suggestions bucket - and again to tabs and total.
-        mMediator.keyboardVisibilityChanged(false); // Hide, so it's brought up again.
+        mCoordinator.close(); // Hide, so it's brought up again.
         KeyboardAccessoryData.PropertyProvider<Action> autofillSuggestionProvider =
                 new KeyboardAccessoryData.PropertyProvider<>(AUTOFILL_SUGGESTION);
         Action suggestion = new Action("Suggestion", AUTOFILL_SUGGESTION, (a) -> {});
         mCoordinator.registerActionListProvider(autofillSuggestionProvider);
         autofillSuggestionProvider.notifyObservers(new Action[] {suggestion});
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
 
         // Hiding the keyboard clears actions, so don't log more actions from here on out.
         assertThat(getShownMetricsCount(AccessoryBarContents.WITH_AUTOFILL_SUGGESTIONS), is(1));
@@ -357,9 +352,9 @@
         assertThat(getShownMetricsCount(AccessoryBarContents.ANY_CONTENTS), is(3));
 
         // Removing suggestions adds to everything but the suggestions bucket. The value remains.
-        mMediator.keyboardVisibilityChanged(false); // Hide, so it's brought up again.
+        mCoordinator.close(); // Hide, so it's brought up again.
         autofillSuggestionProvider.notifyObservers(new Action[0]);
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
 
         assertThat(getShownMetricsCount(AccessoryBarContents.WITH_AUTOFILL_SUGGESTIONS), is(1));
         assertThat(getShownMetricsCount(AccessoryBarContents.WITH_ACTIONS), is(1));
@@ -375,7 +370,7 @@
 
         // First showing contains actions only.
         mCoordinator.addTab(mTestTab);
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
 
         assertThat(getShownMetricsCount(AccessoryBarContents.WITH_TABS), is(1));
         assertThat(getShownMetricsCount(AccessoryBarContents.ANY_CONTENTS), is(1));
@@ -406,7 +401,7 @@
 
         // Add a tab and show, so the accessory is permanently visible.
         mCoordinator.addTab(mTestTab);
-        mMediator.keyboardVisibilityChanged(true);
+        mCoordinator.requestShowing();
 
         // Adding an action fills the bar impression bucket and the actions set once.
         mModel.getActionList().set(

diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingControllerTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingControllerTest.java
index f0df2ea..dfdd5396 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingControllerTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/autofill/keyboard_accessory/ManualFillingControllerTest.java

@@ -40,6 +40,7 @@
 import org.chromium.chrome.browser.autofill.keyboard_accessory.KeyboardAccessoryData.Item;
 import org.chromium.chrome.browser.autofill.keyboard_accessory.KeyboardAccessoryData.PropertyProvider;
 import org.chromium.chrome.browser.autofill.keyboard_accessory.KeyboardAccessoryData.Provider;
+import org.chromium.chrome.browser.fullscreen.ChromeFullscreenManager;
 import org.chromium.chrome.browser.modelutil.ListModel;
 import org.chromium.chrome.browser.modelutil.ListObservable;
 import org.chromium.chrome.browser.tab.Tab;
@@ -74,6 +75,7 @@
     private ListObservable.ListObserver<Void> mMockItemListObserver;
     @Mock
     private TabModelSelector mMockTabModelSelector;
+    private ChromeFullscreenManager mFullScreenManager;
     @Mock
     private Drawable mMockIcon;
 
@@ -88,6 +90,8 @@
         when(mMockViewStub.inflate()).thenReturn(mMockView);
         when(mMockWindow.getActivity()).thenReturn(new WeakReference<>(mMockActivity));
         when(mMockActivity.getTabModelSelector()).thenReturn(mMockTabModelSelector);
+        mFullScreenManager = new ChromeFullscreenManager(mMockActivity, 0);
+        when(mMockActivity.getFullscreenManager()).thenReturn(mFullScreenManager);
         PasswordAccessorySheetCoordinator.IconProvider.getInstance().setIconForTesting(mMockIcon);
         mController = new ManualFillingCoordinator(mMockWindow, mMockViewStub, mMockViewStub);
     }

diff --git a/chrome/app/chromeos_strings.grdp b/chrome/app/chromeos_strings.grdp
index 1d3830c..5b4e143 100644
--- a/chrome/app/chromeos_strings.grdp
+++ b/chrome/app/chromeos_strings.grdp

@@ -178,7 +178,7 @@
     Better Together may:
   </message>
   <message name="IDS_MULTIDEVICE_SETUP_START_SETUP_PAGE_AWM_DESCRIPTION" desc="Description of a feature that shows text messages received by the user's phone as notification on their Chromebook.">
-    Send you notifications from Android Web Messages
+    Send you notifications and default to remembering this computer for Messages
   </message>
   <message name="IDS_MULTIDEVICE_SETUP_START_SETUP_PAGE_INSTALL_APPS_DESCRIPTION" desc="Tell the user that Better Together can install apps on their Chromebook">
     Install apps on your Chromebook

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index c572ac4..a4d3bcae 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -9177,6 +9177,12 @@
       <message name="IDS_WEBAUTHN_TRANSPORT_POPUP_CABLE" desc="Menu item text. The user selects this to verify their identity on a web site (i.e. sign in) using their phone. They wirelessly connect their phone to their computer over Bluetooth Low Energy, and then use the phone to sign in to web sites on their computer.">
         Verify via your phone
       </message>
+      <message name="IDS_WEBAUTHN_CABLE_ACTIVATE_TITLE" desc="Title of the dialog shown when the user tries to sign-in using a phone as a security key.">
+        Check your phone
+      </message>
+      <message name="IDS_WEBAUTHN_CABLE_ACTIVATE_DESCRIPTION" desc="Contents of the dialog shown when the user tries to sign-in using a phone as a security key.">
+        A notification was sent to your phone. Follow the prompts to confirm it's you.
+      </message>
    </if>
    <if expr="is_macosx">
      <message name="IDS_WEBAUTHN_TOUCH_ID_TITLE" desc="Title of the dialog shown when the user tries to sign in with Touch ID." meaning="'Touch ID' is the fingerprint recognition feature in macOS. Try to refer Apple support documentation in the target language for the appropriate product name translation.">

diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index e380670..b48d263a 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp

@@ -1156,8 +1156,8 @@
   <message name="IDS_SETTINGS_CLEAR_COOKIES_FLASH" desc="Checkbox for deleting Cookies and other site data">
     Cookies and other site and plugin data
   </message>
-  <message name="IDS_SETTINGS_CLEAR_PASSWORDS" desc="Checkbox for deleting Passwords">
-    Passwords
+  <message name="IDS_SETTINGS_CLEAR_PASSWORDS" desc="Checkbox for deleting Passwords and other sign-in data">
+    Passwords and other sign-in data
   </message>
   <message name="IDS_SETTINGS_CLEAR_FORM_DATA" desc="Checkbox for deleting form data saved for Autofill">
     Autofill form data
@@ -4256,16 +4256,16 @@
       Better Together is off
     </message>
     <message name="IDS_SETTINGS_MULTIDEVICE_SMART_LOCK_SUMMARY" desc="Description of for the 'Smart Lock' setting. This feature automatically unlocks the user's Chromebook if their phone is nearby and unlocked.">
-      Unlock your Chromebook with your phone. <ph name="LINK_BEGIN">&lt;a target="_blank" href="$1<ex>https://google.com/</ex>"&gt;</ph>Learn more.<ph name="LINK_END">&lt;/a&gt;</ph>
+      Unlock your Chromebook with your phone. <ph name="LINK_BEGIN">&lt;a target="_blank" href="$1<ex>https://google.com/</ex>"&gt;</ph>Learn more<ph name="LINK_END">&lt;/a&gt;</ph>
     </message>
     <message name="IDS_SETTINGS_MULTIDEVICE_INSTANT_TETHERING" desc="Name of a feature. This feature automatically offers the user to tether to their phone if their Chromebook is offline and their phone supports tethering.">
       Instant Tethering
     </message>
     <message name="IDS_SETTINGS_MULTIDEVICE_ANDROID_MESSAGES" desc="Name of a feature. This feature lets the user read and reply to text messages from their Chromebook. New text messages will appear as notifications.">
-      Android Messages
+      Messages
     </message>
     <message name="IDS_SETTINGS_MULTIDEVICE_ANDROID_MESSAGES_SUMMARY" desc="Description of for the 'Android Messages' setting. This feature lets the user read and reply to text messages from their Chromebook. New text messages will appear as notifications.">
-      Send and receive text messages from your Chromebook
+      Send and receive text messages from your Chromebook. <ph name="LINK_BEGIN">&lt;a target="_blank" href="$1<ex>https://google.com/</ex>"&gt;</ph>Learn more<ph name="LINK_END">&lt;/a&gt;</ph>
     </message>
     <message name="IDS_SETTINGS_MULTIDEVICE_FORGET_THIS_DEVICE" desc="Header for a clickable menu item that makes the Chromebook forget the user's phone. This means they will no longer have access to multidevice features.">
       Forget this device

diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CLEAR_PASSWORDS.png.sha1 b/chrome/app/settings_strings_grdp/IDS_SETTINGS_CLEAR_PASSWORDS.png.sha1
new file mode 100644
index 0000000..4874b2b
--- /dev/null
+++ b/chrome/app/settings_strings_grdp/IDS_SETTINGS_CLEAR_PASSWORDS.png.sha1

@@ -0,0 +1 @@
+e19fb51dbaf7f8647bb437a082e9fad8f907ae44
\ No newline at end of file

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index ac3c338d..c2f4a95 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -3213,6 +3213,10 @@
     {"enable-new-app-menu-icon", flag_descriptions::kEnableNewAppMenuIconName,
      flag_descriptions::kEnableNewAppMenuIconDescription, kOsDesktop,
      FEATURE_VALUE_TYPE(features::kAnimatedAppMenuIcon)},
+    {"omnibox-drive-suggestions",
+     flag_descriptions::kOmniboxDriveSuggestionsName,
+     flag_descriptions::kOmniboxDriveSuggestionsDescriptions, kOsDesktop,
+     FEATURE_VALUE_TYPE(omnibox::kDocumentProvider)},
 #endif  // defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_WIN)
 
 #if defined(OS_ANDROID)

diff --git a/chrome/browser/chromeos/BUILD.gn b/chrome/browser/chromeos/BUILD.gn
index 5516f94..4af7d90 100644
--- a/chrome/browser/chromeos/BUILD.gn
+++ b/chrome/browser/chromeos/BUILD.gn

@@ -57,12 +57,15 @@
     "//chrome/app:command_ids",
     "//chrome/app/vector_icons",
     "//chrome/browser/apps/foundation/app_service:lib",
+    "//chrome/browser/chromeos/android_sms:android_sms_urls",
     "//chrome/browser/chromeos/power/ml:user_activity_ukm_logger_helpers",
     "//chrome/browser/chromeos/power/ml/smart_dim",
     "//chrome/browser/devtools",
     "//chrome/browser/extensions",
     "//chrome/browser/resource_coordinator:tab_metrics_event_proto",
     "//chrome/browser/ssl:proto",
+    "//chrome/browser/web_applications",
+    "//chrome/browser/web_applications/components",
     "//chrome/common",
     "//chrome/common/extensions/api",
     "//chrome/common/net",
@@ -83,6 +86,7 @@
     "//chromeos/components/tether",
     "//chromeos/services/device_sync/public/cpp",
     "//chromeos/services/multidevice_setup/public/cpp",
+    "//chromeos/services/multidevice_setup/public/cpp:android_sms_app_install_delegate",
     "//chromeos/services/multidevice_setup/public/cpp:auth_token_validator",
     "//chromeos/services/multidevice_setup/public/cpp:prefs",
     "//chromeos/services/secure_channel/public/cpp/client",
@@ -929,6 +933,8 @@
     "login/demo_mode/demo_extensions_external_loader.h",
     "login/demo_mode/demo_mode_detector.cc",
     "login/demo_mode/demo_mode_detector.h",
+    "login/demo_mode/demo_mode_resources_remover.cc",
+    "login/demo_mode/demo_mode_resources_remover.h",
     "login/demo_mode/demo_session.cc",
     "login/demo_mode/demo_session.h",
     "login/demo_mode/demo_setup_controller.cc",
@@ -1289,6 +1295,8 @@
     "mobile/mobile_activator.h",
     "mobile_config.cc",
     "mobile_config.h",
+    "multidevice_setup/android_sms_app_install_delegate_impl.cc",
+    "multidevice_setup/android_sms_app_install_delegate_impl.h",
     "multidevice_setup/auth_token_validator_factory.cc",
     "multidevice_setup/auth_token_validator_factory.h",
     "multidevice_setup/auth_token_validator_impl.cc",
@@ -2095,6 +2103,7 @@
     "lock_screen_apps/state_controller_unittest.cc",
     "login/auth/cryptohome_authenticator_unittest.cc",
     "login/demo_mode/demo_extensions_external_loader_unittest.cc",
+    "login/demo_mode/demo_mode_resources_remover_unittest.cc",
     "login/demo_mode/demo_session_unittest.cc",
     "login/demo_mode/demo_setup_controller_unittest.cc",
     "login/demo_mode/demo_setup_test_utils.h",
@@ -2119,6 +2128,7 @@
     "login/users/user_manager_unittest.cc",
     "mobile/mobile_activator_unittest.cc",
     "mobile_config_unittest.cc",
+    "multidevice_setup/android_sms_app_install_delegate_impl_unittest.cc",
     "net/cert_verify_proc_chromeos_unittest.cc",
     "net/client_cert_store_chromeos_unittest.cc",
     "net/network_portal_detector_impl_unittest.cc",
@@ -2319,6 +2329,7 @@
     "//base",
     "//chrome/browser/chromeos/android_sms:unit_tests",
     "//chrome/browser/resources/chromeos/zip_archiver:char_coding",
+    "//chrome/browser/web_applications/components:test_support",
     "//chrome/common",
     "//chromeos:login_manager_proto",
     "//chromeos/components/tether:test_support",

diff --git a/chrome/browser/chromeos/android_sms/BUILD.gn b/chrome/browser/chromeos/android_sms/BUILD.gn
index 16c6b539..75edec3e 100644
--- a/chrome/browser/chromeos/android_sms/BUILD.gn
+++ b/chrome/browser/chromeos/android_sms/BUILD.gn

@@ -2,16 +2,26 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+source_set("android_sms_urls") {
+  sources = [
+    "android_sms_switches.cc",
+    "android_sms_switches.h",
+    "android_sms_urls.cc",
+    "android_sms_urls.h",
+  ]
+
+  deps = [
+    "//base",
+    "//url",
+  ]
+}
+
 static_library("android_sms") {
   sources = [
     "android_sms_service.cc",
     "android_sms_service.h",
     "android_sms_service_factory.cc",
     "android_sms_service_factory.h",
-    "android_sms_switches.cc",
-    "android_sms_switches.h",
-    "android_sms_urls.cc",
-    "android_sms_urls.h",
     "connection_establisher.h",
     "connection_establisher_impl.cc",
     "connection_establisher_impl.h",
@@ -20,6 +30,7 @@
   ]
 
   deps = [
+    ":android_sms_urls",
     "//base",
     "//chrome/browser/chromeos:chromeos",
     "//chromeos:chromeos",
@@ -53,6 +64,7 @@
 
   deps = [
     ":android_sms",
+    ":android_sms_urls",
     ":test_support",
     "//content/public/browser",
     "//content/test:test_support",

diff --git a/chrome/browser/chromeos/chrome_browser_main_chromeos.cc b/chrome/browser/chromeos/chrome_browser_main_chromeos.cc
index 69f3ee6..12be4285 100644
--- a/chrome/browser/chromeos/chrome_browser_main_chromeos.cc
+++ b/chrome/browser/chromeos/chrome_browser_main_chromeos.cc

@@ -60,6 +60,7 @@
 #include "chrome/browser/chromeos/language_preferences.h"
 #include "chrome/browser/chromeos/lock_screen_apps/state_controller.h"
 #include "chrome/browser/chromeos/logging.h"
+#include "chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.h"
 #include "chrome/browser/chromeos/login/demo_mode/demo_session.h"
 #include "chrome/browser/chromeos/login/helper.h"
 #include "chrome/browser/chromeos/login/lock/screen_locker.h"
@@ -995,6 +996,9 @@
   if (!user_manager::UserManager::Get()->IsLoggedInAsGuest())
     low_disk_notification_ = std::make_unique<LowDiskNotification>();
 
+  demo_mode_resources_remover_ = DemoModeResourcesRemover::CreateIfNeeded(
+      g_browser_process->local_state());
+
   ChromeBrowserMainPartsLinux::PostProfileInit();
 }
 
@@ -1117,6 +1121,7 @@
   network_throttling_observer_.reset();
   ScreenLocker::ShutDownClass();
   low_disk_notification_.reset();
+  demo_mode_resources_remover_.reset();
   user_activity_controller_.reset();
   adaptive_screen_brightness_manager_.reset();
 

diff --git a/chrome/browser/chromeos/chrome_browser_main_chromeos.h b/chrome/browser/chromeos/chrome_browser_main_chromeos.h
index 6ccc4a2d..03061286 100644
--- a/chrome/browser/chromeos/chrome_browser_main_chromeos.h
+++ b/chrome/browser/chromeos/chrome_browser_main_chromeos.h

@@ -32,6 +32,7 @@
 namespace chromeos {
 
 class ArcKioskAppManager;
+class DemoModeResourcesRemover;
 class EventRewriterDelegateImpl;
 class IdleActionWarningObserver;
 class LowDiskNotification;
@@ -133,6 +134,8 @@
 
   std::unique_ptr<power::ml::UserActivityController> user_activity_controller_;
 
+  std::unique_ptr<DemoModeResourcesRemover> demo_mode_resources_remover_;
+
   DISALLOW_COPY_AND_ASSIGN(ChromeBrowserMainPartsChromeos);
 };
 

diff --git a/chrome/browser/chromeos/drive/drive_integration_service.cc b/chrome/browser/chromeos/drive/drive_integration_service.cc
index 07997c6..c54cb0d 100644
--- a/chrome/browser/chromeos/drive/drive_integration_service.cc
+++ b/chrome/browser/chromeos/drive/drive_integration_service.cc

@@ -263,9 +263,10 @@
     if (!integration_service_->GetDriveFsInterface())
       return;
 
-    integration_service_->GetDriveFsInterface()->SetPauseSyncing(
+    integration_service_->GetDriveFsInterface()->UpdateNetworkState(
         net::NetworkChangeNotifier::IsConnectionCellular(type) &&
-        pref_service_->GetBoolean(prefs::kDisableDriveOverCellular));
+            pref_service_->GetBoolean(prefs::kDisableDriveOverCellular),
+        type == net::NetworkChangeNotifier::CONNECTION_NONE);
   }
 
   PrefService* pref_service_;

diff --git a/chrome/browser/chromeos/file_manager/file_manager_browsertest.cc b/chrome/browser/chromeos/file_manager/file_manager_browsertest.cc
index 5866c27..300dcbb 100644
--- a/chrome/browser/chromeos/file_manager/file_manager_browsertest.cc
+++ b/chrome/browser/chromeos/file_manager/file_manager_browsertest.cc

@@ -264,8 +264,7 @@
                       TestCase("renameFileDownloads"),
                       TestCase("renameFileDrive"),
                       TestCase("renameFileDrive").EnableDriveFs(),
-                      // https://crbug.com/874954, failed on MSan bots.
-                      // TestCase("renameNewFolderDownloads").InGuestMode(),
+                      TestCase("renameNewFolderDownloads").InGuestMode(),
                       TestCase("renameNewFolderDownloads"),
                       TestCase("renameNewFolderDrive"),
                       TestCase("renameNewFolderDrive").EnableDriveFs()));

diff --git a/chrome/browser/chromeos/file_manager/gallery_jstest.cc b/chrome/browser/chromeos/file_manager/gallery_jstest.cc
index bb7cc59..fe55fb1 100644
--- a/chrome/browser/chromeos/file_manager/gallery_jstest.cc
+++ b/chrome/browser/chromeos/file_manager/gallery_jstest.cc

@@ -51,7 +51,7 @@
 }
 
 IN_PROC_BROWSER_TEST_F(GalleryJsTest, SlideModeTest) {
-  RunTest(base::FilePath(FILE_PATH_LITERAL("slide_mode_unittest.html")));
+  RunGeneratedTest("/slide_mode_unittest.html");
 }
 
 IN_PROC_BROWSER_TEST_F(GalleryJsTest, DimmableUIControllerTest) {

diff --git a/chrome/browser/chromeos/input_method/input_method_manager_impl_unittest.cc b/chrome/browser/chromeos/input_method/input_method_manager_impl_unittest.cc
index 511c123..cafe3e4 100644
--- a/chrome/browser/chromeos/input_method/input_method_manager_impl_unittest.cc
+++ b/chrome/browser/chromeos/input_method/input_method_manager_impl_unittest.cc

@@ -10,9 +10,6 @@
 #include <memory>
 #include <utility>
 
-#include "ash/ime/ime_controller.h"
-#include "ash/ime/test_ime_controller.h"
-#include "ash/shell.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
@@ -23,6 +20,7 @@
 #include "chrome/browser/chromeos/input_method/mock_input_method_engine.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/ash/ime_controller_client.h"
+#include "chrome/browser/ui/ash/test_ime_controller.h"
 #include "chrome/test/base/browser_with_test_window_test.h"
 #include "chrome/test/base/testing_profile.h"
 #include "chrome/test/base/testing_profile_manager.h"
@@ -1425,7 +1423,7 @@
 // Verifies that the combination of InputMethodManagerImpl and
 // ImeControllerClient sends the correct data to ash.
 TEST_F(InputMethodManagerImplTest, IntegrationWithAsh) {
-  ash::TestImeController ime_controller;  // Mojo interface to ash.
+  TestImeController ime_controller;  // Mojo interface to ash.
   ImeControllerClient ime_controller_client(manager_.get());
   ime_controller_client.InitForTesting(ime_controller.CreateInterfacePtr());
 

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.cc b/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.cc
index 1e7ea817..37fa79dc 100644
--- a/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.cc
+++ b/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.cc

@@ -9,6 +9,7 @@
 #include "base/sys_info.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/login/ui/login_display_host.h"
+#include "chrome/browser/chromeos/login/wizard_controller.h"
 #include "chrome/common/pref_names.h"
 #include "chromeos/chromeos_switches.h"
 #include "components/prefs/pref_registry_simple.h"
@@ -83,7 +84,15 @@
   if (demo_launched_)
     return;
   demo_launched_ = true;
-  LoginDisplayHost::default_host()->StartDemoAppLaunch();
+
+  // Offline demo mode can be only enabled when demo mode feature is enabled.
+  const auto* command_line = base::CommandLine::ForCurrentProcess();
+  if (command_line->HasSwitch(switches::kEnableDemoMode) &&
+      command_line->HasSwitch(switches::kEnableOfflineDemoMode)) {
+    WizardController::default_controller()->StartDerelictDemoModeSetup();
+  } else {
+    LoginDisplayHost::default_host()->StartDemoAppLaunch();
+  }
 }
 
 void DemoModeDetector::OnOobeTimerUpdate() {

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.h b/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.h
index 27bb68a..45ed294 100644
--- a/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.h
+++ b/chrome/browser/chromeos/login/demo_mode/demo_mode_detector.h

@@ -18,8 +18,9 @@
 
 namespace chromeos {
 
-// Helper for idle state and demo-mode detection.
-// Should be initialized on OOBE start.
+// Helper for idle state and demo-mode detection. Will either enroll the device
+// into derelict offline Demo Mode or launch the old demo app in Kiosk mode,
+// depending on offline demo mode availability.
 class DemoModeDetector {
  public:
   DemoModeDetector();

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.cc b/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.cc
new file mode 100644
index 0000000..ac8f178
--- /dev/null
+++ b/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.cc

@@ -0,0 +1,138 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.h"
+
+#include <utility>
+
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/location.h"
+#include "base/logging.h"
+#include "base/memory/ptr_util.h"
+#include "base/metrics/histogram_macros.h"
+#include "base/task/post_task.h"
+#include "chrome/browser/chromeos/login/demo_mode/demo_session.h"
+#include "chromeos/dbus/dbus_thread_manager.h"
+#include "components/prefs/pref_registry_simple.h"
+#include "components/prefs/pref_service.h"
+
+namespace chromeos {
+
+namespace {
+
+DemoModeResourcesRemover* g_instance = nullptr;
+
+// Name of the pref in local state that indicates whether demo mode resources
+// have been removed from the device.
+constexpr char kDemoModeResourcesRemoved[] = "demo_mode_resources_removed";
+
+// Deletes directory at |path| from the device.
+DemoModeResourcesRemover::RemovalResult RemoveDirectory(
+    const base::FilePath& path) {
+  if (!base::DirectoryExists(path) || base::IsDirectoryEmpty(path))
+    return DemoModeResourcesRemover::RemovalResult::kNotFound;
+
+  if (!base::DeleteFile(path, true /*recursive*/))
+    return DemoModeResourcesRemover::RemovalResult::kFailed;
+
+  return DemoModeResourcesRemover::RemovalResult::kSuccess;
+}
+
+}  // namespace
+
+// static
+void DemoModeResourcesRemover::RegisterLocalStatePrefs(
+    PrefRegistrySimple* registry) {
+  registry->RegisterBooleanPref(kDemoModeResourcesRemoved, false);
+}
+
+// static
+std::unique_ptr<DemoModeResourcesRemover>
+DemoModeResourcesRemover::CreateIfNeeded(PrefService* local_state) {
+  if (DemoSession::IsDeviceInDemoMode() ||
+      local_state->GetBoolean(kDemoModeResourcesRemoved)) {
+    return nullptr;
+  }
+
+  return base::WrapUnique(new DemoModeResourcesRemover(local_state));
+}
+
+// static
+DemoModeResourcesRemover* DemoModeResourcesRemover::Get() {
+  return g_instance;
+}
+
+DemoModeResourcesRemover::~DemoModeResourcesRemover() {
+  CHECK_EQ(g_instance, this);
+  g_instance = nullptr;
+}
+
+void DemoModeResourcesRemover::LowDiskSpace(uint64_t free_disk_space) {
+  AttemptRemoval(RemovalReason::kLowDiskSpace, RemovalCallback());
+}
+
+void DemoModeResourcesRemover::AttemptRemoval(RemovalReason reason,
+                                              RemovalCallback callback) {
+  if (local_state_->GetBoolean(kDemoModeResourcesRemoved)) {
+    if (callback)
+      std::move(callback).Run(RemovalResult::kAlreadyRemoved);
+    return;
+  }
+
+  if (DemoSession::IsDeviceInDemoMode()) {
+    if (callback)
+      std::move(callback).Run(RemovalResult::kNotAllowed);
+    return;
+  }
+
+  if (callback)
+    removal_callbacks_.push_back(std::move(callback));
+
+  if (removal_in_progress_)
+    return;
+  removal_in_progress_ = true;
+
+  // Report this metric only once per resources directory removal task.
+  // Concurrent removal requests should not be reported multiple times.
+  UMA_HISTOGRAM_ENUMERATION("DemoMode.ResourcesRemoval.Reason", reason);
+
+  base::PostTaskWithTraitsAndReplyWithResult(
+      FROM_HERE,
+      {base::MayBlock(), base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN},
+      base::BindOnce(&RemoveDirectory,
+                     DemoSession::GetPreInstalledDemoResourcesPath()),
+      base::BindOnce(&DemoModeResourcesRemover::OnRemovalDone,
+                     weak_ptr_factory_.GetWeakPtr()));
+}
+
+DemoModeResourcesRemover::DemoModeResourcesRemover(PrefService* local_state)
+    : local_state_(local_state),
+      cryptohome_observer_(this),
+      weak_ptr_factory_(this) {
+  CHECK(!g_instance);
+  g_instance = this;
+
+  cryptohome_observer_.Add(DBusThreadManager::Get()->GetCryptohomeClient());
+}
+
+void DemoModeResourcesRemover::OnRemovalDone(RemovalResult result) {
+  DCHECK(removal_in_progress_);
+  removal_in_progress_ = false;
+
+  if (result == RemovalResult::kNotFound || result == RemovalResult::kSuccess) {
+    local_state_->SetBoolean(kDemoModeResourcesRemoved, true);
+    cryptohome_observer_.RemoveAll();
+  }
+
+  UMA_HISTOGRAM_ENUMERATION("DemoMode.ResourcesRemoval.Result", result);
+
+  std::vector<RemovalCallback> callbacks;
+  callbacks.swap(removal_callbacks_);
+
+  for (auto& callback : callbacks)
+    std::move(callback).Run(result);
+}
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.h b/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.h
new file mode 100644
index 0000000..e56e00e
--- /dev/null
+++ b/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.h

@@ -0,0 +1,123 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_LOGIN_DEMO_MODE_DEMO_MODE_RESOURCES_REMOVER_H_
+#define CHROME_BROWSER_CHROMEOS_LOGIN_DEMO_MODE_DEMO_MODE_RESOURCES_REMOVER_H_
+
+#include <memory>
+#include <vector>
+
+#include "base/callback_forward.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/scoped_observer.h"
+#include "chromeos/dbus/cryptohome_client.h"
+
+class PrefRegistrySimple;
+class PrefService;
+
+namespace chromeos {
+
+// Handles removal of pre-installed demo mode resources.
+// Observes system state to detect when pre-installed demo mode resources are
+// not needed anymore, and schedules their deletion from the disk.
+//
+// Only single instance is expected to be created per process.
+//
+// Demo mode resources are deleted if the device is not in demo mode, and any
+// of the following conditions are satisfied:
+//   * device is running low on disk space
+//   * TODO(crbug.com/827368): device is enrolled in a non-demo-mode domain
+//   * TODO(crbug.com/827368): enough non-demo-mode user activity has been
+//     detected on the device
+class DemoModeResourcesRemover : public CryptohomeClient::Observer {
+ public:
+  // The reason a removal was requested.
+  // DO NOT REORDER - used to report metrics.
+  enum class RemovalReason {
+    kLowDiskSpace = 0,
+    kEnterpriseEnrolled = 1,
+    kRegularUsage = 2,
+    kMaxValue = kRegularUsage
+  };
+
+  // The result of a removal attempt.
+  // DO NOT REORDER - used to report metrics.
+  enum class RemovalResult {
+    // Pre-installed resources were removed.
+    kSuccess = 0,
+
+    // Pre-installed resources were not found.
+    kNotFound = 1,
+
+    // Pre-installed resources cannot be removed in this session.
+    // Not expected to be reported in UMA.
+    kNotAllowed = 2,
+
+    // The resources have been previously removed.
+    // Not expected to be reported in UMA.
+    kAlreadyRemoved = 3,
+
+    // Attempt to remove pre-installed resources failed.
+    kFailed = 4,
+
+    kMaxValue = kFailed
+  };
+
+  // Callback for a request to remove demo mode resources from the stateful
+  // partition.
+  using RemovalCallback = base::OnceCallback<void(RemovalResult result)>;
+
+  static void RegisterLocalStatePrefs(PrefRegistrySimple* registry);
+
+  // Gets the demo mode resources remover instance for this process - at most
+  // one instance can be created per process.
+  static DemoModeResourcesRemover* Get();
+
+  // Creates a demo mode resources remover instance if it's required.
+  // It will return nullptr if a DemoModeResourcesRemover is not needed at the
+  // time - for example if the resources have previously been removed, or if the
+  // device is in demo mode.
+  //
+  // It should be called at most once per process - creating more than one
+  // DemoModeResourcesRemover instances will hit a CHECK.
+  static std::unique_ptr<DemoModeResourcesRemover> CreateIfNeeded(
+      PrefService* local_state);
+
+  ~DemoModeResourcesRemover() override;
+
+  // CryptohomeClient::Observer:
+  void LowDiskSpace(uint64_t free_disk_space) override;
+
+  // Requests demo mode resources removal from the disk. If a removal operation
+  // is already in progress, this method will schedule the callback to be run
+  // with the result of the operation in progress.
+  void AttemptRemoval(RemovalReason reason, RemovalCallback callback);
+
+ private:
+  // Use CreateIfNeeded() to create an instance.
+  explicit DemoModeResourcesRemover(PrefService* local_state);
+
+  // Passes as the callback to directory removal file operations.
+  void OnRemovalDone(RemovalResult result);
+
+  PrefService* const local_state_;
+
+  // Whether a resources removal operation is currently in progress.
+  bool removal_in_progress_ = false;
+
+  // Callbacks for the resources removal operation, if one is in progress.
+  std::vector<RemovalCallback> removal_callbacks_;
+
+  ScopedObserver<CryptohomeClient, DemoModeResourcesRemover>
+      cryptohome_observer_;
+
+  base::WeakPtrFactory<DemoModeResourcesRemover> weak_ptr_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(DemoModeResourcesRemover);
+};
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_LOGIN_DEMO_MODE_DEMO_MODE_RESOURCES_REMOVER_H_

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover_unittest.cc b/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover_unittest.cc
new file mode 100644
index 0000000..da6aa641
--- /dev/null
+++ b/chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover_unittest.cc

@@ -0,0 +1,259 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.h"
+
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/macros.h"
+#include "base/optional.h"
+#include "base/test/scoped_task_environment.h"
+#include "chrome/browser/chromeos/login/demo_mode/demo_session.h"
+#include "chromeos/dbus/dbus_thread_manager.h"
+#include "chromeos/dbus/fake_cryptohome_client.h"
+#include "components/prefs/testing_pref_service.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace chromeos {
+
+namespace {
+
+// Used as a callback to DemoModeResourcesRemover::AttemptRemoval - it records
+// the result of the attempt to |result_out|.
+void RecordRemovalResult(
+    base::Optional<DemoModeResourcesRemover::RemovalResult>* result_out,
+    DemoModeResourcesRemover::RemovalResult result) {
+  *result_out = result;
+}
+
+}  // namespace
+
+class DemoModeResourcesRemoverTest : public testing::Test {
+ public:
+  DemoModeResourcesRemoverTest() = default;
+  ~DemoModeResourcesRemoverTest() override = default;
+
+  void SetUp() override {
+    auto cryptohome_client = std::make_unique<FakeCryptohomeClient>();
+    cryptohome_client_ = cryptohome_client.get();
+
+    chromeos::DBusThreadManager::GetSetterForTesting()->SetCryptohomeClient(
+        std::move(cryptohome_client));
+
+    ASSERT_TRUE(scoped_temp_dir_.CreateUniqueTempDir());
+    demo_resources_path_ =
+        scoped_temp_dir_.GetPath().AppendASCII("demo-mode-resources");
+    DemoSession::OverridePreInstalledDemoResourcesPathForTesting(
+        &demo_resources_path_);
+
+    DemoSession::SetDemoModeEnrollmentTypeForTesting(
+        DemoSession::EnrollmentType::kUnenrolled);
+
+    DemoModeResourcesRemover::RegisterLocalStatePrefs(local_state_.registry());
+  }
+
+  void TearDown() override {
+    DemoSession::ShutDownIfInitialized();
+    DemoSession::OverridePreInstalledDemoResourcesPathForTesting(nullptr);
+    DemoSession::SetDemoModeEnrollmentTypeForTesting(
+        DemoSession::EnrollmentType::kNone);
+    chromeos::DBusThreadManager::Shutdown();
+  }
+
+ protected:
+  bool CreateDemoModeResources() {
+    if (!base::CreateDirectory(demo_resources_path_))
+      return false;
+
+    const std::string manifest = R"({
+        "name": "demo-mode-resources",
+        "version": "0.0.1",
+        "min_env_version": "1.0"
+    })";
+    if (base::WriteFile(demo_resources_path_.AppendASCII("manifest.json"),
+                        manifest.data(), manifest.size()) < 0) {
+      return false;
+    }
+
+    const std::string image = "fake image content";
+    if (base::WriteFile(demo_resources_path_.AppendASCII("image.squash"),
+                        image.data(), manifest.size()) < 0) {
+      return false;
+    }
+
+    return true;
+  }
+
+  bool DemoModeResourcesExist() {
+    return base::DirectoryExists(demo_resources_path_);
+  }
+
+  FakeCryptohomeClient* cryptohome_client_ = nullptr;
+
+  TestingPrefServiceSimple local_state_;
+  base::test::ScopedTaskEnvironment task_environment_;
+
+ private:
+  base::ScopedTempDir scoped_temp_dir_;
+  base::FilePath demo_resources_path_;
+
+  DISALLOW_COPY_AND_ASSIGN(DemoModeResourcesRemoverTest);
+};
+
+TEST_F(DemoModeResourcesRemoverTest, LowDiskSpace) {
+  ASSERT_TRUE(CreateDemoModeResources());
+
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  ASSERT_TRUE(remover.get());
+  EXPECT_EQ(DemoModeResourcesRemover::Get(), remover.get());
+
+  cryptohome_client_->NotifyLowDiskSpace(1024 * 1024 * 1024);
+  task_environment_.RunUntilIdle();
+  EXPECT_FALSE(DemoModeResourcesExist());
+}
+
+TEST_F(DemoModeResourcesRemoverTest, LowDiskSpaceInDemoSession) {
+  ASSERT_TRUE(CreateDemoModeResources());
+  DemoSession::SetDemoModeEnrollmentTypeForTesting(
+      DemoSession::EnrollmentType::kOnline);
+
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  EXPECT_FALSE(remover.get());
+  EXPECT_FALSE(DemoModeResourcesRemover::Get());
+
+  cryptohome_client_->NotifyLowDiskSpace(1024 * 1024 * 1024);
+  task_environment_.RunUntilIdle();
+  EXPECT_TRUE(DemoModeResourcesExist());
+}
+
+TEST_F(DemoModeResourcesRemoverTest, NotCreatedAfterResourcesRemoved) {
+  ASSERT_TRUE(CreateDemoModeResources());
+
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  ASSERT_TRUE(remover.get());
+  EXPECT_EQ(DemoModeResourcesRemover::Get(), remover.get());
+
+  cryptohome_client_->NotifyLowDiskSpace(1024 * 1024 * 1024);
+  task_environment_.RunUntilIdle();
+  EXPECT_FALSE(DemoModeResourcesExist());
+
+  // Reset the resources remover - subsequent attempts to create the remover
+  // instance should return nullptr.
+  remover.reset();
+  EXPECT_FALSE(DemoModeResourcesRemover::CreateIfNeeded(&local_state_));
+}
+
+TEST_F(DemoModeResourcesRemoverTest, AttemptRemoval) {
+  ASSERT_TRUE(CreateDemoModeResources());
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  ASSERT_TRUE(remover.get());
+  EXPECT_EQ(DemoModeResourcesRemover::Get(), remover.get());
+
+  base::Optional<DemoModeResourcesRemover::RemovalResult> result;
+  remover->AttemptRemoval(
+      DemoModeResourcesRemover::RemovalReason::kEnterpriseEnrolled,
+      base::BindOnce(&RecordRemovalResult, &result));
+
+  task_environment_.RunUntilIdle();
+
+  ASSERT_TRUE(result.has_value());
+  EXPECT_EQ(DemoModeResourcesRemover::RemovalResult::kSuccess, result.value());
+  EXPECT_FALSE(DemoModeResourcesExist());
+}
+
+TEST_F(DemoModeResourcesRemoverTest, AttemptRemovalResourcesNonExistent) {
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  ASSERT_TRUE(remover.get());
+  EXPECT_EQ(DemoModeResourcesRemover::Get(), remover.get());
+
+  base::Optional<DemoModeResourcesRemover::RemovalResult> result;
+  remover->AttemptRemoval(
+      DemoModeResourcesRemover::RemovalReason::kLowDiskSpace,
+      base::BindOnce(&RecordRemovalResult, &result));
+
+  task_environment_.RunUntilIdle();
+
+  ASSERT_TRUE(result.has_value());
+  EXPECT_EQ(DemoModeResourcesRemover::RemovalResult::kNotFound, result.value());
+}
+
+TEST_F(DemoModeResourcesRemoverTest, AttemptRemovalInDemoSession) {
+  ASSERT_TRUE(CreateDemoModeResources());
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  DemoSession::SetDemoModeEnrollmentTypeForTesting(
+      DemoSession::EnrollmentType::kOnline);
+
+  base::Optional<DemoModeResourcesRemover::RemovalResult> result;
+  remover->AttemptRemoval(
+      DemoModeResourcesRemover::RemovalReason::kLowDiskSpace,
+      base::BindOnce(&RecordRemovalResult, &result));
+
+  ASSERT_TRUE(result.has_value());
+  EXPECT_EQ(DemoModeResourcesRemover::RemovalResult::kNotAllowed,
+            result.value());
+  EXPECT_TRUE(DemoModeResourcesExist());
+}
+
+TEST_F(DemoModeResourcesRemoverTest, ConcurrentRemovalAttempts) {
+  ASSERT_TRUE(CreateDemoModeResources());
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  ASSERT_TRUE(remover.get());
+  EXPECT_EQ(DemoModeResourcesRemover::Get(), remover.get());
+
+  base::Optional<DemoModeResourcesRemover::RemovalResult> result_1;
+  remover->AttemptRemoval(
+      DemoModeResourcesRemover::RemovalReason::kLowDiskSpace,
+      base::BindOnce(&RecordRemovalResult, &result_1));
+
+  base::Optional<DemoModeResourcesRemover::RemovalResult> result_2;
+  remover->AttemptRemoval(
+      DemoModeResourcesRemover::RemovalReason::kLowDiskSpace,
+      base::BindOnce(&RecordRemovalResult, &result_2));
+
+  task_environment_.RunUntilIdle();
+
+  EXPECT_FALSE(DemoModeResourcesExist());
+  ASSERT_TRUE(result_1.has_value());
+  EXPECT_EQ(DemoModeResourcesRemover::RemovalResult::kSuccess,
+            result_1.value());
+
+  ASSERT_TRUE(result_2.has_value());
+  EXPECT_EQ(DemoModeResourcesRemover::RemovalResult::kSuccess,
+            result_2.value());
+}
+
+TEST_F(DemoModeResourcesRemoverTest, RepeatedRemovalAttempt) {
+  ASSERT_TRUE(CreateDemoModeResources());
+  std::unique_ptr<DemoModeResourcesRemover> remover =
+      DemoModeResourcesRemover::CreateIfNeeded(&local_state_);
+  ASSERT_TRUE(remover.get());
+  remover->AttemptRemoval(
+      DemoModeResourcesRemover::RemovalReason::kLowDiskSpace,
+      DemoModeResourcesRemover::RemovalCallback());
+  task_environment_.RunUntilIdle();
+
+  EXPECT_FALSE(DemoModeResourcesExist());
+
+  base::Optional<DemoModeResourcesRemover::RemovalResult> result;
+  remover->AttemptRemoval(
+      DemoModeResourcesRemover::RemovalReason::kLowDiskSpace,
+      base::BindOnce(&RecordRemovalResult, &result));
+  ASSERT_TRUE(result.has_value());
+  EXPECT_EQ(DemoModeResourcesRemover::RemovalResult::kAlreadyRemoved,
+            result.value());
+}
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_session.cc b/chrome/browser/chromeos/login/demo_mode/demo_session.cc
index dd5165e..1b42996f 100644
--- a/chrome/browser/chromeos/login/demo_mode/demo_session.cc
+++ b/chrome/browser/chromeos/login/demo_mode/demo_session.cc

@@ -15,7 +15,6 @@
 #include "chrome/browser/chromeos/settings/install_attributes.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/image_loader_client.h"
-#include "content/public/browser/browser_thread.h"
 
 namespace chromeos {
 
@@ -37,6 +36,10 @@
     FILE_PATH_LITERAL(
         "/mnt/stateful_partition/unencrypted/demo_mode_resources");
 
+// Can be set in test to override location of preinstalled offline resources
+// component path.
+const base::FilePath* g_pre_installed_demo_resources_path_override = nullptr;
+
 // Path relative to the path at which offline demo resources are loaded that
 // contains image with demo Android apps.
 constexpr base::FilePath::CharType kDemoAppsPath[] =
@@ -46,7 +49,6 @@
     FILE_PATH_LITERAL("demo_extensions.json");
 
 bool IsDemoModeOfflineEnrolled() {
-  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   DCHECK(DemoSession::IsDeviceInDemoMode());
   return DemoSession::GetEnrollmentType() ==
          DemoSession::EnrollmentType::kOffline;
@@ -55,8 +57,20 @@
 }  // namespace
 
 // static
+base::FilePath DemoSession::GetPreInstalledDemoResourcesPath() {
+  if (g_pre_installed_demo_resources_path_override)
+    return *g_pre_installed_demo_resources_path_override;
+  return base::FilePath(kPreInstalledDemoResourcesComponentPath);
+}
+
+// static
+void DemoSession::OverridePreInstalledDemoResourcesPathForTesting(
+    base::FilePath* overriden_path) {
+  g_pre_installed_demo_resources_path_override = overriden_path;
+}
+
+// static
 bool DemoSession::IsDeviceInDemoMode() {
-  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   const EnrollmentType enrollment_type = GetEnrollmentType();
   return enrollment_type != EnrollmentType::kNone &&
          enrollment_type != EnrollmentType::kUnenrolled;
@@ -77,7 +91,6 @@
 // static
 void DemoSession::SetDemoModeEnrollmentTypeForTesting(
     EnrollmentType enrollment_type) {
-  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   g_force_enrollment_type = enrollment_type;
 }
 
@@ -167,8 +180,7 @@
   chromeos::DBusThreadManager::Get()
       ->GetImageLoaderClient()
       ->LoadComponentAtPath(
-          kDemoResourcesComponentName,
-          base::FilePath(kPreInstalledDemoResourcesComponentPath),
+          kDemoResourcesComponentName, GetPreInstalledDemoResourcesPath(),
           base::BindOnce(&DemoSession::OnOfflineResourcesLoaded,
                          weak_ptr_factory_.GetWeakPtr()));
 }

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_session.h b/chrome/browser/chromeos/login/demo_mode/demo_session.h
index 7550bec8..3c27633 100644
--- a/chrome/browser/chromeos/login/demo_mode/demo_session.h
+++ b/chrome/browser/chromeos/login/demo_mode/demo_session.h

@@ -35,6 +35,12 @@
     kOffline,
   };
 
+  // Location on disk where pre-installed demo mode resources are expected to be
+  // found.
+  static base::FilePath GetPreInstalledDemoResourcesPath();
+  static void OverridePreInstalledDemoResourcesPathForTesting(
+      base::FilePath* overriden_path);
+
   // Whether the device is set up to run demo sessions.
   static bool IsDeviceInDemoMode();
 

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.cc b/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.cc
index bb32d8e2..be451c03 100644
--- a/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.cc
+++ b/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.cc

@@ -31,9 +31,11 @@
     "local_account_policy";
 
 // The policy blob data for offline demo-mode is embedded into the filesystem.
-// TODO(mukai, agawronska): fix this when switching to dm-verity image.
+// TODO(mukai, agawronska): fix these when switching to dm-verity image.
 constexpr const base::FilePath::CharType kOfflineDemoModeDir[] =
     FILE_PATH_LITERAL("/usr/share/demo_mode_resources/policy");
+constexpr const base::FilePath::CharType kDerelictOfflineDemoModeDir[] =
+    FILE_PATH_LITERAL("/usr/share/demo_mode_resources/derelict_policy");
 
 bool CheckOfflinePolicyFilesExist(const base::FilePath& policy_dir,
                                   std::string* message) {
@@ -130,7 +132,12 @@
 }
 
 bool DemoSetupController::IsOfflineEnrollment() const {
-  return enrollment_type_ && *enrollment_type_ == EnrollmentType::kOffline;
+  return enrollment_type_ && *enrollment_type_ != EnrollmentType::kOnline;
+}
+
+bool DemoSetupController::IsDerelictOfflineEnrollment() const {
+  return enrollment_type_ &&
+         *enrollment_type_ == EnrollmentType::kDerelictOffline;
 }
 
 void DemoSetupController::Enroll(OnSetupSuccess on_setup_success,
@@ -143,20 +150,21 @@
   on_setup_success_ = std::move(on_setup_success);
   on_setup_error_ = std::move(on_setup_error);
 
-  switch (*enrollment_type_) {
-    case EnrollmentType::kOnline:
-      EnrollOnline();
-      return;
-    case EnrollmentType::kOffline: {
-      const base::FilePath offline_data_dir =
-          policy_dir_for_tests_.empty() ? base::FilePath(kOfflineDemoModeDir)
-                                        : policy_dir_for_tests_;
-      EnrollOffline(offline_data_dir);
-      return;
-    }
-    default:
-      NOTREACHED() << "Unknown demo mode enrollment type";
+  if (*enrollment_type_ == EnrollmentType::kOnline) {
+    EnrollOnline();
+    return;
   }
+
+  base::FilePath offline_data_dir;
+  if (!policy_dir_for_tests_.empty()) {
+    offline_data_dir = policy_dir_for_tests_;
+  } else {
+    offline_data_dir =
+        base::FilePath(*enrollment_type_ == EnrollmentType::kOffline
+                           ? kOfflineDemoModeDir
+                           : kDerelictOfflineDemoModeDir);
+  }
+  EnrollOffline(offline_data_dir);
 }
 
 void DemoSetupController::EnrollOnline() {

diff --git a/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.h b/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.h
index 3d65d1f..ecf4190 100644
--- a/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.h
+++ b/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.h

@@ -29,6 +29,9 @@
     kOnline,
     // Offline enrollment into demo mode that is established locally.
     kOffline,
+    // Offline enrollment into demo mode that is established locally due to
+    // device being derelict.
+    kDerelictOffline,
   };
 
   // Type of demo mode setup error.
@@ -68,9 +71,13 @@
     enrollment_type_ = enrollment_type;
   }
 
-  // Whether offline enrollment is used for setup.
+  // Whether offline enrollment is used for setup. This includes manual and
+  // derelict enrollment.
   bool IsOfflineEnrollment() const;
 
+  // Whether derelict offline enrollment occurred.
+  bool IsDerelictOfflineEnrollment() const;
+
   // Initiates enrollment that sets up the device in the demo mode domain. The
   // |enrollment_type_| determines whether online or offline setup will be
   // performed and it should be set with set_enrollment_type() before calling

diff --git a/chrome/browser/chromeos/login/demo_setup_browsertest.cc b/chrome/browser/chromeos/login/demo_setup_browsertest.cc
index 6ffb8b0..0caf376a 100644
--- a/chrome/browser/chromeos/login/demo_setup_browsertest.cc
+++ b/chrome/browser/chromeos/login/demo_setup_browsertest.cc

@@ -382,20 +382,26 @@
             OobeScreen::SCREEN_OOBE_DEMO_SETUP));
   }
 
-  void SimulateOfflineEnvironment() {
+  // Simulates offline data directory.
+  void MockOfflinePolicyDir() {
     DemoSetupController* controller =
         WizardController::default_controller()->demo_setup_controller();
 
-    // Simulate offline data directory.
     ASSERT_TRUE(SetupDummyOfflinePolicyDir("test", &fake_policy_dir_));
     controller->SetOfflineDataDirForTest(fake_policy_dir_.GetPath());
+  }
 
+  // Simulates policy store that loads or fails to load.
+  void MockOfflinePolicyStore(bool valid) {
     // Simulate policy store.
     EXPECT_CALL(mock_policy_store_, Store(testing::_))
         .WillRepeatedly(testing::InvokeWithoutArgs(
             &mock_policy_store_,
-            &policy::MockCloudPolicyStore::NotifyStoreLoaded));
-    controller->SetDeviceLocalAccountPolicyStoreForTest(&mock_policy_store_);
+            valid ? &policy::MockCloudPolicyStore::NotifyStoreLoaded
+                  : &policy::MockCloudPolicyStore::NotifyStoreError));
+    WizardController::default_controller()
+        ->demo_setup_controller()
+        ->SetDeviceLocalAccountPolicyStoreForTest(&mock_policy_store_);
   }
 
   // Simulates device being connected to the network.
@@ -629,7 +635,8 @@
 
   // It needs to be done after demo setup controller was created (demo setup
   // flow was started).
-  SimulateOfflineEnvironment();
+  MockOfflinePolicyDir();
+  MockOfflinePolicyStore(true /* valid */);
 
   OobeScreenWaiter(OobeScreen::SCREEN_OOBE_DEMO_PREFERENCES).Wait();
   EXPECT_TRUE(IsScreenShown(OobeScreen::SCREEN_OOBE_DEMO_PREFERENCES));
@@ -673,7 +680,8 @@
 
   // It needs to be done after demo setup controller was created (demo setup
   // flow was started).
-  SimulateOfflineEnvironment();
+  MockOfflinePolicyDir();
+  MockOfflinePolicyStore(true /* valid */);
 
   OobeScreenWaiter(OobeScreen::SCREEN_OOBE_DEMO_PREFERENCES).Wait();
   EXPECT_TRUE(IsScreenShown(OobeScreen::SCREEN_OOBE_DEMO_PREFERENCES));
@@ -707,6 +715,87 @@
   EXPECT_FALSE(StartupUtils::IsDeviceRegistered());
 }
 
+IN_PROC_BROWSER_TEST_F(DemoSetupTest, DerelictOfflineSetupFlowSuccess) {
+  // Simulate offline setup success.
+  EnterpriseEnrollmentHelper::SetupEnrollmentHelperMock(
+      &MockDemoModeOfflineEnrollmentHelperCreator<
+          DemoModeSetupResult::SUCCESS>);
+  SimulateNetworkDisconnected();
+
+  auto* const wizard_controller = WizardController::default_controller();
+  wizard_controller->StartDerelictDemoModeSetup();
+
+  EXPECT_TRUE(
+      wizard_controller->demo_setup_controller()->IsOfflineEnrollment());
+  EXPECT_TRUE(wizard_controller->demo_setup_controller()
+                  ->IsDerelictOfflineEnrollment());
+
+  // This needs to be done after demo setup controller was created (demo setup
+  // flow was started).
+  MockOfflinePolicyDir();
+  MockOfflinePolicyStore(true /* valid */);
+
+  OobeScreenWaiter(OobeScreen::SCREEN_OOBE_DEMO_SETUP).Wait();
+
+  // TODO(michaelpg): Progress dialog transition is async - extra work is
+  // needed to be able to check it reliably.
+
+  OobeScreenWaiter(OobeScreen::SCREEN_GAIA_SIGNIN).Wait();
+}
+
+IN_PROC_BROWSER_TEST_F(DemoSetupTest, DerelictOfflineSetupFlowError) {
+  // Simulate offline setup error.
+  EnterpriseEnrollmentHelper::SetupEnrollmentHelperMock(
+      &MockDemoModeOfflineEnrollmentHelperCreator<DemoModeSetupResult::ERROR>);
+  SimulateNetworkDisconnected();
+
+  auto* const wizard_controller = WizardController::default_controller();
+  wizard_controller->StartDerelictDemoModeSetup();
+
+  EXPECT_TRUE(
+      wizard_controller->demo_setup_controller()->IsOfflineEnrollment());
+  EXPECT_TRUE(wizard_controller->demo_setup_controller()
+                  ->IsDerelictOfflineEnrollment());
+
+  // This needs to be done after demo setup controller was created (demo setup
+  // flow was started).
+  MockOfflinePolicyDir();
+  MockOfflinePolicyStore(true /* valid */);
+
+  OobeScreenWaiter(OobeScreen::SCREEN_OOBE_DEMO_SETUP).Wait();
+
+  // For derelict enrollment, a recoverable error returns the user to the
+  // Welcome screen.
+  OobeScreenWaiter(OobeScreen::SCREEN_OOBE_WELCOME).Wait();
+}
+
+IN_PROC_BROWSER_TEST_F(DemoSetupTest, DerelictOfflineSetupFlowFatalError) {
+  // Simulate offline setup success. The fatal error will come from the
+  // unreadable policy store.
+  EnterpriseEnrollmentHelper::SetupEnrollmentHelperMock(
+      &MockDemoModeOfflineEnrollmentHelperCreator<
+          DemoModeSetupResult::SUCCESS>);
+  SimulateNetworkDisconnected();
+
+  auto* const wizard_controller = WizardController::default_controller();
+  wizard_controller->StartDerelictDemoModeSetup();
+
+  EXPECT_TRUE(
+      wizard_controller->demo_setup_controller()->IsOfflineEnrollment());
+  EXPECT_TRUE(wizard_controller->demo_setup_controller()
+                  ->IsDerelictOfflineEnrollment());
+
+  // This needs to be done after demo setup controller was created (demo setup
+  // flow was started).
+  MockOfflinePolicyDir();
+  MockOfflinePolicyStore(false /* valid */);
+
+  // On fatal error, stay on the Setup screen.
+  OobeScreenWaiter(OobeScreen::SCREEN_OOBE_DEMO_SETUP).Wait();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_TRUE(IsScreenShown(OobeScreen::SCREEN_OOBE_DEMO_SETUP));
+}
+
 IN_PROC_BROWSER_TEST_F(DemoSetupTest, NextDisabledOnNetworkScreen) {
   SimulateNetworkDisconnected();
   SkipToScreen(OobeScreen::SCREEN_OOBE_NETWORK);
@@ -858,4 +947,37 @@
   EXPECT_FALSE(IsConfirmationDialogShown());
 }
 
+class DemoSetupDerelictTest : public DemoSetupTest {
+ protected:
+  DemoSetupDerelictTest() = default;
+  ~DemoSetupDerelictTest() override = default;
+
+  // DemoSetupTest:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    DemoSetupTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitchASCII(switches::kDerelictDetectionTimeout, "1");
+    command_line->AppendSwitchASCII(switches::kDerelictIdleTimeout, "1");
+    command_line->AppendSwitchASCII(switches::kOobeTimerInterval, "1");
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DemoSetupDerelictTest);
+};
+
+IN_PROC_BROWSER_TEST_F(DemoSetupDerelictTest, DerelictSetup) {
+  // Simulate offline setup error.
+  EnterpriseEnrollmentHelper::SetupEnrollmentHelperMock(
+      &MockDemoModeOfflineEnrollmentHelperCreator<DemoModeSetupResult::ERROR>);
+  SimulateNetworkDisconnected();
+
+  // Demo setup starts automatically after idle detection timeouts.
+  OobeScreenWaiter(OobeScreen::SCREEN_OOBE_DEMO_SETUP).Wait();
+
+  // TODO(michaelpg): Mock policy directory and policy store so we can test
+  // enrollment success. Currently this must be done after the
+  // DemoSetupController is created, but policy install has already failed by
+  // this point.
+  OobeScreenWaiter(OobeScreen::SCREEN_OOBE_WELCOME).Wait();
+}
+
 }  // namespace chromeos

diff --git a/chrome/browser/chromeos/login/screens/demo_setup_screen.cc b/chrome/browser/chromeos/login/screens/demo_setup_screen.cc
index 7fd224f..c2497732 100644
--- a/chrome/browser/chromeos/login/screens/demo_setup_screen.cc
+++ b/chrome/browser/chromeos/login/screens/demo_setup_screen.cc

@@ -33,6 +33,7 @@
 }
 
 void DemoSetupScreen::Show() {
+  DCHECK(DemoSetupController::IsOobeDemoSetupFlowInProgress());
   if (view_)
     view_->Show();
 }
@@ -53,6 +54,16 @@
 }
 
 void DemoSetupScreen::OnSetupError(DemoSetupController::DemoSetupError error) {
+  if (error != DemoSetupController::DemoSetupError::kFatal &&
+      WizardController::default_controller()
+          ->demo_setup_controller()
+          ->IsDerelictOfflineEnrollment()) {
+    // Silently return to the welcome screen since enrollment was attempted
+    // automatically.
+    Finish(ScreenExitCode::DEMO_MODE_SETUP_CANCELED);
+    return;
+  }
+
   // TODO(mukai): propagate |error| information and change the error message.
   view_->OnSetupFinished(false, std::string());
 }

diff --git a/chrome/browser/chromeos/login/wizard_controller.cc b/chrome/browser/chromeos/login/wizard_controller.cc
index be177a6..debad8e 100644
--- a/chrome/browser/chromeos/login/wizard_controller.cc
+++ b/chrome/browser/chromeos/login/wizard_controller.cc

@@ -1436,6 +1436,14 @@
   ShowDemoModePreferencesScreen();
 }
 
+void WizardController::StartDerelictDemoModeSetup() {
+  DCHECK(!demo_setup_controller_);
+  demo_setup_controller_ = std::make_unique<DemoSetupController>();
+  demo_setup_controller_->set_enrollment_type(
+      DemoSetupController::EnrollmentType::kDerelictOffline);
+  ShowDemoModeSetupScreen();
+}
+
 void WizardController::SimulateDemoModeSetupForTesting() {
   demo_setup_controller_ = std::make_unique<DemoSetupController>();
 }

diff --git a/chrome/browser/chromeos/login/wizard_controller.h b/chrome/browser/chromeos/login/wizard_controller.h
index 7fb5e33..f9cb314 100644
--- a/chrome/browser/chromeos/login/wizard_controller.h
+++ b/chrome/browser/chromeos/login/wizard_controller.h

@@ -114,6 +114,12 @@
   //    chromeos::OobeScreen::SCREEN_OOBE_DEMO_SETUP
   void StartDemoModeSetup();
 
+  // Starts derelict Demo Mode setup flow. This should only occur when the
+  // device has been idle on the Welcome screen.
+  // The device will auto-enroll into derelict Demo Mode with no user input
+  // required.
+  void StartDerelictDemoModeSetup();
+
   void SimulateDemoModeSetupForTesting();
 
   // Advances to login/update screen. Should be used in for testing only.

diff --git a/chrome/browser/chromeos/login/wizard_controller_browsertest.cc b/chrome/browser/chromeos/login/wizard_controller_browsertest.cc
index 693f29fc..64868654 100644
--- a/chrome/browser/chromeos/login/wizard_controller_browsertest.cc
+++ b/chrome/browser/chromeos/login/wizard_controller_browsertest.cc

@@ -43,6 +43,7 @@
 #include "chrome/browser/chromeos/login/screens/welcome_screen.h"
 #include "chrome/browser/chromeos/login/screens/wrong_hwid_screen.h"
 #include "chrome/browser/chromeos/login/startup_utils.h"
+#include "chrome/browser/chromeos/login/test/oobe_screen_waiter.h"
 #include "chrome/browser/chromeos/login/test/wizard_in_process_browser_test.h"
 #include "chrome/browser/chromeos/login/ui/login_display_host.h"
 #include "chrome/browser/chromeos/login/ui/webui_login_view.h"
@@ -2441,6 +2442,28 @@
   EXPECT_TRUE(DemoSetupController::IsOobeDemoSetupFlowInProgress());
 }
 
+IN_PROC_BROWSER_TEST_F(WizardControllerDemoSetupTest,
+                       DerelictOfflineDemoSetupFlowFinished) {
+  CheckCurrentScreen(OobeScreen::SCREEN_OOBE_WELCOME);
+  EXPECT_FALSE(DemoSetupController::IsOobeDemoSetupFlowInProgress());
+  WaitUntilJSIsReady();
+
+  EXPECT_CALL(*mock_welcome_screen_, Hide()).Times(1);
+  EXPECT_CALL(*mock_welcome_screen_, SetConfiguration(IsNull(), _)).Times(1);
+  EXPECT_CALL(*mock_demo_setup_screen_, Show()).Times(1);
+
+  WizardController::default_controller()->StartDerelictDemoModeSetup();
+
+  CheckCurrentScreen(OobeScreen::SCREEN_OOBE_DEMO_SETUP);
+  EXPECT_TRUE(DemoSetupController::IsOobeDemoSetupFlowInProgress());
+
+  OnExit(*mock_demo_setup_screen_, ScreenExitCode::DEMO_MODE_SETUP_FINISHED);
+
+  EXPECT_TRUE(StartupUtils::IsOobeCompleted());
+  EXPECT_TRUE(ExistingUserController::current_controller());
+  EXPECT_FALSE(DemoSetupController::IsOobeDemoSetupFlowInProgress());
+}
+
 class WizardControllerOobeResumeTest : public WizardControllerTest {
  protected:
   WizardControllerOobeResumeTest() {}

diff --git a/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.cc b/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.cc
new file mode 100644
index 0000000..15c8f97
--- /dev/null
+++ b/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.cc

@@ -0,0 +1,53 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.h"
+
+#include <utility>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "chrome/browser/chromeos/android_sms/android_sms_urls.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/web_applications/components/pending_app_manager.h"
+#include "chrome/browser/web_applications/web_app_provider.h"
+#include "chromeos/components/proximity_auth/logging/logging.h"
+
+namespace chromeos {
+
+namespace multidevice_setup {
+
+AndroidSmsAppInstallDelegateImpl::AndroidSmsAppInstallDelegateImpl(
+    Profile* profile)
+    : pending_app_manager_(
+          &web_app::WebAppProvider::Get(profile)->pending_app_manager()),
+      weak_ptr_factory_(this) {}
+
+AndroidSmsAppInstallDelegateImpl::AndroidSmsAppInstallDelegateImpl(
+    web_app::PendingAppManager* pending_app_manager)
+    : pending_app_manager_(pending_app_manager), weak_ptr_factory_(this) {}
+
+AndroidSmsAppInstallDelegateImpl::~AndroidSmsAppInstallDelegateImpl() = default;
+
+void AndroidSmsAppInstallDelegateImpl::InstallAndroidSmsApp() {
+  // TODO(crbug.com/874605): Consider retries and error handling here. This call
+  // can easily fail.
+  pending_app_manager_->Install(
+      web_app::PendingAppManager::AppInfo(
+          chromeos::android_sms::GetAndroidMessagesURL(),
+          web_app::PendingAppManager::LaunchContainer::kWindow),
+      base::BindOnce(&AndroidSmsAppInstallDelegateImpl::OnAppInstalled,
+                     weak_ptr_factory_.GetWeakPtr()));
+}
+
+void AndroidSmsAppInstallDelegateImpl::OnAppInstalled(
+    const GURL& app_url,
+    const std::string& app_id) {
+  PA_LOG(INFO) << "Messages app installed! URL: " << app_url
+               << ". Id: " << app_id;
+}
+
+}  // namespace multidevice_setup
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.h b/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.h
new file mode 100644
index 0000000..45c4c4e
--- /dev/null
+++ b/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.h

@@ -0,0 +1,49 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_MULTIDEVICE_SETUP_ANDROID_SMS_APP_INSTALL_DELEGATE_IMPL_H_
+#define CHROME_BROWSER_CHROMEOS_MULTIDEVICE_SETUP_ANDROID_SMS_APP_INSTALL_DELEGATE_IMPL_H_
+
+#include <string>
+
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h"
+#include "url/gurl.h"
+
+class Profile;
+
+namespace web_app {
+class PendingAppManager;
+}  // namespace web_app
+
+namespace chromeos {
+namespace multidevice_setup {
+
+class AndroidSmsAppInstallDelegateImpl : public AndroidSmsAppInstallDelegate {
+ public:
+  explicit AndroidSmsAppInstallDelegateImpl(Profile* profile);
+  ~AndroidSmsAppInstallDelegateImpl() override;
+
+ private:
+  friend class AndroidSmsAppInstallDelegateImplTest;
+
+  explicit AndroidSmsAppInstallDelegateImpl(
+      web_app::PendingAppManager* pending_app_manager);
+  void OnAppInstalled(const GURL& app_url, const std::string& app_id);
+
+  // AndroidSmsAppInstallDelegate:
+  void InstallAndroidSmsApp() override;
+
+  static const char kMessagesWebAppUrl[];
+  web_app::PendingAppManager* pending_app_manager_;
+  base::WeakPtrFactory<AndroidSmsAppInstallDelegateImpl> weak_ptr_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(AndroidSmsAppInstallDelegateImpl);
+};
+
+}  // namespace multidevice_setup
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_MULTIDEVICE_SETUP_ANDROID_SMS_APP_INSTALL_DELEGATE_IMPL_H_

diff --git a/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl_unittest.cc b/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl_unittest.cc
new file mode 100644
index 0000000..0d780a5
--- /dev/null
+++ b/chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl_unittest.cc

@@ -0,0 +1,63 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.h"
+
+#include <memory>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/macros.h"
+#include "base/memory/ptr_util.h"
+#include "chrome/browser/chromeos/android_sms/android_sms_urls.h"
+#include "chrome/browser/web_applications/components/test_pending_app_manager.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace chromeos {
+
+namespace multidevice_setup {
+
+class AndroidSmsAppInstallDelegateImplTest : public testing::Test {
+ protected:
+  AndroidSmsAppInstallDelegateImplTest() = default;
+  ~AndroidSmsAppInstallDelegateImplTest() override = default;
+
+  // testing::Test:
+  void SetUp() override {
+    test_pending_app_manager_ =
+        std::make_unique<web_app::TestPendingAppManager>();
+    android_sms_app_install_delegate_ = base::WrapUnique(
+        new AndroidSmsAppInstallDelegateImpl(test_pending_app_manager_.get()));
+  }
+
+  web_app::TestPendingAppManager* test_pending_app_manager() {
+    return test_pending_app_manager_.get();
+  }
+
+  void InstallApp() {
+    android_sms_app_install_delegate_->InstallAndroidSmsApp();
+  }
+
+ private:
+  std::unique_ptr<web_app::TestPendingAppManager> test_pending_app_manager_;
+  std::unique_ptr<AndroidSmsAppInstallDelegate>
+      android_sms_app_install_delegate_;
+
+  DISALLOW_COPY_AND_ASSIGN(AndroidSmsAppInstallDelegateImplTest);
+};
+
+TEST_F(AndroidSmsAppInstallDelegateImplTest, TestInstallMessagesApp) {
+  InstallApp();
+
+  std::vector<web_app::PendingAppManager::AppInfo> expected_apps_to_install;
+  expected_apps_to_install.emplace_back(
+      chromeos::android_sms::GetAndroidMessagesURL(),
+      web_app::PendingAppManager::LaunchContainer::kWindow);
+  EXPECT_EQ(expected_apps_to_install,
+            test_pending_app_manager()->installed_apps());
+}
+
+}  // namespace multidevice_setup
+
+}  // namespace chromeos

diff --git a/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc b/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
index 422c5713..b6f3c24 100644
--- a/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
+++ b/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc

@@ -428,28 +428,29 @@
 bool ChromeContentBrowserClientExtensionsPart::ShouldLockToOrigin(
     content::BrowserContext* browser_context,
     const GURL& effective_site_url) {
-  // https://crbug.com/160576 workaround: Origin lock to the chrome-extension://
-  // scheme for a hosted app would kill processes on legitimate requests for the
-  // app's cookies.
-  if (effective_site_url.SchemeIs(extensions::kExtensionScheme)) {
-    const Extension* extension =
-        ExtensionRegistry::Get(browser_context)
-            ->enabled_extensions()
-            .GetExtensionOrAppByURL(effective_site_url);
-    if (extension && extension->is_hosted_app())
-      return false;
+  if (!effective_site_url.SchemeIs(kExtensionScheme))
+    return true;
 
-    // Extensions are allowed to share processes, even in --site-per-process
-    // currently. See https://crbug.com/600441#c1 for some background on the
-    // intersection of extension process reuse and site isolation.
-    //
-    // TODO(nick): Fix this, possibly by revamping the extensions process model
-    // so that sharing is determined by privilege level, as described in
-    // https://crbug.com/766267
-    if (extension)
-      return false;
-  }
-  return true;
+  const Extension* extension = ExtensionRegistry::Get(browser_context)
+                                   ->enabled_extensions()
+                                   .GetExtensionOrAppByURL(effective_site_url);
+  if (!extension)
+    return true;
+
+  // Hosted apps should be locked to their web origin. See
+  // https://crbug.com/794315.
+  if (extension->is_hosted_app())
+    return true;
+
+  // Other extensions are allowed to share processes, even in
+  // --site-per-process currently. See https://crbug.com/600441#c1 for some
+  // background on the intersection of extension process reuse and site
+  // isolation.
+  //
+  // TODO(nick): Fix this, possibly by revamping the extensions process model
+  // so that sharing is determined by privilege level, as described in
+  // https://crbug.com/766267.
+  return false;
 }
 
 // static

diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 15bf224..085e743 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc

@@ -2793,6 +2793,12 @@
     "either the #upcoming-ui-features flag is Enabled or the #top-chrome-md "
     "flag is set to Refresh or Touchable Refresh.";
 
+const char kOmniboxDriveSuggestionsName[] =
+    "Omnibox Google Drive Document suggestions";
+const char kOmniboxDriveSuggestionsDescriptions[] =
+    "Display suggestions for Google Drive documents in the omnibox when Google "
+    "is the default search engine.";
+
 const char kOmniboxNewAnswerLayoutName[] = "Omnibox new answer layout";
 const char kOmniboxNewAnswerLayoutDescription[] =
     "Display answers using an enhanced layout with larger images. Has no "

diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index a2c89242..58be958 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h

@@ -1685,6 +1685,9 @@
 extern const char kInfiniteSessionRestoreName[];
 extern const char kInfiniteSessionRestoreDescription[];
 
+extern const char kOmniboxDriveSuggestionsName[];
+extern const char kOmniboxDriveSuggestionsDescriptions[];
+
 extern const char kOmniboxRichEntitySuggestionsName[];
 extern const char kOmniboxRichEntitySuggestionsDescription[];
 

diff --git a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
index dd408580..f98b368 100644
--- a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
+++ b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc

@@ -333,14 +333,10 @@
     : download_request_limiter_(g_browser_process->download_request_limiter()),
       safe_browsing_(g_browser_process->safe_browsing_service())
 #if BUILDFLAG(ENABLE_EXTENSIONS)
-      , user_script_listener_(new extensions::UserScriptListener())
+      ,
+      user_script_listener_(new extensions::UserScriptListener())
 #endif
-      {
-  BrowserThread::PostTask(
-      BrowserThread::IO, FROM_HERE,
-      base::BindOnce(
-          content::ServiceWorkerContext::AddExcludedHeadersForFetchEvent,
-          variations::GetVariationHeaderNames()));
+{
 }
 
 ChromeResourceDispatcherHostDelegate::~ChromeResourceDispatcherHostDelegate() {

diff --git a/chrome/browser/net/network_context_configuration_browsertest.cc b/chrome/browser/net/network_context_configuration_browsertest.cc
index 59fb3d6..e831f8df 100644
--- a/chrome/browser/net/network_context_configuration_browsertest.cc
+++ b/chrome/browser/net/network_context_configuration_browsertest.cc

@@ -404,7 +404,9 @@
       ASSERT_TRUE(simple_loader_helper.response_body());
       EXPECT_EQ(*simple_loader_helper.response_body(), "Echo");
     } else {
-      EXPECT_EQ(net::ERR_NAME_NOT_RESOLVED, simple_loader->NetError());
+      // TestHostResolver returns net::ERR_NOT_IMPLEMENTED for non-local host
+      // URLs.
+      EXPECT_EQ(net::ERR_NOT_IMPLEMENTED, simple_loader->NetError());
       ASSERT_FALSE(simple_loader_helper.response_body());
     }
   }

diff --git a/chrome/browser/password_manager/password_accessory_controller.cc b/chrome/browser/password_manager/password_accessory_controller.cc
index 243921b..c4866e05 100644
--- a/chrome/browser/password_manager/password_accessory_controller.cc
+++ b/chrome/browser/password_manager/password_accessory_controller.cc

@@ -173,7 +173,6 @@
     autofill::FillingStatus status) {
   if (status != autofill::FillingStatus::SUCCESS)
     return;                      // TODO(crbug/853766): Record success rate.
-  view_->CloseAccessorySheet();  // The sheet's purpose is fulfilled.
   view_->OpenKeyboard();  // Bring up the keyboard for the still focused field.
 }
 
@@ -181,19 +180,17 @@
     const url::Origin& origin,
     bool is_fillable,
     bool is_password_field) {
-  // When new suggestions are requested, the keyboard will pop open. To avoid
-  // that any open sheet is pushed up, close it now. Doesn't affect the bar.
-  view_->CloseAccessorySheet();
-  // TODO(crbug/853766): Record CTR metric.
   if (is_fillable) {
     current_origin_ = origin;
     view_->OnItemsAvailable(CreateViewItems(origin, origin_suggestions_[origin],
                                             is_password_field));
+    view_->OpenKeyboard();  // Should happen automatically.
   } else {
     // For unfillable fields, reset the origin and send the empty state message.
     current_origin_ = url::Origin();
     view_->OnItemsAvailable(CreateViewItems(
         origin, std::vector<SuggestionElementData>(), is_password_field));
+    view_->CloseAccessorySheet();
   }
 }
 

diff --git a/chrome/browser/password_manager/password_accessory_controller_unittest.cc b/chrome/browser/password_manager/password_accessory_controller_unittest.cc
index 72a0e25a..9f2ffb3 100644
--- a/chrome/browser/password_manager/password_accessory_controller_unittest.cc
+++ b/chrome/browser/password_manager/password_accessory_controller_unittest.cc

@@ -259,6 +259,7 @@
         mock_dialog_factory_.Get(), favicon_service());
     NavigateAndCommit(GURL(kExampleSite));
     EXPECT_CALL(*view(), CloseAccessorySheet()).Times(AnyNumber());
+    EXPECT_CALL(*view(), OpenKeyboard()).Times(AnyNumber());
   }
 
   PasswordAccessoryController* controller() {
@@ -405,11 +406,11 @@
 TEST_F(PasswordAccessoryControllerTest, ClosesViewOnSuccessfullFillingOnly) {
   // If the filling wasn't successful, no call is expected.
   EXPECT_CALL(*view(), CloseAccessorySheet()).Times(0);
+  EXPECT_CALL(*view(), OpenKeyboard()).Times(0);
   controller()->OnFilledIntoFocusedField(FillingStatus::ERROR_NOT_ALLOWED);
   controller()->OnFilledIntoFocusedField(FillingStatus::ERROR_NO_VALID_FIELD);
 
   // If the filling completed successfully, let the view know.
-  EXPECT_CALL(*view(), CloseAccessorySheet());
   EXPECT_CALL(*view(), OpenKeyboard());
   controller()->OnFilledIntoFocusedField(FillingStatus::SUCCESS);
 }

diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index 30d21901..edf7a36 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc

@@ -228,6 +228,7 @@
 #include "chrome/browser/chromeos/first_run/first_run.h"
 #include "chrome/browser/chromeos/lock_screen_apps/state_controller.h"
 #include "chrome/browser/chromeos/login/demo_mode/demo_mode_detector.h"
+#include "chrome/browser/chromeos/login/demo_mode/demo_mode_resources_remover.h"
 #include "chrome/browser/chromeos/login/quick_unlock/fingerprint_storage.h"
 #include "chrome/browser/chromeos/login/quick_unlock/pin_storage_prefs.h"
 #include "chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.h"
@@ -460,6 +461,7 @@
   chromeos::MultiProfileUserController::RegisterPrefs(registry);
   chromeos::HIDDetectionScreenHandler::RegisterPrefs(registry);
   chromeos::DemoModeDetector::RegisterPrefs(registry);
+  chromeos::DemoModeResourcesRemover::RegisterLocalStatePrefs(registry);
   chromeos::NetworkThrottlingObserver::RegisterPrefs(registry);
   chromeos::PowerMetricsReporter::RegisterLocalStatePrefs(registry);
   chromeos::Preferences::RegisterPrefs(registry);

diff --git a/chrome/browser/prefs/pref_service_incognito_whitelist.cc b/chrome/browser/prefs/pref_service_incognito_whitelist.cc
index 6612276..9055213 100644
--- a/chrome/browser/prefs/pref_service_incognito_whitelist.cc
+++ b/chrome/browser/prefs/pref_service_incognito_whitelist.cc

@@ -22,23 +22,16 @@
 #include "components/rappor/rappor_pref_names.h"
 #include "components/reading_list/core/reading_list_pref_names.h"
 #include "components/search_engines/search_engines_pref_names.h"
-#include "components/suggestions/suggestions_pref_names.h"
 #include "components/ukm/ukm_pref_names.h"
 #include "components/variations/pref_names.h"
 #include "components/web_resource/web_resource_pref_names.h"
 
-#if defined(OS_ANDROID)
-#include "components/feed/buildflags.h"
-#include "components/feed/core/pref_names.h"
-#endif  // defined(OS_ANDROID)
-
 #if !defined(OS_ANDROID)
 #include "chrome/browser/accessibility/animation_policy_prefs.h"
 #endif  // !defined(OS_ANDROID)
 
 #if defined(OS_CHROMEOS)
 #include "ash/public/cpp/ash_pref_names.h"
-#include "chromeos/chromeos_pref_names.h"
 #include "ui/base/ime/chromeos/extension_ime_util.h"
 #endif  // defined(OS_CHROMEOS)
 
@@ -434,13 +427,6 @@
     prefs::kSuppressUnsupportedOSWarning, prefs::kWasRestarted,
 #endif  // !defined(OS_ANDROID)
 
-#if defined(OS_ANDROID)
-    prefs::kContentSuggestionsNotificationsEnabled,
-    prefs::kContentSuggestionsConsecutiveIgnoredPrefName,
-    prefs::kContentSuggestionsNotificationsSentDay,
-    prefs::kContentSuggestionsNotificationsSentCount,
-#endif  // defined(OS_ANDROID)
-
     prefs::kDevToolsAdbKey, prefs::kDevToolsAvailability,
     prefs::kDevToolsDiscoverUsbDevicesEnabled, prefs::kDevToolsEditedFiles,
     prefs::kDevToolsFileSystemPaths, prefs::kDevToolsPortForwardingEnabled,
@@ -696,15 +682,6 @@
     prefs::kAutoplayAllowed, prefs::kAutoplayWhitelist,
 #endif
 
-// chromeos/chromeos_pref_names.h
-#if defined(OS_CHROMEOS)
-    chromeos::prefs::kAudioDevicesMute,
-    chromeos::prefs::kAudioDevicesVolumePercent, chromeos::prefs::kAudioMute,
-    chromeos::prefs::kAudioOutputAllowed, chromeos::prefs::kAudioVolumePercent,
-    chromeos::prefs::kAudioDevicesState,
-    chromeos::prefs::kQuirksClientLastServerCheck,
-#endif  // defined(OS_CHROMEOS)
-
     // components/consent_auditor/pref_names.h
     consent_auditor::prefs::kLocalConsentsDictionary,
 
@@ -713,17 +690,6 @@
     dom_distiller::prefs::kFontScale,
     dom_distiller::prefs::kReaderForAccessibility,
 
-// components/feed/core/pref_names.h
-#if defined(OS_ANDROID)
-#if BUILDFLAG(ENABLE_FEED_IN_CHROME)
-    feed::prefs::kBackgroundRefreshPeriod, feed::prefs::kLastFetchAttemptTime,
-    feed::prefs::kUserClassifierAverageNTPOpenedPerHour,
-    feed::prefs::kUserClassifierAverageSuggestionsUsedPerHour,
-    feed::prefs::kUserClassifierLastTimeToOpenNTP,
-    feed::prefs::kUserClassifierLastTimeToUseSuggestions,
-#endif  // BUILDFLAG(ENABLE_FEED_IN_CHROME)
-#endif  // defined(OS_ANDROID)
-
     // components/flags_ui/flags_ui_pref_names.h
     flags_ui::prefs::kEnabledLabsExperiments,
 
@@ -754,10 +720,6 @@
     prefs::kDefaultSearchProviderEnabled, prefs::kSearchProviderOverrides,
     prefs::kSearchProviderOverridesVersion, prefs::kCountryIDAtInstall,
 
-    // components/suggestions/suggestions_pref_names.h
-    suggestions::prefs::kSuggestionsBlacklist,
-    suggestions::prefs::kSuggestionsData,
-
     // components/web_resource/web_resource_pref_names.h
     prefs::kEulaAccepted,
 

diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/profile_impl.cc
index 94eb633..d260d77 100644
--- a/chrome/browser/profiles/profile_impl.cc
+++ b/chrome/browser/profiles/profile_impl.cc

@@ -149,6 +149,7 @@
 #include "chrome/browser/chromeos/device_sync/device_sync_client_factory.h"
 #include "chrome/browser/chromeos/locale_change_guard.h"
 #include "chrome/browser/chromeos/login/session/user_session_manager.h"
+#include "chrome/browser/chromeos/multidevice_setup/android_sms_app_install_delegate_impl.h"
 #include "chrome/browser/chromeos/multidevice_setup/auth_token_validator_factory.h"
 #include "chrome/browser/chromeos/multidevice_setup/auth_token_validator_impl.h"
 #include "chrome/browser/chromeos/net/delay_network_call.h"
@@ -1528,7 +1529,9 @@
       chromeos::secure_channel::SecureChannelClientProvider::GetInstance()
           ->GetClient(),
       chromeos::multidevice_setup::AuthTokenValidatorFactory::GetForProfile(
-          this));
+          this),
+      std::make_unique<
+          chromeos::multidevice_setup::AndroidSmsAppInstallDelegateImpl>(this));
 }
 
 #endif  // defined(OS_CHROMEOS)

diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js
index 7ecff29b..1e5750cc4 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js

@@ -468,9 +468,7 @@
     },
     listMarker: {speak: `$name`},
     menu: {
-      enter:
-          `$name $role
-          @@list_with_items($countChildren(menuItem, menuItemCheckBox, menuItemRadio))`,
+      enter: `$name $role `,
       speak: `$name $node(activeDescendant)
           $role @@list_with_items(
               $countChildren(menuItem, menuItemCheckBox, menuItemRadio))
@@ -478,20 +476,23 @@
     },
     menuItem: {
       speak: `$name $role $if($haspopup, @has_submenu)
-          @describe_index($posInSet, $setSize)
+          @describe_index($if($posInSet, $posInSet, $indexInParent(menuItem, menuItemCheckBox, menuItemRadio)),
+              $if($setSize, $setSize, $parentChildCount(menuItem, menuItemCheckBox, menuItemRadio)))
           $description $state $restriction`
     },
     menuItemCheckBox: {
       speak: `$if($checked, $earcon(CHECK_ON), $earcon(CHECK_OFF))
           $name $role $checked $state $restriction $description
-          @describe_index($posInSet, $setSize)`
+          @describe_index($if($posInSet, $posInSet, $indexInParent(menuItem, menuItemCheckBox, menuItemRadio)),
+              $if($setSize, $setSize, $parentChildCount(menuItem, menuItemCheckBox, menuItemRadio))) `
     },
     menuItemRadio: {
       speak: `$if($checked, $earcon(CHECK_ON), $earcon(CHECK_OFF))
           $if($checked, @describe_radio_selected($name),
           @describe_radio_unselected($name)) $state $roleDescription
-          $restriction
-          $description @describe_index($posInSet, $setSize) `
+          $restriction $description
+          @describe_index($if($posInSet, $posInSet, $indexInParent(menuItem, menuItemCheckBox, menuItemRadio)),
+              $if($setSize, $setSize, $parentChildCount(menuItem, menuItemCheckBox, menuItemRadio))) `
     },
     menuListOption: {
       speak: `$name $role @describe_index($posInSet, $setSize) $state
@@ -1221,9 +1222,17 @@
         } else if (token == 'indexInParent') {
           if (node.parent) {
             options.annotation.push(token);
+            var roles;
+            if (tree.firstChild) {
+              roles = this.createRoles_(tree);
+            } else {
+              roles = new Set();
+              roles.add(node.role);
+            }
+
             var count = 0;
             for (var i = 0, child; child = node.parent.children[i]; i++) {
-              if (node.role == child.role)
+              if (roles.has(child.role))
                 count++;
               if (node === child)
                 break;
@@ -1233,9 +1242,17 @@
         } else if (token == 'parentChildCount') {
           if (node.parent) {
             options.annotation.push(token);
+            var roles;
+            if (tree.firstChild) {
+              roles = this.createRoles_(tree);
+            } else {
+              roles = new Set();
+              roles.add(node.role);
+            }
+
             var count = node.parent.children
                             .filter(function(child) {
-                              return node.role == child.role;
+                              return roles.has(child.role);
                             })
                             .length;
             this.append_(buff, String(count));
@@ -1480,14 +1497,11 @@
                 tree.firstChild.value, node.location || undefined));
             this.append_(buff, '', options);
           } else if (token == 'countChildren') {
-            var roles = [];
-            var currentNode = tree.firstChild;
-            for (; currentNode; currentNode = currentNode.nextSibling)
-              roles.push(currentNode.value);
+            var roles = this.createRoles_(tree);
 
             var count = node.children
                             .filter(function(e) {
-                              return roles.includes(e.role);
+                              return roles.has(e.role);
                             })
                             .length;
             this.append_(buff, String(count));
@@ -1589,6 +1603,19 @@
   },
 
   /**
+   * @param {Object} tree
+   * @return {!Set}
+   * @private
+   */
+  createRoles_: function(tree) {
+    var roles = new Set();
+    var currentNode = tree.firstChild;
+    for (; currentNode; currentNode = currentNode.nextSibling)
+      roles.add(currentNode.value);
+    return roles;
+  },
+
+  /**
    * @param {!cursors.Range} range
    * @param {cursors.Range} prevRange
    * @param {EventType|Output.EventType} type

diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
index 17662432..079d7af2 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs

@@ -476,13 +476,13 @@
     var el = root.firstChild.firstChild;
     var range = cursors.Range.fromNode(el);
     var o = new Output().withSpeechAndBraille(range, null, 'navigate');
-    checkSpeechOutput('a|Menu item| 1 of 1 |Menu|with 3 items', [
+    checkSpeechOutput('a|Menu item| 1 of 3 |Menu', [
       {value: 'name', start: 0, end: 1},
       {value: 'role', start: 21, end: 25}], o);
     checkBrailleOutput(
-        'a mnuitm 1/1 mnu +3',
+        'a mnuitm 1/3 mnu',
         [{value: new Output.NodeSpan(el), start: 0, end: 12},
-         {value: new Output.NodeSpan(el.parent), start: 13, end: 19}],
+         {value: new Output.NodeSpan(el.parent), start: 13, end: 16}],
         o);
   });
 });

diff --git a/chrome/browser/resources/print_preview/new/color_settings.html b/chrome/browser/resources/print_preview/new/color_settings.html
index 242cf8789..93f1453 100644
--- a/chrome/browser/resources/print_preview/new/color_settings.html
+++ b/chrome/browser/resources/print_preview/new/color_settings.html

@@ -12,7 +12,8 @@
     <print-preview-settings-section>
       <span id="color-label" slot="title">$i18n{optionColor}</span>
       <div slot="controls">
-        <select aria-labelledby="color-label" disabled$="[[disabled]]">
+        <select aria-labelledby="color-label" disabled$="[[disabled]]"
+            value="{{selectedValue::change}}">
           <option value="bw" selected>$i18n{optionBw}</option>
           <option value="color">$i18n{optionColor}</option>
         </select>

diff --git a/chrome/browser/resources/print_preview/new/color_settings.js b/chrome/browser/resources/print_preview/new/color_settings.js
index 40e2e6b..c64f1f2 100644
--- a/chrome/browser/resources/print_preview/new/color_settings.js
+++ b/chrome/browser/resources/print_preview/new/color_settings.js

@@ -14,11 +14,11 @@
   observers: ['onColorSettingChange_(settings.color.value)'],
 
   /**
-   * @param {*} value The new value of the color setting.
+   * @param {*} newValue The new value of the color setting.
    * @private
    */
-  onColorSettingChange_: function(value) {
-    this.$$('select').value = /** @type {boolean} */ (value) ? 'color' : 'bw';
+  onColorSettingChange_: function(newValue) {
+    this.selectedValue = /** @type {boolean} */ (newValue) ? 'color' : 'bw';
   },
 
   /** @param {string} value The new select value. */

diff --git a/chrome/browser/resources/print_preview/new/layout_settings.html b/chrome/browser/resources/print_preview/new/layout_settings.html
index dc7b971..0c43014 100644
--- a/chrome/browser/resources/print_preview/new/layout_settings.html
+++ b/chrome/browser/resources/print_preview/new/layout_settings.html

@@ -12,7 +12,8 @@
     <print-preview-settings-section>
       <span id="layout-label" slot="title">$i18n{layoutLabel}</span>
       <div slot="controls">
-        <select aria-labelledby="layout-label" disabled$="[[disabled]]">
+        <select aria-labelledby="layout-label" disabled$="[[disabled]]"
+            value="{{selectedValue::change}}">
           <option value="portrait" selected>$i18n{optionPortrait}</option>
           <option value="landscape">$i18n{optionLandscape}</option>
         </select>

diff --git a/chrome/browser/resources/print_preview/new/layout_settings.js b/chrome/browser/resources/print_preview/new/layout_settings.js
index c5cb3e5f..7569400 100644
--- a/chrome/browser/resources/print_preview/new/layout_settings.js
+++ b/chrome/browser/resources/print_preview/new/layout_settings.js

@@ -14,12 +14,12 @@
   observers: ['onLayoutSettingChange_(settings.layout.value)'],
 
   /**
-   * @param {*} value The new value of the layout setting.
+   * @param {*} newValue The new value of the layout setting.
    * @private
    */
-  onLayoutSettingChange_: function(value) {
-    this.$$('select').value =
-        /** @type {boolean} */ (value) ? 'landscape' : 'portrait';
+  onLayoutSettingChange_: function(newValue) {
+    this.selectedValue =
+        /** @type {boolean} */ (newValue) ? 'landscape' : 'portrait';
   },
 
   /** @param {string} value The new select value. */

diff --git a/chrome/browser/resources/print_preview/new/margins_settings.html b/chrome/browser/resources/print_preview/new/margins_settings.html
index 87121b4..8c2ebcd 100644
--- a/chrome/browser/resources/print_preview/new/margins_settings.html
+++ b/chrome/browser/resources/print_preview/new/margins_settings.html

@@ -13,7 +13,8 @@
     <print-preview-settings-section>
       <span id="margins-label" slot="title">$i18n{marginsLabel}</span>
       <div slot="controls">
-        <select aria-labelledby="margins-label" disabled$="[[disabled]]">
+        <select aria-labelledby="margins-label" disabled$="[[disabled]]"
+            value="{{selectedValue::change}}">
           <!-- The order of these options must match the natural order of their
           values, which come from
           print_preview.ticket_items.MarginsTypeValue. -->

diff --git a/chrome/browser/resources/print_preview/new/margins_settings.js b/chrome/browser/resources/print_preview/new/margins_settings.js
index 9145663..6873f628 100644
--- a/chrome/browser/resources/print_preview/new/margins_settings.js
+++ b/chrome/browser/resources/print_preview/new/margins_settings.js

@@ -14,11 +14,13 @@
   observers: ['onMarginsSettingChange_(settings.margins.value)'],
 
   /**
-   * @param {*} value The new value of the margins setting.
+   * @param {*} newValue The new value of the margins setting.
    * @private
    */
-  onMarginsSettingChange_: function(value) {
-    this.$$('select').value = /** @type {string} */ (value).toString();
+  onMarginsSettingChange_: function(newValue) {
+    this.selectedValue =
+        /** @type {!print_preview.ticket_items.MarginsTypeValue} */ (newValue)
+            .toString();
   },
 
   /** @param {string} value The new select value. */

diff --git a/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.html b/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.html
index 09a4a68..526a2d11 100644
--- a/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.html
+++ b/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.html

@@ -15,7 +15,7 @@
       </span>
       <div slot="controls">
         <select aria-labelledby="pages-per-sheet-label"
-            disabled$="[[disabled]]">
+            value="{{selectedValue::change}}" disabled$="[[disabled]]">
           <option value="1" selected>1</option>
           <option value="2">2</option>
           <option value="4">4</option>

diff --git a/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.js b/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.js
index 0b23bbc..0e9701e8 100644
--- a/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.js
+++ b/chrome/browser/resources/print_preview/new/pages_per_sheet_settings.js

@@ -14,11 +14,11 @@
   observers: ['onPagesPerSheetSettingChange_(settings.pagesPerSheet.value)'],
 
   /**
-   * @param {*} value The new value of the pages per sheet setting.
+   * @param {*} newValue The new value of the pages per sheet setting.
    * @private
    */
-  onPagesPerSheetSettingChange_: function(value) {
-    this.$$('select').value = /** @type {number} */ (value).toString();
+  onPagesPerSheetSettingChange_: function(newValue) {
+    this.selectedValue = /** @type {number} */ (newValue).toString();
   },
 
   /** @param {string} value The new select value. */

diff --git a/chrome/browser/resources/print_preview/new/select_behavior.js b/chrome/browser/resources/print_preview/new/select_behavior.js
index a248f6c9..e76f128b 100644
--- a/chrome/browser/resources/print_preview/new/select_behavior.js
+++ b/chrome/browser/resources/print_preview/new/select_behavior.js

@@ -12,24 +12,29 @@
    * @polymerBehavior
    */
   const SelectBehavior = {
-    /** @private {string} */
-    lastValue_: '',
+    properties: {
+      selectedValue: {
+        type: String,
+        observer: 'onSelectedValueChange_',
+      },
+    },
 
     /**
-     * Timeout used to delay processing of the selection.
-     * @private {?number}
+     * @param {string} current
+     * @param {?string} previous
+     * @private
      */
-    timeout_: null,
+    onSelectedValueChange_: function(current, previous) {
+      // Don't trigger an extra preview request at startup.
+      if (previous === undefined)
+        return;
 
-    /** @override */
-    ready: function() {
-      assert(this.shadowRoot.querySelectorAll('select').length == 1);
-      this.$$('select').addEventListener('change', () => {
-        if (this.timeout_) {
-          clearTimeout(this.timeout_);
-        }
-        this.timeout_ = setTimeout(this.onTimeout_.bind(this), 100);
-      });
+      this.debounce('select-change', () => {
+        this.onProcessSelectChange(this.selectedValue);
+
+        // For testing only
+        this.fire('process-select-change');
+      }, 100);
     },
 
     /**
@@ -38,22 +43,6 @@
      * @param {string} value The new select value to process.
      */
     onProcessSelectChange: function(value) {},
-
-    /**
-     * Called after a timeout after user selects a new option.
-     * @private
-     */
-    onTimeout_: function() {
-      this.timeout_ = null;
-      const value = /** @type {!HTMLSelectElement} */ (this.$$('select')).value;
-      if (this.lastValue_ != value) {
-        this.lastValue_ = value;
-        this.onProcessSelectChange(value);
-
-        // For testing only
-        this.fire('process-select-change');
-      }
-    },
   };
 
   return {SelectBehavior: SelectBehavior};

diff --git a/chrome/browser/resources/print_preview/new/settings_select.html b/chrome/browser/resources/print_preview/new/settings_select.html
index 45eb62fb..e2b7ea9 100644
--- a/chrome/browser/resources/print_preview/new/settings_select.html
+++ b/chrome/browser/resources/print_preview/new/settings_select.html

@@ -10,9 +10,9 @@
   <template>
     <style include="print-preview-shared select">
     </style>
-    <select disabled$="[[disabled]]">
+    <select disabled$="[[disabled]]" value="{{selectedValue::change}}">
       <template is="dom-repeat" items="[[capability.option]]">
-        <option selected="[[isSelected_(item, selectedValue_)]]"
+        <option selected="[[isSelected_(item, selectedValue)]]"
             value="[[getValue_(item)]]">
           [[getDisplayName_(item)]]
         </option>

diff --git a/chrome/browser/resources/print_preview/new/settings_select.js b/chrome/browser/resources/print_preview/new/settings_select.js
index c855e07..16e29d0b0 100644
--- a/chrome/browser/resources/print_preview/new/settings_select.js
+++ b/chrome/browser/resources/print_preview/new/settings_select.js

@@ -26,13 +26,6 @@
     settingName: String,
 
     disabled: Boolean,
-
-    /** @private {string} */
-    selectedValue_: {
-      type: String,
-      notify: true,
-      value: '',
-    },
   },
 
   /**
@@ -41,13 +34,13 @@
    * @private
    */
   isSelected_: function(option) {
-    return this.getValue_(option) == this.selectedValue_ ||
-        (!!option.is_default && this.selectedValue_ == '');
+    return this.getValue_(option) == this.selectedValue ||
+        (!!option.is_default && this.selectedValue == '');
   },
 
   /** @param {string} value The value to select. */
   selectValue: function(value) {
-    this.selectedValue_ = value;
+    this.selectedValue = value;
   },
 
   /**

diff --git a/chrome/browser/resources/settings/people_page/BUILD.gn b/chrome/browser/resources/settings/people_page/BUILD.gn
index 6426f36..c7084991 100644
--- a/chrome/browser/resources/settings/people_page/BUILD.gn
+++ b/chrome/browser/resources/settings/people_page/BUILD.gn

@@ -14,7 +14,6 @@
     ":easy_unlock_turn_off_dialog",
     ":fingerprint_browser_proxy",
     ":fingerprint_list",
-    ":fingerprint_progress_arc",
     ":import_data_browser_proxy",
     ":import_data_dialog",
     ":lock_screen",
@@ -110,12 +109,6 @@
   externs_list = [ "$externs_path/web_animations.js" ]
 }
 
-js_library("fingerprint_progress_arc") {
-  deps = [
-    "//ui/webui/resources/js:cr",
-  ]
-}
-
 js_library("import_data_browser_proxy") {
   deps = [
     "//ui/webui/resources/js:cr",
@@ -216,7 +209,7 @@
 js_library("setup_fingerprint_dialog") {
   deps = [
     ":fingerprint_browser_proxy",
-    ":fingerprint_progress_arc",
+    "//ui/webui/resources/cr_elements/chromeos/fingerprint:cr_fingerprint_progress_arc",
     "//ui/webui/resources/js:i18n_behavior",
     "//ui/webui/resources/js:web_ui_listener_behavior",
   ]

diff --git a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.html b/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.html
deleted file mode 100644
index cb18a85..0000000
--- a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.html
+++ /dev/null

@@ -1,23 +0,0 @@
-<link rel="import" href="chrome://resources/html/polymer.html">
-
-<dom-module id="settings-fingerprint-progress-arc">
-  <template>
-    <style>
-      #canvas {
-        height: 100%;
-        vertical-align: bottom;
-        width: 100%;
-      }
-
-      #canvasDiv {
-        height: var(--canvas-height);
-        width: var(--canvas-width);
-      }
-    </style>
-
-    <div id="canvasDiv">
-      <canvas id="canvas"></canvas>
-    </div>
-  </template>
-  <script src="fingerprint_progress_arc.js"></script>
-</dom-module>

diff --git a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.js b/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.js
deleted file mode 100644
index 2b3c38c..0000000
--- a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.js
+++ /dev/null

@@ -1,171 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-(function() {
-
-/**
- * The time in milliseconds of the animation updates.
- * @type {number}
- */
-const ANIMATE_TICKS_MS = 20;
-
-/**
- * The duration in milliseconds of the animation of the progress circle when the
- * user is touching the scanner.
- * @type {number}
- */
-const ANIMATE_DURATION_MS = 200;
-
-/**
- * The radius of the add fingerprint progress circle.
- * @type {number}
- */
-const CANVAS_CIRCLE_RADIUS = 50;
-
-/**
- * The thickness of the add fingerprint progress circle.
- * @type {number}
- */
-const CANVAS_CIRCLE_STROKE_WIDTH = 4;
-
-/**
- * The color of the canvas circle background.
- * @type {string}
- */
-const CANVAS_CIRCLE_BACKGROUND_COLOR = 'rgba(66, 66, 66, 1.0)';
-
-/**
- * The color of the arc/circle which indicates setup progress.
- * @type {string}
- */
-const CANVAS_CIRCLE_PROGRESS_COLOR = 'rgba(53, 103, 214, 1.0)';
-
-/**
- * The color of the canvas circle shadow.
- * @type {string}
- */
-const CANVAS_CIRCLE_SHADOW_COLOR = 'rgba(0, 0, 0, 0.5)';
-
-Polymer({
-  is: 'settings-fingerprint-progress-arc',
-
-  // Also put these values as member values so they can be overriden by tests
-  // and the tests do not need to be changed every time the UI is.
-  /** @private {number} */
-  canvasCircleRadius_: CANVAS_CIRCLE_RADIUS,
-  /** @private {number} */
-  canvasCircleStrokeWidth_: CANVAS_CIRCLE_STROKE_WIDTH,
-  /** @private {string} */
-  canvasCircleBackgroundColor_: CANVAS_CIRCLE_BACKGROUND_COLOR,
-  /** @private {string} */
-  canvasCircleProgressColor_: CANVAS_CIRCLE_PROGRESS_COLOR,
-  /** @private {string} */
-  canvasCircleShadowColor_: CANVAS_CIRCLE_SHADOW_COLOR,
-
-  /**
-   * Draws an arc on the canvas element around the center with radius
-   * |CANVAS_CIRCLE_RADIUS|.
-   * @param {number} startAngle The start angle of the arc we want to draw.
-   * @param {number} endAngle The end angle of the arc we want to draw.
-   * @param {string} color The color of the arc we want to draw. The string is
-   *     in the format rgba(r',g',b',a'). r', g', b' are values from [0-255]
-   *     and a' is a value from [0-1].
-   */
-  drawArc: function(startAngle, endAngle, color) {
-    const c = this.$.canvas;
-    const ctx = c.getContext('2d');
-
-    ctx.beginPath();
-    ctx.arc(
-        c.width / 2, c.height / 2, this.canvasCircleRadius_, startAngle,
-        endAngle);
-    ctx.lineWidth = this.canvasCircleStrokeWidth_;
-    ctx.strokeStyle = color;
-    ctx.stroke();
-  },
-
-  /**
-   * Draws a circle on the canvas element around the center with radius
-   * |CANVAS_CIRCLE_RADIUS| and color |CANVAS_CIRCLE_BACKGROUND_COLOR|.
-   */
-  drawBackgroundCircle: function() {
-    this.drawArc(0, 2 * Math.PI, this.canvasCircleBackgroundColor_);
-  },
-
-  /**
-   * Draws a circular shadow around the center with radius
-   * |CANVAS_CIRCLE_RADIUS|.
-   * @param {number} blur
-   * @param {number} offsetX
-   * @param {number} offsetY
-   */
-  drawShadow: function(blur, offsetX, offsetY) {
-    const c = this.$.canvas;
-    const ctx = c.getContext('2d');
-
-    ctx.beginPath();
-    ctx.translate(-c.width, 0);
-    ctx.shadowOffsetX = c.width + offsetX;
-    ctx.shadowOffsetY = 0;
-    ctx.shadowColor = this.canvasCircleShadowColor_;
-    ctx.shadowBlur = blur;
-    ctx.arc(
-        c.width / 2, c.height / 2,
-        this.canvasCircleRadius_ - this.canvasCircleStrokeWidth_ / 2 + blur / 2,
-        0, 2 * Math.PI);
-    ctx.stroke();
-    ctx.translate(c.width, 0);
-  },
-
-  /**
-   * Animates the progress the circle. Animates an arc that starts at the top of
-   * the circle to startAngle, to an arc that starts at the top of the circle to
-   * endAngle.
-   * @param {number} startAngle The start angle of the arc we want to draw.
-   * @param {number} endAngle The end angle of the arc we want to draw.
-   */
-  animateProgress: function(startAngle, endAngle) {
-    let currentAngle = startAngle;
-    // The value to update the angle by each tick.
-    const step =
-        (endAngle - startAngle) / (ANIMATE_DURATION_MS / ANIMATE_TICKS_MS);
-    const id = setInterval(doAnimate.bind(this), ANIMATE_TICKS_MS);
-    // Circles on html canvas have 0 radians on the positive x-axis and go in
-    // clockwise direction. We want to start at the top of the circle which is
-    // 3pi/2.
-    const start = 3 * Math.PI / 2;
-
-    // Function that is called every tick of the interval, draws the arc a bit
-    // closer to the final destination each tick, until it reaches the final
-    // destination.
-    function doAnimate() {
-      if (currentAngle >= endAngle)
-        clearInterval(id);
-
-      // Clears the canvas and draws the new progress circle.
-      this.clearCanvas();
-      // Drawing two arcs to form a circle gives a nicer look than drawing an
-      // arc on top of a circle. If |currentAngle| is 0, draw from |start| +
-      // |currentAngle| to 7 * Math.PI / 2 (start is 3 * Math.PI / 2) otherwise
-      // the regular draw from |start| to |currentAngle| will draw nothing which
-      // will cause a flicker for one frame.
-      this.drawArc(
-          start, start + currentAngle, this.canvasCircleProgressColor_);
-      this.drawArc(
-          start + currentAngle, currentAngle <= 0 ? 7 * Math.PI / 2 : start,
-          this.canvasCircleBackgroundColor_);
-      currentAngle += step;
-    }
-  },
-
-  /**
-   * Clear the canvas of any renderings.
-   */
-  clearCanvas: function() {
-    const c = this.$.canvas;
-    const ctx = c.getContext('2d');
-    ctx.clearRect(0, 0, c.width, c.height);
-  },
-});
-})();

diff --git a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html
index 87adadc..2d3e0fb 100644
--- a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html
+++ b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html

@@ -1,5 +1,6 @@
 <link rel="import" href="chrome://resources/html/polymer.html">
 
+<link rel="import" href="chrome://resources/cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.html">
 <link rel="import" href="chrome://resources/cr_elements/cr_dialog/cr_dialog.html">
 <link rel="import" href="chrome://resources/cr_elements/icons.html">
 <link rel="import" href="chrome://resources/html/i18n_behavior.html">
@@ -10,16 +11,10 @@
 <link rel="import" href="../icons.html">
 <link rel="import" href="../settings_shared_css.html">
 <link rel="import" href="fingerprint_browser_proxy.html">
-<link rel="import" href="fingerprint_progress_arc.html">
 
 <dom-module id="settings-setup-fingerprint-dialog">
   <template>
     <style include="settings-shared">
-      #arc {
-        --canvas-height: 200px;
-        --canvas-width: 450px;
-      }
-
       #dialog {
         --cr-dialog-native: {
           min-width: 500px;
@@ -27,27 +22,6 @@
         };
       }
 
-      #image {
-        height: 80px;
-        left: 185px;
-        min-height: 80px;
-        min-width: 80px;
-        position: relative;
-        top: -140px;
-        width: 80px;
-      }
-
-      #image[step='3'] {
-        --iron-icon-fill-color: var(--google-blue-700);
-      }
-
-      /* Put the image in a separate div with 0 height, otherwise the div will
-         take the height of the image, leaving us with a row of whitespace when
-         we position the #image to be inside #arc. */
-      #imageDiv {
-        height: 0;
-      }
-
       /* Use this instead of hidden so that the dialog does not resize when the
          problem appears or disappears. */
       #problemDiv[invisible] {
@@ -62,12 +36,8 @@
         <div class="settings-box first">
           <span class="middle">[[getInstructionMessage_(step_)]]</span>
         </div>
-        <settings-fingerprint-progress-arc id="arc">
-        </settings-fingerprint-progress-arc>
-        <div id="imageDiv">
-          <iron-icon id="image" icon="settings:fingerprint" step$="[[step_]]">
-          </iron-icon>
-        </div>
+        <cr-fingerprint-progress-arc id="arc" circle-radius="100">
+        </cr-fingerprint-progress-arc>
         <div id="problemDiv" class="settings-box first"
             invisible$="[[!problemMessage_]]">
           <iron-icon icon="cr:warning"></iron-icon>

diff --git a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js
index 2332428..f23b4759 100644
--- a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js
+++ b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js

@@ -17,13 +17,6 @@
 (function() {
 
 /**
- * The duration in ms of a fingerprint icon flash when a user touches the
- * fingerprint sensor during an enroll session.
- * @type {number}
- */
-const FLASH_DURATION_MS = 300;
-
-/**
  * The amount of milliseconds after a successful but not completed scan before a
  * message shows up telling the user to scan their finger again.
  * @type {number}
@@ -79,9 +72,7 @@
         'on-fingerprint-scan-received', this.onScanReceived_.bind(this));
     this.browserProxy_ = settings.FingerprintBrowserProxyImpl.getInstance();
 
-    this.$.arc.clearCanvas();
-    this.$.arc.drawBackgroundCircle();
-    this.$.arc.drawShadow(10, 0, 0);
+    this.$.arc.reset();
     this.browserProxy_.startEnroll();
     this.$.dialog.showModal();
   },
@@ -119,7 +110,7 @@
   reset_: function() {
     this.step_ = settings.FingerprintSetupStep.LOCATE_SCANNER;
     this.percentComplete_ = 0;
-    this.$.arc.clearCanvas();
+    this.$.arc.reset();
     this.clearSensorMessageTimeout_();
   },
 
@@ -143,35 +134,25 @@
       case settings.FingerprintSetupStep.LOCATE_SCANNER:
       case settings.FingerprintSetupStep.MOVE_FINGER:
         if (this.step_ == settings.FingerprintSetupStep.LOCATE_SCANNER) {
-          // Clear canvas because there will be shadows present at this step.
-          this.$.arc.clearCanvas();
-          this.$.arc.drawBackgroundCircle();
-
+          this.$.arc.reset();
           this.step_ = settings.FingerprintSetupStep.MOVE_FINGER;
           this.percentComplete_ = 0;
         }
-        const slice = 2 * Math.PI / 100;
         if (scan.isComplete) {
           this.problemMessage_ = '';
           this.step_ = settings.FingerprintSetupStep.READY;
-          this.$.arc.animateProgress(
-              this.percentComplete_ * slice, 2 * Math.PI);
+          this.$.arc.setProgress(
+              this.percentComplete_, 100 /*currPercentComplete*/,
+              true /*isComplete*/);
           this.clearSensorMessageTimeout_();
         } else {
           this.setProblem_(scan.result);
           if (scan.result == settings.FingerprintResultType.SUCCESS) {
             this.problemMessage_ = '';
-            // Flash the fingerprint icon blue so that users get some feedback
-            // when a successful scan has been registered.
-            this.$.image.animate(
-                {
-                  fill: ['var(--google-blue-700)', 'var(--google-grey-500)'],
-                  opacity: [0.7, 1.0],
-                },
-                FLASH_DURATION_MS);
             if (scan.percentComplete > this.percentComplete_) {
-              this.$.arc.animateProgress(
-                  this.percentComplete_ * slice, scan.percentComplete * slice);
+              this.$.arc.setProgress(
+                  this.percentComplete_, scan.percentComplete,
+                  false /*isComplete*/);
               this.percentComplete_ = scan.percentComplete;
             }
           }
@@ -285,8 +266,7 @@
   onAddAnotherFingerprint_: function() {
     this.fire('add-fingerprint');
     this.reset_();
-    this.$.arc.drawBackgroundCircle();
-    this.$.arc.drawShadow(10, 0, 0);
+    this.$.arc.reset();
     this.browserProxy_.startEnroll();
   },
 });

diff --git a/chrome/browser/resources/settings/settings_resources.grd b/chrome/browser/resources/settings/settings_resources.grd
index e569323..626bba0 100644
--- a/chrome/browser/resources/settings/settings_resources.grd
+++ b/chrome/browser/resources/settings/settings_resources.grd

@@ -1492,12 +1492,6 @@
         <structure name="IDR_SETTINGS_PEOPLE_SETUP_FINGERPRINT_DIALOG_HTML"
                    file="people_page/setup_fingerprint_dialog.html"
                    type="chrome_html" />
-        <structure name="IDR_SETTINGS_PEOPLE_FINGERPRINT_PROGRESS_ARC_JS"
-                   file="people_page/fingerprint_progress_arc.js"
-                   type="chrome_html" />
-        <structure name="IDR_SETTINGS_PEOPLE_FINGERPRINT_PROGRESS_ARC_HTML"
-                   file="people_page/fingerprint_progress_arc.html"
-                   type="chrome_html" />
         <structure name="IDR_SETTINGS_PEOPLE_FINGERPRINT_BROWSER_PROXY_JS"
                    file="people_page/fingerprint_browser_proxy.js"
                    type="chrome_html" />

diff --git a/chrome/browser/signin/account_consistency_mode_manager.cc b/chrome/browser/signin/account_consistency_mode_manager.cc
index 5755bf8..8782bc7 100644
--- a/chrome/browser/signin/account_consistency_mode_manager.cc
+++ b/chrome/browser/signin/account_consistency_mode_manager.cc

@@ -20,10 +20,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/google_api_keys.h"
 
-#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX)
-#include "ui/base/ui_base_features.h"
-#endif
-
 #if defined(OS_CHROMEOS)
 #include "components/signin/core/browser/signin_pref_names.h"
 #endif
@@ -255,13 +251,7 @@
 #endif
 
 #if BUILDFLAG(ENABLE_DICE_SUPPORT)
-  AccountConsistencyMethod method =
-      AccountConsistencyMethod::kDicePrepareMigration;
-
-#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX)
-  if (base::FeatureList::IsEnabled(features::kExperimentalUi))
-    method = AccountConsistencyMethod::kDiceMigration;
-#endif
+  AccountConsistencyMethod method = AccountConsistencyMethod::kDiceMigration;
 
   if (method_value == kAccountConsistencyFeatureMethodDiceFixAuthErrors)
     method = AccountConsistencyMethod::kDiceFixAuthErrors;

diff --git a/chrome/browser/signin/account_consistency_mode_manager_unittest.cc b/chrome/browser/signin/account_consistency_mode_manager_unittest.cc
index 3edfdd39..1075d684 100644
--- a/chrome/browser/signin/account_consistency_mode_manager_unittest.cc
+++ b/chrome/browser/signin/account_consistency_mode_manager_unittest.cc

@@ -36,7 +36,7 @@
   EXPECT_EQ(signin::AccountConsistencyMethod::kMirror,
             AccountConsistencyModeManager::GetMethodForProfile(&profile));
 #elif BUILDFLAG(ENABLE_DICE_SUPPORT)
-  EXPECT_EQ(signin::AccountConsistencyMethod::kDicePrepareMigration,
+  EXPECT_EQ(signin::AccountConsistencyMethod::kDiceMigration,
             AccountConsistencyModeManager::GetMethodForProfile(&profile));
 #else
   EXPECT_EQ(signin::AccountConsistencyMethod::kDisabled,

diff --git a/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc b/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc
index 48ec26ef..c366f31b 100644
--- a/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc
+++ b/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc

@@ -22,6 +22,7 @@
 #include "base/time/default_clock.h"
 #include "base/time/time.h"
 #include "base/values.h"
+#include "build/build_config.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
@@ -51,6 +52,16 @@
 constexpr char kRecurrentInterstitialModeInMemory[] = "in-memory";
 constexpr char kRecurrentInterstitialModePref[] = "pref";
 
+#if defined(OS_ANDROID)
+const base::FeatureParam<std::string> kRecurrentInterstitialMode{
+    &kRecurrentInterstitialFeature, kRecurrentInterstitialModeParam,
+    kRecurrentInterstitialModePref};
+#else
+const base::FeatureParam<std::string> kRecurrentInterstitialMode{
+    &kRecurrentInterstitialFeature, kRecurrentInterstitialModeParam,
+    kRecurrentInterstitialModeInMemory};
+#endif
+
 // The number of times an error must recur before the recurrent error message is
 // shown.
 constexpr char kRecurrentInterstitialThresholdParam[] = "threshold";
@@ -244,7 +255,7 @@
 }  // namespace
 
 const base::Feature kRecurrentInterstitialFeature{
-    "RecurrentInterstitialFeature", base::FEATURE_DISABLED_BY_DEFAULT};
+    "RecurrentInterstitialFeature", base::FEATURE_ENABLED_BY_DEFAULT};
 
 ChromeSSLHostStateDelegate::ChromeSSLHostStateDelegate(Profile* profile)
     : clock_(new base::DefaultClock()),
@@ -469,8 +480,7 @@
     return;
   }
 
-  const std::string mode_param = base::GetFieldTrialParamValueByFeature(
-      kRecurrentInterstitialFeature, kRecurrentInterstitialModeParam);
+  const std::string mode_param = kRecurrentInterstitialMode.Get();
   const int threshold = base::GetFieldTrialParamByFeatureAsInt(
       kRecurrentInterstitialFeature, kRecurrentInterstitialThresholdParam,
       kRecurrentInterstitialDefaultThreshold);
@@ -495,8 +505,7 @@
     return false;
   }
 
-  const std::string mode_param = base::GetFieldTrialParamValueByFeature(
-      kRecurrentInterstitialFeature, kRecurrentInterstitialModeParam);
+  const std::string mode_param = kRecurrentInterstitialMode.Get();
   const int threshold = base::GetFieldTrialParamByFeatureAsInt(
       kRecurrentInterstitialFeature, kRecurrentInterstitialThresholdParam,
       kRecurrentInterstitialDefaultThreshold);

diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index 801a20b..8f44d467 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn

@@ -1865,6 +1865,8 @@
       "ash/tablet_mode_client.cc",
       "ash/tablet_mode_client.h",
       "ash/tablet_mode_client_observer.h",
+      "ash/test_ime_controller.cc",
+      "ash/test_ime_controller.h",
       "ash/volume_controller.cc",
       "ash/volume_controller.h",
       "ash/vpn_list_forwarder.cc",
@@ -3609,6 +3611,10 @@
       "app_list/search/search_provider.h",
       "app_list/search/search_resource_manager.cc",
       "app_list/search/search_resource_manager.h",
+      "app_list/search/search_result_ranker/app_launch_predictor.cc",
+      "app_list/search/search_result_ranker/app_launch_predictor.h",
+      "app_list/search/search_result_ranker/app_search_result_ranker.cc",
+      "app_list/search/search_result_ranker/app_search_result_ranker.h",
       "app_list/search/search_util.cc",
       "app_list/search/search_util.h",
       "app_list/search/search_webstore_result.cc",

diff --git a/chrome/browser/ui/app_list/app_list_client_impl.cc b/chrome/browser/ui/app_list/app_list_client_impl.cc
index 5ec5ce7..d3bebcf 100644
--- a/chrome/browser/ui/app_list/app_list_client_impl.cc
+++ b/chrome/browser/ui/app_list/app_list_client_impl.cc

@@ -24,6 +24,7 @@
 #include "chrome/browser/ui/app_list/app_list_syncable_service.h"
 #include "chrome/browser/ui/app_list/app_list_syncable_service_factory.h"
 #include "chrome/browser/ui/app_list/app_sync_ui_state_watcher.h"
+#include "chrome/browser/ui/app_list/search/app_result.h"
 #include "chrome/browser/ui/app_list/search/chrome_search_result.h"
 #include "chrome/browser/ui/app_list/search/search_controller.h"
 #include "chrome/browser/ui/app_list/search/search_controller_factory.h"
@@ -89,8 +90,16 @@
   if (!search_controller_)
     return;
   ChromeSearchResult* result = search_controller_->FindSearchResult(result_id);
-  if (result)
+  if (result) {
     search_controller_->OpenResult(result, event_flags);
+
+    // Send training signal to search controller.
+    if (result->result_type() == ash::SearchResultType::kInstalledApp ||
+        result->result_type() == ash::SearchResultType::kInternalApp) {
+      search_controller_->Train(
+          static_cast<app_list::AppResult*>(result)->app_id());
+    }
+  }
 }
 
 void AppListClientImpl::InvokeSearchResultAction(const std::string& result_id,
@@ -153,6 +162,9 @@
   if (!model_updater_)
     return;
   model_updater_->ActivateChromeItem(id, event_flags);
+
+  // Send training signal to search controller.
+  search_controller_->Train(id);
 }
 
 void AppListClientImpl::GetContextMenuModel(

diff --git a/chrome/browser/ui/app_list/search/app_search_provider.cc b/chrome/browser/ui/app_list/search/app_search_provider.cc
index d2973d5f..0c3b5cc 100644
--- a/chrome/browser/ui/app_list/search/app_search_provider.cc
+++ b/chrome/browser/ui/app_list/search/app_search_provider.cc

@@ -46,6 +46,7 @@
 #include "chrome/browser/ui/app_list/search/crostini_app_result.h"
 #include "chrome/browser/ui/app_list/search/extension_app_result.h"
 #include "chrome/browser/ui/app_list/search/internal_app_result.h"
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.h"
 #include "chrome/common/pref_names.h"
 #include "components/browser_sync/profile_sync_service.h"
 #include "components/sync/driver/sync_service.h"
@@ -61,9 +62,6 @@
 
 namespace {
 
-// The size of each step unlaunched apps should increase their relevance by.
-constexpr double kUnlaunchedAppRelevanceStepSize = 0.0001;
-
 // The minimum capacity we reserve in the Apps container which will be filled
 // with extensions and ARC apps, to avoid successive reallocation.
 constexpr size_t kMinimumReservedAppsContainerCapacity = 60U;
@@ -99,6 +97,18 @@
                                 duplicate_app_ids.end());
 }
 
+// Linearly maps |score| to the range [min, max].
+// |score| is assumed to be within [0.0, 1.0]; if it's greater than 1.0
+// then max is returned; if it's less than 0.0, then min is returned.
+float ReRange(const float score, const float min, const float max) {
+  if (score >= 1.0f)
+    return max;
+  if (score <= 0.0f)
+    return min;
+
+  return min + score * (max - min);
+}
+
 }  // namespace
 
 namespace app_list {
@@ -479,6 +489,7 @@
       list_controller_(list_controller),
       model_updater_(model_updater),
       clock_(clock),
+      ranker_(std::make_unique<AppSearchResultRanker>(profile)),
       update_results_factory_(this) {
   data_sources_.emplace_back(
       std::make_unique<ExtensionDataSource>(profile, this));
@@ -505,6 +516,10 @@
   UpdateResults();
 }
 
+void AppSearchProvider::Train(const std::string& id) {
+  ranker_->Train(id);
+}
+
 void AppSearchProvider::RefreshApps() {
   apps_.clear();
   apps_.reserve(kMinimumReservedAppsContainerCapacity);
@@ -518,6 +533,7 @@
   std::set<std::string> seen_or_filtered_apps;
   const uint16_t apps_size = apps_.size();
   new_results.reserve(apps_size);
+  const auto& ranker_scores = ranker_->Rank();
 
   for (auto& app : apps_) {
     // Skip apps which cannot be shown as a suggested app.
@@ -536,28 +552,33 @@
         app->data_source()->CreateResult(app->id(), list_controller_, true);
     result->SetTitle(title);
 
-    // Use the app list order to tiebreak apps that have never been
-    // launched. The apps that have been installed or launched recently
-    // should be more relevant than other apps.
-    // If it is |kInternalAppIdContinueReading|, always show it as the first
-    // result.
+    // Set app->relevance based on the following criteria.
+    const auto find_in_ranker = ranker_scores.find(app->id());
+    const auto find_in_app_list = id_to_app_list_index.find(app->id());
     const base::Time time = app->GetLastActivityTime();
-    if (time.is_null()) {
-      double relevance = 1.0;
-      if (app->id() != kInternalAppIdContinueReading) {
-        const auto& it = id_to_app_list_index.find(app->id());
-        // If it's in a folder, it won't be in |id_to_app_list_index|.
-        // Rank those as if they are at the end of the list.
-        const size_t app_list_index = (it == id_to_app_list_index.end())
-                                          ? apps_size
-                                          : std::min(apps_size, it->second);
-        relevance =
-            kUnlaunchedAppRelevanceStepSize * (apps_size - app_list_index);
-      }
-      result->set_relevance(relevance);
-    } else {
+
+    if (app->id() == kInternalAppIdContinueReading) {
+      // Case 1: if it's |kInternalAppIdContinueReading|, set relevance as 1.0
+      // (always show it as the first).
+      result->set_relevance(1.0);
+    } else if (find_in_ranker != ranker_scores.end()) {
+      // Case 2: if it's recommended by |ranker_|, set relevance as a score
+      // in [0.67, 0.99].
+      result->set_relevance(ReRange(find_in_ranker->second, 0.67, 0.99));
+    } else if (!time.is_null()) {
+      // Case 3: if it has last activity time or install time, set the relevance
+      // in [0.34, 0.66] based on the time.
       result->UpdateFromLastLaunchedOrInstalledTime(clock_->Now(), time);
+      result->set_relevance(ReRange(result->relevance(), 0.34, 0.66));
+    } else if (find_in_app_list != id_to_app_list_index.end()) {
+      // Case 4: if it's in the app_list_index, set the relevance in [0.1, 0.33]
+      result->set_relevance(
+          ReRange(1.0f / (1.0f + find_in_app_list->second), 0.1, 0.33));
+    } else {
+      // Case 5: otherwise set the relevance as 0.0f;
+      result->set_relevance(0.0f);
     }
+
     MaybeAddResult(&new_results, std::move(result), &seen_or_filtered_apps);
   }
 

diff --git a/chrome/browser/ui/app_list/search/app_search_provider.h b/chrome/browser/ui/app_list/search/app_search_provider.h
index 7da9a286..9c1c6cb 100644
--- a/chrome/browser/ui/app_list/search/app_search_provider.h
+++ b/chrome/browser/ui/app_list/search/app_search_provider.h

@@ -25,6 +25,8 @@
 
 namespace app_list {
 
+class AppSearchResultRanker;
+
 class AppSearchProvider : public SearchProvider {
  public:
   class App;
@@ -43,6 +45,7 @@
 
   // SearchProvider overrides:
   void Start(const base::string16& query) override;
+  void Train(const std::string& id) override;
 
   // Refresh indexed app data and update search results. When |force_inline| is
   // set to true, search results is updated before returning from the function.
@@ -64,6 +67,7 @@
   AppListModelUpdater* const model_updater_;
   base::Clock* clock_;
   std::vector<std::unique_ptr<DataSource>> data_sources_;
+  std::unique_ptr<AppSearchResultRanker> ranker_;
   base::WeakPtrFactory<AppSearchProvider> update_results_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(AppSearchProvider);

diff --git a/chrome/browser/ui/app_list/search/search_controller.cc b/chrome/browser/ui/app_list/search/search_controller.cc
index 395921a..4b19696c 100644
--- a/chrome/browser/ui/app_list/search/search_controller.cc
+++ b/chrome/browser/ui/app_list/search/search_controller.cc

@@ -109,4 +109,9 @@
   return nullptr;
 }
 
+void SearchController::Train(const std::string& id) {
+  for (const auto& provider : providers_)
+    provider->Train(id);
+}
+
 }  // namespace app_list

diff --git a/chrome/browser/ui/app_list/search/search_controller.h b/chrome/browser/ui/app_list/search/search_controller.h
index 32f0948..0f6a038 100644
--- a/chrome/browser/ui/app_list/search/search_controller.h
+++ b/chrome/browser/ui/app_list/search/search_controller.h

@@ -48,6 +48,9 @@
   ChromeSearchResult* FindSearchResult(const std::string& result_id);
   ChromeSearchResult* GetResultByTitleForTest(const std::string& title);
 
+  // Sends training signal to each |providers_|
+  void Train(const std::string& id);
+
  private:
   // Invoked when the search results are changed.
   void OnResultsChanged();

diff --git a/chrome/browser/ui/app_list/search/search_provider.h b/chrome/browser/ui/app_list/search/search_provider.h
index 72bf24ef..5fd6c28 100644
--- a/chrome/browser/ui/app_list/search/search_provider.h
+++ b/chrome/browser/ui/app_list/search/search_provider.h

@@ -26,6 +26,8 @@
 
   // Invoked to start a query.
   virtual void Start(const base::string16& query) = 0;
+  // Handles training signals if necessary.
+  virtual void Train(const std::string& id) {}
 
   void set_result_changed_callback(const ResultChangedCallback& callback) {
     result_changed_callback_ = callback;

diff --git a/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.cc b/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.cc
new file mode 100644
index 0000000..7d66b31
--- /dev/null
+++ b/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.cc

@@ -0,0 +1,44 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.h"
+
+#include <cmath>
+
+#include "base/logging.h"
+
+namespace app_list {
+
+MrfuAppLaunchPredictor::MrfuAppLaunchPredictor() = default;
+MrfuAppLaunchPredictor::~MrfuAppLaunchPredictor() = default;
+
+// Updates the score for this |app_id|.
+void MrfuAppLaunchPredictor::Train(const std::string& app_id) {
+  ++num_of_trains_;
+  Score& score = scores_[app_id];
+  UpdateScore(&score);
+  score.last_score += 1.0f - decay_coeff_;
+}
+
+// Updates all scores and return app_id to score map.
+base::flat_map<std::string, float> MrfuAppLaunchPredictor::Rank() {
+  base::flat_map<std::string, float> output;
+  for (auto& pair : scores_) {
+    UpdateScore(&pair.second);
+    output[pair.first] = pair.second.last_score;
+  }
+  return output;
+}
+
+// Updates last_score and last_update_timestamp.
+void MrfuAppLaunchPredictor::UpdateScore(Score* score) {
+  const int trains_since_last_time =
+      num_of_trains_ - score->num_of_trains_at_last_update;
+  if (trains_since_last_time > 0) {
+    score->last_score *= std::pow(decay_coeff_, trains_since_last_time);
+    score->num_of_trains_at_last_update = num_of_trains_;
+  }
+}
+
+}  // namespace app_list

diff --git a/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.h b/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.h
new file mode 100644
index 0000000..e9e1fad
--- /dev/null
+++ b/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.h

@@ -0,0 +1,73 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_APP_LIST_SEARCH_SEARCH_RESULT_RANKER_APP_LAUNCH_PREDICTOR_H_
+#define CHROME_BROWSER_UI_APP_LIST_SEARCH_SEARCH_RESULT_RANKER_APP_LAUNCH_PREDICTOR_H_
+
+#include <string>
+
+#include "base/containers/flat_map.h"
+#include "base/gtest_prod_util.h"
+#include "base/macros.h"
+
+namespace app_list {
+
+// AppLaunchPredictor is the interface implemented by all predictors. It defines
+// two basic public functions Train and Rank for training and inferencing.
+class AppLaunchPredictor {
+ public:
+  virtual ~AppLaunchPredictor() = default;
+  // Trains on the |app_id| and (possibly) updates its internal representation.
+  virtual void Train(const std::string& app_id) = 0;
+  // Returns a map of app_id and score.
+  //  (1) Higher score means more relevant.
+  //  (2) Only returns a subset of app_ids seen by this predictor.
+  //  (3) The returned scores should be in range [0.0, 1.0] for
+  //      AppSearchProvider to handle.
+  virtual base::flat_map<std::string, float> Rank() = 0;
+};
+
+// MrfuAppLaunchPredictor is a simple AppLaunchPredictor that balances MRU (most
+// recently used) and MFU (most frequently used). It is adopted from LRFU cpu
+// cache algorithm.
+class MrfuAppLaunchPredictor : public AppLaunchPredictor {
+ public:
+  MrfuAppLaunchPredictor();
+  ~MrfuAppLaunchPredictor() override;
+
+  // AppLaunchPredictor:
+  void Train(const std::string& app_id) override;
+  base::flat_map<std::string, float> Rank() override;
+
+ private:
+  FRIEND_TEST_ALL_PREFIXES(AppLaunchPredictorTest, MrfuAppLaunchPredictor);
+  FRIEND_TEST_ALL_PREFIXES(AppSearchResultRankerTest, TrainAndInfer);
+
+  // Records last updates of the Score for an app.
+  struct Score {
+    int32_t num_of_trains_at_last_update = 0;
+    float last_score = 0.0f;
+  };
+
+  // Updates the Score to now.
+  void UpdateScore(Score* score);
+
+  // Controls how much the score decays for each Train() call.
+  // This decay_coeff_ should be within [0.5f, 1.0f]. Setting it as 0.5f means
+  // MRU; setting as 1.0f means MFU;
+  // TODO(https://crbug.com/871674):
+  // (1) Set a better initial value based on real user data.
+  // (2) Dynamically change this coeff instead of setting it as constant.
+  static constexpr float decay_coeff_ = 0.8f;
+  // Map from app_id to its Score.
+  base::flat_map<std::string, Score> scores_;
+  // Increment 1 for each Train() call.
+  int32_t num_of_trains_ = 0;
+
+  DISALLOW_COPY_AND_ASSIGN(MrfuAppLaunchPredictor);
+};
+
+}  // namespace app_list
+
+#endif  // CHROME_BROWSER_UI_APP_LIST_SEARCH_SEARCH_RESULT_RANKER_APP_LAUNCH_PREDICTOR_H_

diff --git a/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor_unittest.cc b/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor_unittest.cc
new file mode 100644
index 0000000..dc3bd75
--- /dev/null
+++ b/chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor_unittest.cc

@@ -0,0 +1,44 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.h"
+
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using testing::UnorderedElementsAre;
+using testing::Pair;
+using testing::FloatEq;
+
+namespace app_list {
+
+namespace {
+
+constexpr char kTarget1[] = "Target1";
+constexpr char kTarget2[] = "Target2";
+
+}  // namespace
+
+TEST(AppLaunchPredictorTest, MrfuAppLaunchPredictor) {
+  MrfuAppLaunchPredictor predictor;
+  const float decay = MrfuAppLaunchPredictor::decay_coeff_;
+
+  predictor.Train(kTarget1);
+  const float score_1 = 1.0f - decay;
+  EXPECT_THAT(predictor.Rank(),
+              UnorderedElementsAre(Pair(kTarget1, FloatEq(score_1))));
+
+  predictor.Train(kTarget1);
+  const float score_2 = score_1 + score_1 * decay;
+  EXPECT_THAT(predictor.Rank(),
+              UnorderedElementsAre(Pair(kTarget1, FloatEq(score_2))));
+
+  predictor.Train(kTarget2);
+  const float score_3 = score_2 * decay;
+  EXPECT_THAT(predictor.Rank(),
+              UnorderedElementsAre(Pair(kTarget1, FloatEq(score_3)),
+                                   Pair(kTarget2, FloatEq(score_1))));
+}
+
+}  // namespace app_list

diff --git a/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.cc b/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.cc
new file mode 100644
index 0000000..63a6e386
--- /dev/null
+++ b/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.cc

@@ -0,0 +1,42 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.h"
+
+#include "ash/public/cpp/app_list/app_list_features.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.h"
+
+namespace app_list {
+
+AppSearchResultRanker::AppSearchResultRanker(Profile* profile) {
+  if (!features::IsSearchResultRankerTrainEnabled())
+    return;
+
+  if (features::SearchResultRankerPredictorName() == "MrfuAppLaunchPredictor") {
+    predictor_ = std::make_unique<MrfuAppLaunchPredictor>();
+    load_from_disk_success_ = true;
+  } else {
+    NOTREACHED();
+  }
+}
+
+AppSearchResultRanker::~AppSearchResultRanker() = default;
+
+void AppSearchResultRanker::Train(const std::string& app_id) {
+  if (load_from_disk_success_ && predictor_) {
+    predictor_->Train(app_id);
+  }
+}
+
+base::flat_map<std::string, float> AppSearchResultRanker::Rank() {
+  if (load_from_disk_success_ && features::IsSearchResultRankerInferEnabled() &&
+      predictor_) {
+    return predictor_->Rank();
+  }
+
+  return {};
+}
+
+}  // namespace app_list

diff --git a/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.h b/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.h
new file mode 100644
index 0000000..2b702e4
--- /dev/null
+++ b/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.h

@@ -0,0 +1,51 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_APP_LIST_SEARCH_SEARCH_RESULT_RANKER_APP_SEARCH_RESULT_RANKER_H_
+#define CHROME_BROWSER_UI_APP_LIST_SEARCH_SEARCH_RESULT_RANKER_APP_SEARCH_RESULT_RANKER_H_
+
+#include <memory>
+#include <string>
+
+#include "base/containers/flat_map.h"
+#include "base/macros.h"
+
+class Profile;
+
+namespace app_list {
+
+class AppLaunchPredictor;
+
+// AppSearchResultRanker is the main class used to train and re-rank the app
+// launches.
+class AppSearchResultRanker {
+ public:
+  // Construct a AppSearchResultRanker with profile. It (possibly)
+  // asynchronously loads model from disk from profile->GetPath(); and sets
+  // |load_from_disk_success_| to true when the loading finishes.
+  // The internal |predictor_| is constructed with param
+  // SearchResultRankerPredictorName() in "app_list_features.h".
+  explicit AppSearchResultRanker(Profile* profile);
+  ~AppSearchResultRanker();
+
+  // Trains on the |app_id| and (possibly) updates its internal representation.
+  void Train(const std::string& app_id);
+  // Returns a map of app_id and score.
+  //  (1) Higher score means more relevant.
+  //  (2) Only returns a subset of app_ids seen by this predictor.
+  //  (3) The returned scores should be in range [0.0, 1.0] for
+  //      AppSearchProvider to handle.
+  base::flat_map<std::string, float> Rank();
+
+ private:
+  // Internal predictor used for train and rank.
+  std::unique_ptr<AppLaunchPredictor> predictor_;
+  bool load_from_disk_success_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(AppSearchResultRanker);
+};
+
+}  // namespace app_list
+
+#endif  // CHROME_BROWSER_UI_APP_LIST_SEARCH_SEARCH_RESULT_RANKER_APP_SEARCH_RESULT_RANKER_H_

diff --git a/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker_unittest.cc b/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker_unittest.cc
new file mode 100644
index 0000000..f528b76
--- /dev/null
+++ b/chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker_unittest.cc

@@ -0,0 +1,71 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.h"
+
+#include "ash/public/cpp/app_list/app_list_features.h"
+#include "base/test/scoped_feature_list.h"
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_launch_predictor.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using testing::UnorderedElementsAre;
+using testing::Pair;
+using testing::FloatEq;
+
+namespace app_list {
+
+namespace {
+
+constexpr char kTarget1[] = "Target1";
+constexpr char kTarget2[] = "Target2";
+
+}  // namespace
+
+TEST(AppSearchResultRankerTest, TrainAndInfer) {
+  base::test::ScopedFeatureList scoped_feature_list_;
+  scoped_feature_list_.InitWithFeatures(
+      {features::kEnableSearchResultRankerTrain,
+       features::kEnableSearchResultRankerInfer},
+      {});
+
+  AppSearchResultRanker ranker(nullptr);
+  ranker.Train(kTarget1);
+  ranker.Train(kTarget2);
+
+  const float decay = MrfuAppLaunchPredictor::decay_coeff_;
+
+  EXPECT_THAT(
+      ranker.Rank(),
+      UnorderedElementsAre(Pair(kTarget1, FloatEq((1.0f - decay) * decay)),
+                           Pair(kTarget2, FloatEq(1.0f - decay))));
+}
+
+TEST(AppSearchResultRankerTest, ReturnEmptyIfInferIsDisabled) {
+  base::test::ScopedFeatureList scoped_feature_list_;
+  scoped_feature_list_.InitWithFeatures(
+      {features::kEnableSearchResultRankerTrain},
+      {features::kEnableSearchResultRankerInfer});
+
+  AppSearchResultRanker ranker(nullptr);
+  ranker.Train(kTarget1);
+  ranker.Train(kTarget2);
+
+  EXPECT_TRUE(ranker.Rank().empty());
+}
+
+TEST(AppSearchResultRankerTest, ReturnEmptyIfTrainIsDisabled) {
+  base::test::ScopedFeatureList scoped_feature_list_;
+  scoped_feature_list_.InitWithFeatures(
+      {features::kEnableSearchResultRankerTrain},
+      {features::kEnableSearchResultRankerInfer});
+
+  AppSearchResultRanker ranker(nullptr);
+  ranker.Train(kTarget1);
+  ranker.Train(kTarget2);
+
+  EXPECT_TRUE(ranker.Rank().empty());
+}
+
+}  // namespace app_list

diff --git a/chrome/browser/ui/app_list/search/tests/app_search_provider_unittest.cc b/chrome/browser/ui/app_list/search/tests/app_search_provider_unittest.cc
index 8d71c20..04e6ff8 100644
--- a/chrome/browser/ui/app_list/search/tests/app_search_provider_unittest.cc
+++ b/chrome/browser/ui/app_list/search/tests/app_search_provider_unittest.cc

@@ -11,9 +11,11 @@
 #include <string>
 #include <utility>
 
+#include "ash/public/cpp/app_list/app_list_features.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/simple_test_clock.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/ui/app_list/app_list_test_util.h"
@@ -22,6 +24,7 @@
 #include "chrome/browser/ui/app_list/arc/arc_app_test.h"
 #include "chrome/browser/ui/app_list/extension_app_model_builder.h"
 #include "chrome/browser/ui/app_list/search/chrome_search_result.h"
+#include "chrome/browser/ui/app_list/search/search_result_ranker/app_search_result_ranker.h"
 #include "chrome/browser/ui/app_list/test/fake_app_list_model_updater.h"
 #include "chrome/browser/ui/app_list/test/test_app_list_controller_delegate.h"
 #include "chrome/common/chrome_constants.h"
@@ -140,6 +143,9 @@
   const SearchProvider::Results& results() { return app_search_->results(); }
   ArcAppTest& arc_test() { return arc_test_; }
 
+  // Train the |app_search| provider with id.
+  void Train(const std::string& id) { app_search_->Train(id); }
+
  private:
   base::SimpleTestClock clock_;
   std::unique_ptr<FakeAppListModelUpdater> model_updater_;
@@ -294,6 +300,53 @@
             RunQuery(""));
 }
 
+TEST_F(AppSearchProviderTest, FetchRecommendationsFromRanker) {
+  base::test::ScopedFeatureList scoped_feature_list_;
+  scoped_feature_list_.InitWithFeatures(
+      {features::kEnableSearchResultRankerTrain,
+       features::kEnableSearchResultRankerInfer},
+      {});
+  CreateSearch();
+
+  extensions::ExtensionPrefs* prefs =
+      extensions::ExtensionPrefs::Get(profile_.get());
+
+  prefs->SetLastLaunchTime(kHostedAppId, base::Time::FromInternalValue(20));
+  prefs->SetLastLaunchTime(kPackagedApp1Id, base::Time::FromInternalValue(10));
+  prefs->SetLastLaunchTime(kPackagedApp2Id, base::Time::FromInternalValue(5));
+  EXPECT_EQ("Hosted App,Packaged App 1,Packaged App 2,Settings,Camera",
+            RunQuery(""));
+
+  Train(kPackagedApp2Id);
+  Train(kPackagedApp2Id);
+  Train(kPackagedApp1Id);
+  EXPECT_EQ("Packaged App 2,Packaged App 1,Hosted App,Settings,Camera",
+            RunQuery(""));
+}
+
+TEST_F(AppSearchProviderTest, RankerIsDisabledWithFlag) {
+  base::test::ScopedFeatureList scoped_feature_list_;
+  scoped_feature_list_.InitWithFeatures(
+      {features::kEnableSearchResultRankerTrain},
+      {features::kEnableSearchResultRankerInfer});
+  CreateSearch();
+
+  extensions::ExtensionPrefs* prefs =
+      extensions::ExtensionPrefs::Get(profile_.get());
+
+  prefs->SetLastLaunchTime(kHostedAppId, base::Time::FromInternalValue(20));
+  prefs->SetLastLaunchTime(kPackagedApp1Id, base::Time::FromInternalValue(10));
+  prefs->SetLastLaunchTime(kPackagedApp2Id, base::Time::FromInternalValue(5));
+  EXPECT_EQ("Hosted App,Packaged App 1,Packaged App 2,Settings,Camera",
+            RunQuery(""));
+
+  Train(kPackagedApp2Id);
+  Train(kPackagedApp2Id);
+  Train(kPackagedApp1Id);
+  EXPECT_EQ("Hosted App,Packaged App 1,Packaged App 2,Settings,Camera",
+            RunQuery(""));
+}
+
 TEST_F(AppSearchProviderTest, FilterDuplicate) {
   arc_test().SetUp(profile());
 

diff --git a/chrome/browser/ui/ash/ime_controller_client_unittest.cc b/chrome/browser/ui/ash/ime_controller_client_unittest.cc
index 2df72fc8..eb0dc95 100644
--- a/chrome/browser/ui/ash/ime_controller_client_unittest.cc
+++ b/chrome/browser/ui/ash/ime_controller_client_unittest.cc

@@ -9,12 +9,12 @@
 #include <utility>
 #include <vector>
 
-#include "ash/ime/test_ime_controller.h"
 #include "base/macros.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/scoped_task_environment.h"
+#include "chrome/browser/ui/ash/test_ime_controller.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/ime/chromeos/fake_input_method_delegate.h"
 #include "ui/base/ime/chromeos/input_method_descriptor.h"
@@ -158,7 +158,7 @@
   TestInputMethodManager input_method_manager_;
 
   // Mock of mojo interface in ash.
-  ash::TestImeController ime_controller_;
+  TestImeController ime_controller_;
 
  private:
   base::test::ScopedTaskEnvironment scoped_task_environment_;

diff --git a/chrome/browser/ui/ash/launcher/chrome_launcher_controller.cc b/chrome/browser/ui/ash/launcher/chrome_launcher_controller.cc
index 6ad1c95..9339518 100644
--- a/chrome/browser/ui/ash/launcher/chrome_launcher_controller.cc
+++ b/chrome/browser/ui/ash/launcher/chrome_launcher_controller.cc

@@ -1125,25 +1125,25 @@
   // if the icon cache gets deleted upon user switch.
   std::unique_ptr<AppIconLoader> chrome_app_icon_loader =
       std::make_unique<extensions::ChromeAppIconLoader>(
-          profile_, extension_misc::EXTENSION_ICON_SMALL, this);
+          profile_, extension_misc::EXTENSION_ICON_MEDIUM, this);
   app_icon_loaders_.push_back(std::move(chrome_app_icon_loader));
 
   if (arc::IsArcAllowedForProfile(profile_)) {
     std::unique_ptr<AppIconLoader> arc_app_icon_loader =
         std::make_unique<ArcAppIconLoader>(
-            profile_, extension_misc::EXTENSION_ICON_SMALL, this);
+            profile_, extension_misc::EXTENSION_ICON_MEDIUM, this);
     app_icon_loaders_.push_back(std::move(arc_app_icon_loader));
   }
 
   std::unique_ptr<AppIconLoader> internal_app_icon_loader =
       std::make_unique<InternalAppIconLoader>(
-          profile_, extension_misc::EXTENSION_ICON_SMALL, this);
+          profile_, extension_misc::EXTENSION_ICON_MEDIUM, this);
   app_icon_loaders_.push_back(std::move(internal_app_icon_loader));
 
   if (IsCrostiniUIAllowedForProfile(profile_)) {
     std::unique_ptr<AppIconLoader> crostini_app_icon_loader =
         std::make_unique<CrostiniAppIconLoader>(
-            profile_, extension_misc::EXTENSION_ICON_SMALL, this);
+            profile_, extension_misc::EXTENSION_ICON_MEDIUM, this);
     app_icon_loaders_.push_back(std::move(crostini_app_icon_loader));
   }
 

diff --git a/ash/ime/test_ime_controller.cc b/chrome/browser/ui/ash/test_ime_controller.cc
similarity index 91%
rename from ash/ime/test_ime_controller.cc
rename to chrome/browser/ui/ash/test_ime_controller.cc
index 5a62033e9..a97ea5d0 100644
--- a/ash/ime/test_ime_controller.cc
+++ b/chrome/browser/ui/ash/test_ime_controller.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "ash/ime/test_ime_controller.h"
+#include "chrome/browser/ui/ash/test_ime_controller.h"
 
 #include <memory>
 #include <string>
@@ -10,8 +10,6 @@
 
 #include "ash/public/interfaces/ime_controller.mojom.h"
 
-namespace ash {
-
 TestImeController::TestImeController() : binding_(this) {}
 TestImeController::~TestImeController() = default;
 
@@ -21,7 +19,7 @@
   return ptr;
 }
 
-void TestImeController::SetClient(mojom::ImeControllerClientPtr client) {}
+void TestImeController::SetClient(ash::mojom::ImeControllerClientPtr client) {}
 
 void TestImeController::RefreshIme(
     const std::string& current_ime_id,
@@ -64,5 +62,3 @@
                                           const base::string16& text) {
   show_mode_indicator_ = true;
 }
-
-}  // namespace ash

diff --git a/ash/ime/test_ime_controller.h b/chrome/browser/ui/ash/test_ime_controller.h
similarity index 70%
rename from ash/ime/test_ime_controller.h
rename to chrome/browser/ui/ash/test_ime_controller.h
index 070cbe3d..6f8f3af 100644
--- a/ash/ime/test_ime_controller.h
+++ b/chrome/browser/ui/ash/test_ime_controller.h

@@ -2,32 +2,29 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef ASH_IME_TEST_IME_CONTROLLER_H_
-#define ASH_IME_TEST_IME_CONTROLLER_H_
+#ifndef CHROME_BROWSER_UI_ASH_TEST_IME_CONTROLLER_H_
+#define CHROME_BROWSER_UI_ASH_TEST_IME_CONTROLLER_H_
 
 #include <memory>
 #include <string>
 #include <utility>
 
-#include "ash/ash_export.h"
 #include "ash/public/interfaces/ime_controller.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
 
-namespace ash {
-
-class ASH_EXPORT TestImeController : mojom::ImeController {
+class TestImeController : ash::mojom::ImeController {
  public:
   TestImeController();
   ~TestImeController() override;
 
   // Returns a mojo interface pointer bound to this object.
-  mojom::ImeControllerPtr CreateInterfacePtr();
+  ash::mojom::ImeControllerPtr CreateInterfacePtr();
 
-  // mojom::ImeController:
-  void SetClient(mojom::ImeControllerClientPtr client) override;
+  // ash::mojom::ImeController:
+  void SetClient(ash::mojom::ImeControllerClientPtr client) override;
   void RefreshIme(const std::string& current_ime_id,
-                  std::vector<mojom::ImeInfoPtr> available_imes,
-                  std::vector<mojom::ImeMenuItemPtr> menu_items) override;
+                  std::vector<ash::mojom::ImeInfoPtr> available_imes,
+                  std::vector<ash::mojom::ImeMenuItemPtr> menu_items) override;
   void SetImesManagedByPolicy(bool managed) override;
   void ShowImeMenuOnShelf(bool show) override;
   void UpdateCapsLockState(bool enabled) override;
@@ -41,8 +38,8 @@
 
   // The most recent values received via mojo.
   std::string current_ime_id_;
-  std::vector<mojom::ImeInfoPtr> available_imes_;
-  std::vector<mojom::ImeMenuItemPtr> menu_items_;
+  std::vector<ash::mojom::ImeInfoPtr> available_imes_;
+  std::vector<ash::mojom::ImeMenuItemPtr> menu_items_;
   bool managed_by_policy_ = false;
   bool show_ime_menu_on_shelf_ = false;
   bool show_mode_indicator_ = false;
@@ -54,11 +51,9 @@
   bool is_voice_enabled_ = false;
 
  private:
-  mojo::Binding<mojom::ImeController> binding_;
+  mojo::Binding<ash::mojom::ImeController> binding_;
 
   DISALLOW_COPY_AND_ASSIGN(TestImeController);
 };
 
-}  // namespace ash
-
-#endif  // ASH_IME_TEST_IME_CONTROLLER_H_
+#endif  // CHROME_BROWSER_UI_ASH_TEST_IME_CONTROLLER_H_

diff --git a/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller.mm b/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller.mm
index 471a2da1..bafb1a5 100644
--- a/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller.mm
+++ b/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller.mm

@@ -173,11 +173,6 @@
       return;
     }
 
-    if (!range.IsValid()) {
-      [self updateTextSelection:base::string16() range:gfx::Range() offset:0];
-      return;
-    }
-
     text_.reset([base::SysUTF16ToNSString(text) retain]);
     selectionRange_ =
         NSMakeRange(range.start() - offset, range.end() - range.start());
@@ -275,8 +270,10 @@
       webContents_->GetTopLevelRenderWidgetHostView()->GetSelectedRange();
   const size_t offset = webContents_->GetTopLevelRenderWidgetHostView()
                             ->GetOffsetForSurroundingText();
-
-  [self updateTextSelection:text range:range offset:offset];
+  if (range.IsValid())
+    [self updateTextSelection:text range:range offset:offset];
+  else
+    [self updateTextSelection:base::string16() range:gfx::Range() offset:0];
 }
 
 - (content::WebContents*)webContents {

diff --git a/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller_browsertest.mm b/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller_browsertest.mm
index 2fee623..a98b8b0 100644
--- a/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller_browsertest.mm
+++ b/chrome/browser/ui/cocoa/touchbar/text_suggestions_touch_bar_controller_browsertest.mm

@@ -191,17 +191,6 @@
   }
 }
 
-// Tests that an invalid range does not crash the controller.
-IN_PROC_BROWSER_TEST_F(TextSuggestionsTouchBarControllerTest, InvalidRange) {
-  FocusTextfield();
-  [touch_bar_controller_
-      updateTextSelection:base::string16(base::ASCIIToUTF16("text"))
-                    range:gfx::Range::InvalidRange()
-                   offset:0];
-  EXPECT_STREQ("", [touch_bar_controller_ text].UTF8String);
-  EXPECT_EQ(gfx::Range(), [touch_bar_controller_ selectionRange]);
-}
-
 // Tests that a change in WebContents is handled properly.
 IN_PROC_BROWSER_TEST_F(TextSuggestionsTouchBarControllerTest, SetWebContents) {
   NSString* const kText = @"text";

diff --git a/chrome/browser/ui/extensions/hosted_app_browsertest.cc b/chrome/browser/ui/extensions/hosted_app_browsertest.cc
index c7fd49e..972c529 100644
--- a/chrome/browser/ui/extensions/hosted_app_browsertest.cc
+++ b/chrome/browser/ui/extensions/hosted_app_browsertest.cc

@@ -43,6 +43,7 @@
 #include "chrome/common/web_application_info.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/security_interstitials/core/controller_client.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/notification_service.h"
@@ -2007,6 +2008,278 @@
       web_contents->GetMainFrame()->GetProcess()->GetID()));
 }
 
+class HostedAppSitePerProcessTest : public HostedAppProcessModelTest {
+ public:
+  HostedAppSitePerProcessTest() {}
+  ~HostedAppSitePerProcessTest() override {}
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ASSERT_TRUE(embedded_test_server()->InitializeAndListen());
+    content::IsolateAllSitesForTesting(command_line);
+  }
+};
+
+// Check that two different cross-site hosted apps won't share a process even
+// when over process limit, when in --site-per-process mode.  See
+// https://crbug.com/811939.
+IN_PROC_BROWSER_TEST_P(HostedAppSitePerProcessTest,
+                       DoNotShareProcessWhenOverProcessLimit) {
+  // Set the process limit to 1.
+  content::RenderProcessHost::SetMaxRendererProcessCount(1);
+
+  // Set up and launch a hosted app covering foo.com.
+  GURL foo_app_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
+  constexpr const char kHostedAppManifest[] =
+      R"( { "name": "Hosted App With SitePerProcess Test",
+            "version": "1",
+            "manifest_version": 2,
+            "app": {
+              "launch": {
+                "web_url": "%s"
+              },
+              "urls": ["http://%s/"]
+            }
+          } )";
+  {
+    extensions::TestExtensionDir test_app_dir;
+    test_app_dir.WriteManifest(base::StringPrintf(
+        kHostedAppManifest, foo_app_url.spec().c_str(), "foo.com"));
+    SetupApp(test_app_dir.UnpackedPath());
+  }
+  content::WebContents* foo_contents =
+      app_browser_->tab_strip_model()->GetActiveWebContents();
+  EXPECT_TRUE(content::WaitForLoadStop(foo_contents));
+
+  // Set up and launch a hosted app covering bar.com.
+  GURL bar_app_url(embedded_test_server()->GetURL("bar.com", "/title1.html"));
+  {
+    extensions::TestExtensionDir test_app_dir;
+    test_app_dir.WriteManifest(base::StringPrintf(
+        kHostedAppManifest, bar_app_url.spec().c_str(), "bar.com"));
+    SetupApp(test_app_dir.UnpackedPath());
+  }
+  content::WebContents* bar_contents =
+      app_browser_->tab_strip_model()->GetActiveWebContents();
+  EXPECT_TRUE(content::WaitForLoadStop(bar_contents));
+
+  EXPECT_NE(foo_contents, bar_contents);
+  EXPECT_NE(foo_contents->GetMainFrame()->GetSiteInstance(),
+            bar_contents->GetMainFrame()->GetSiteInstance());
+  EXPECT_EQ(foo_app_url, foo_contents->GetLastCommittedURL());
+  EXPECT_EQ(bar_app_url, bar_contents->GetLastCommittedURL());
+
+  // Under --site-per-process the two apps should load in separate processes,
+  // even when over process limit.
+  EXPECT_NE(foo_contents->GetMainFrame()->GetProcess(),
+            bar_contents->GetMainFrame()->GetProcess());
+}
+
+// Check that when a hosted app covers multiple sites in its web extent, these
+// sites do not share a process in site-per-process mode. See
+// https://crbug.com/791796.
+IN_PROC_BROWSER_TEST_P(HostedAppSitePerProcessTest,
+                       DoNotShareProcessForDifferentSitesCoveredBySameApp) {
+  // Set up a hosted app covering http://foo.com and http://bar.com, and launch
+  // the app with a foo.com URL in a new window.
+  GURL foo_app_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
+  constexpr const char kHostedAppManifest[] =
+      R"( { "name": "Hosted App With SitePerProcess Test",
+            "version": "1",
+            "manifest_version": 2,
+            "app": {
+              "launch": {
+                "web_url": "%s"
+              },
+              "urls": ["http://%s/", "http://%s/"]
+            }
+          } )";
+  {
+    extensions::TestExtensionDir test_app_dir;
+    test_app_dir.WriteManifest(base::StringPrintf(
+        kHostedAppManifest, foo_app_url.spec().c_str(), "foo.com", "bar.com"));
+    SetupApp(test_app_dir.UnpackedPath());
+  }
+  content::WebContents* foo_contents =
+      app_browser_->tab_strip_model()->GetActiveWebContents();
+  EXPECT_TRUE(content::WaitForLoadStop(foo_contents));
+  EXPECT_EQ(foo_app_url, foo_contents->GetLastCommittedURL());
+
+  // Now navigate original window to a bar.com app URL.
+  GURL bar_app_url(embedded_test_server()->GetURL("bar.com", "/title2.html"));
+  ui_test_utils::NavigateToURL(browser(), bar_app_url);
+  content::WebContents* bar_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_EQ(bar_app_url, bar_contents->GetLastCommittedURL());
+  EXPECT_NE(foo_contents, bar_contents);
+
+  // Ensure the two pages don't share a process despite being from the same
+  // app, since they are from different sites.
+  EXPECT_NE(foo_contents->GetMainFrame()->GetSiteInstance(),
+            bar_contents->GetMainFrame()->GetSiteInstance());
+  auto* foo_process =
+      foo_contents->GetMainFrame()->GetSiteInstance()->GetProcess();
+  auto* bar_process =
+      bar_contents->GetMainFrame()->GetSiteInstance()->GetProcess();
+  EXPECT_NE(foo_process, bar_process);
+
+  // Ensure each process only has access to its site's data.
+  auto* policy = content::ChildProcessSecurityPolicy::GetInstance();
+  EXPECT_TRUE(
+      policy->CanAccessDataForOrigin(foo_process->GetID(), foo_app_url));
+  EXPECT_FALSE(
+      policy->CanAccessDataForOrigin(foo_process->GetID(), bar_app_url));
+  EXPECT_FALSE(
+      policy->CanAccessDataForOrigin(bar_process->GetID(), foo_app_url));
+  EXPECT_TRUE(
+      policy->CanAccessDataForOrigin(bar_process->GetID(), bar_app_url));
+
+  // Both processes should still be app processes.
+  auto* process_map = extensions::ProcessMap::Get(browser()->profile());
+  EXPECT_TRUE(process_map->Contains(foo_process->GetID()));
+  EXPECT_TRUE(process_map->Contains(bar_process->GetID()));
+}
+
+// Check background page scriptability for a hosted app that covers multiple
+// sites in its web extent.  When a hosted app page opens a background page,
+// only same-site parts of the app should be able to script that background
+// page. This behavior should be the same with and without --site-per-process.
+IN_PROC_BROWSER_TEST_P(HostedAppProcessModelTest,
+                       BackgroundPageWithAppCoveringDifferentSites) {
+  // Set up a hosted app covering http://foo.com and http://bar.com.
+  GURL foo_app_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
+  constexpr const char kHostedAppManifest[] =
+      R"( { "name": "Hosted App With SitePerProcess Test",
+            "version": "1",
+            "manifest_version": 2,
+            "app": {
+              "launch": {
+                "web_url": "%s"
+              },
+              "urls": ["http://foo.com/", "http://bar.com/"]
+            },
+            "permissions": ["background"]
+          } )";
+  {
+    extensions::TestExtensionDir test_app_dir;
+    test_app_dir.WriteManifest(
+        base::StringPrintf(kHostedAppManifest, foo_app_url.spec().c_str()));
+    SetupApp(test_app_dir.UnpackedPath());
+  }
+
+  // Set up three unrelated hosted app tabs in the main browser window:
+  // foo.com, bar.com, and another one at foo.com.
+  ui_test_utils::NavigateToURL(browser(), foo_app_url);
+  content::WebContents* foo_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_EQ(foo_app_url, foo_contents->GetLastCommittedURL());
+
+  GURL bar_app_url(embedded_test_server()->GetURL("bar.com", "/title2.html"));
+  ui_test_utils::NavigateToURLWithDisposition(
+      browser(), bar_app_url, WindowOpenDisposition::NEW_FOREGROUND_TAB,
+      ui_test_utils::BROWSER_TEST_WAIT_FOR_NAVIGATION);
+  content::WebContents* bar_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_EQ(bar_app_url, bar_contents->GetLastCommittedURL());
+  EXPECT_NE(foo_contents, bar_contents);
+
+  GURL foo_app_url2(embedded_test_server()->GetURL("foo.com", "/title3.html"));
+  ui_test_utils::NavigateToURLWithDisposition(
+      browser(), foo_app_url2, WindowOpenDisposition::NEW_FOREGROUND_TAB,
+      ui_test_utils::BROWSER_TEST_WAIT_FOR_NAVIGATION);
+  content::WebContents* foo_contents2 =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_EQ(foo_app_url2, foo_contents2->GetLastCommittedURL());
+  EXPECT_NE(foo_contents, foo_contents2);
+  EXPECT_NE(bar_contents, foo_contents2);
+  ASSERT_EQ(3, browser()->tab_strip_model()->count());
+
+  // The two foo.com tabs should be in the same process even though they are
+  // unrelated, since hosted apps use the process-per-site process model.
+  auto* foo_process = foo_contents->GetMainFrame()->GetProcess();
+  EXPECT_EQ(foo_process, foo_contents2->GetMainFrame()->GetProcess());
+  EXPECT_FALSE(
+      foo_contents->GetMainFrame()->GetSiteInstance()->IsRelatedSiteInstance(
+          foo_contents2->GetMainFrame()->GetSiteInstance()));
+
+  // The bar.com tab should be in the same process as the foo.com tabs only if
+  // we are not in --site-per-process mode.  --site-per-process should override
+  // the process-per-site behavior.
+  auto* bar_process = bar_contents->GetMainFrame()->GetProcess();
+  EXPECT_EQ(foo_process == bar_process,
+            !content::AreAllSitesIsolatedForTesting());
+
+  // Ensure all tabs are in app processes.
+  auto* process_map = extensions::ProcessMap::Get(browser()->profile());
+  EXPECT_TRUE(process_map->Contains(foo_process->GetID()));
+  EXPECT_TRUE(process_map->Contains(bar_process->GetID()));
+
+  // Open a background page from the first foo.com window.
+  {
+    content::TestNavigationObserver background_page_observer(nullptr);
+    background_page_observer.StartWatchingNewWebContents();
+    EXPECT_TRUE(content::ExecuteScript(
+        foo_contents,
+        "window.bg = window.open('/empty.html', 'bg', 'background');"));
+    background_page_observer.Wait();
+    EXPECT_EQ(embedded_test_server()->GetURL("foo.com", "/empty.html"),
+              background_page_observer.last_navigation_url());
+
+    // The background page shouldn't show up in the tab strip.
+    ASSERT_EQ(3, browser()->tab_strip_model()->count());
+  }
+
+  // Script the background page from the first foo.com window and set a dummy
+  // value.
+  EXPECT_TRUE(content::ExecuteScript(foo_contents,
+                                     "bg.document.body.innerText = 'foo'"));
+
+  // Ensure that the second foo.com page can script the same background page
+  // and retrieve the value.
+  EXPECT_EQ("foo",
+            content::EvalJs(foo_contents2,
+                            "window.open('', 'bg').document.body.innerText"));
+
+  // Ensure that the bar.com page cannot script this background page, since it
+  // is cross-origin from it. The window lookup via window.open('', bg') should
+  // be disallowed, resulting in a new popup instead, and the innerText value
+  // from that should be empty.
+  EXPECT_EQ("",
+            content::EvalJs(bar_contents,
+                            "window.open('', 'bg').document.body.innerText"));
+
+  // Open another bar.com app URL in an unrelated tab.  This should share a
+  // process with the first bar.com tab, due to hosted apps using
+  // process-per-site.
+  GURL bar_app_url2(embedded_test_server()->GetURL("bar.com", "/title3.html"));
+  ui_test_utils::NavigateToURLWithDisposition(
+      browser(), bar_app_url2, WindowOpenDisposition::NEW_FOREGROUND_TAB,
+      ui_test_utils::BROWSER_TEST_WAIT_FOR_NAVIGATION);
+  content::WebContents* bar_contents2 =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_EQ(bar_app_url2, bar_contents2->GetLastCommittedURL());
+  EXPECT_EQ(bar_process, bar_contents2->GetMainFrame()->GetProcess());
+  EXPECT_FALSE(
+      bar_contents->GetMainFrame()->GetSiteInstance()->IsRelatedSiteInstance(
+          bar_contents2->GetMainFrame()->GetSiteInstance()));
+
+  // Ensure bar.com tabs can open and script their open background page.
+  {
+    content::TestNavigationObserver background_page_observer(nullptr);
+    background_page_observer.StartWatchingNewWebContents();
+    EXPECT_TRUE(content::ExecuteScript(
+        bar_contents,
+        "window.bg = window.open('/empty.html', 'bg2', 'background');"));
+    background_page_observer.Wait();
+    EXPECT_EQ(embedded_test_server()->GetURL("bar.com", "/empty.html"),
+              background_page_observer.last_navigation_url());
+  }
+  EXPECT_TRUE(content::ExecuteScript(bar_contents,
+                                     "bg.document.body.innerText = 'bar'"));
+  EXPECT_EQ("bar",
+            content::EvalJs(bar_contents2,
+                            "window.open('', 'bg2').document.body.innerText"));
+}
+
 INSTANTIATE_TEST_CASE_P(/* no prefix */,
                         HostedAppTest,
                         ::testing::Combine(kAppTypeValues, ::testing::Bool()));
@@ -2024,3 +2297,9 @@
     HostedAppIsolatedOriginTest,
     ::testing::Combine(::testing::Values(AppType::HOSTED_APP),
                        ::testing::Bool()));
+
+INSTANTIATE_TEST_CASE_P(
+    /* no prefix */,
+    HostedAppSitePerProcessTest,
+    ::testing::Combine(::testing::Values(AppType::HOSTED_APP),
+                       ::testing::Bool()));

diff --git a/chrome/browser/ui/views/autofill/save_card_icon_view.cc b/chrome/browser/ui/views/autofill/save_card_icon_view.cc
index 1c6329f..a5305b8 100644
--- a/chrome/browser/ui/views/autofill/save_card_icon_view.cc
+++ b/chrome/browser/ui/views/autofill/save_card_icon_view.cc

@@ -57,9 +57,10 @@
   enabled &= SetCommandEnabled(enabled);
   SetVisible(enabled);
 
-  AnimateInkDrop(views::InkDropState::HIDDEN, nullptr);
-  if (enabled && controller->CanAnimate())
+  if (enabled && controller->CanAnimate()) {
+    AnimateInkDrop(views::InkDropState::HIDDEN, nullptr);
     AnimateIn(IDS_AUTOFILL_CARD_SAVED);
+  }
 
   return was_visible != visible();
 }
@@ -91,6 +92,7 @@
 
 void SaveCardIconView::AnimationEnded(const gfx::Animation* animation) {
   IconLabelBubbleView::AnimationEnded(animation);
+  AnimateInkDrop(views::InkDropState::ACTIVATED, nullptr);
 
   // |controller| may be nullptr due to lazy initialization.
   SaveCardBubbleControllerImpl* controller = GetController();

diff --git a/chrome/browser/ui/views/tabs/tab_unittest.cc b/chrome/browser/ui/views/tabs/tab_unittest.cc
index b71a822..6e6a9da 100644
--- a/chrome/browser/ui/views/tabs/tab_unittest.cc
+++ b/chrome/browser/ui/views/tabs/tab_unittest.cc

@@ -80,7 +80,9 @@
       gfx::Path* clip) override {
     return true;
   }
-  int GetStrokeThickness() const override { return 0; }
+  int GetStrokeThickness() const override {
+    return ui::MaterialDesignController::IsRefreshUi() ? 0 : 1;
+  }
   bool CanPaintThrobberToLayer() const override {
     return paint_throbber_to_layer_;
   }

diff --git a/chrome/browser/ui/views/webauthn/sheet_view_factory.cc b/chrome/browser/ui/views/webauthn/sheet_view_factory.cc
index 1c298072..c417df8e 100644
--- a/chrome/browser/ui/views/webauthn/sheet_view_factory.cc
+++ b/chrome/browser/ui/views/webauthn/sheet_view_factory.cc

@@ -88,6 +88,10 @@
       sheet_view = std::make_unique<AuthenticatorRequestSheetView>(
           std::make_unique<AuthenticatorTouchIdSheetModel>(dialog_model));
       break;
+    case Step::kCableActivate:
+      sheet_view = std::make_unique<AuthenticatorRequestSheetView>(
+          std::make_unique<AuthenticatorPaaskSheetModel>(dialog_model));
+      break;
     case Step::kCompleted:
     case Step::kBlePowerOnAutomatic:
       sheet_view = std::make_unique<AuthenticatorRequestSheetView>(

diff --git a/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc b/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc
index 4f2467a..e13a02e 100644
--- a/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc
+++ b/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc

@@ -63,6 +63,9 @@
           AuthenticatorRequestDialogModel::Step::kBleActivate);
     } else if (name == "touchid") {
       model->SetCurrentStep(AuthenticatorRequestDialogModel::Step::kTouchId);
+    } else if (name == "cable_activate") {
+      model->SetCurrentStep(
+          AuthenticatorRequestDialogModel::Step::kCableActivate);
     }
 
     ShowAuthenticatorRequestDialog(
@@ -128,3 +131,7 @@
 IN_PROC_BROWSER_TEST_F(AuthenticatorDialogTest, InvokeUi_touchid) {
   ShowAndVerifyUi();
 }
+
+IN_PROC_BROWSER_TEST_F(AuthenticatorDialogTest, InvokeUi_cable_activate) {
+  ShowAndVerifyUi();
+}

diff --git a/chrome/browser/ui/webauthn/sheet_models.cc b/chrome/browser/ui/webauthn/sheet_models.cc
index dc29919..3b72a42 100644
--- a/chrome/browser/ui/webauthn/sheet_models.cc
+++ b/chrome/browser/ui/webauthn/sheet_models.cc

@@ -368,3 +368,17 @@
 base::string16 AuthenticatorTouchIdSheetModel::GetStepDescription() const {
   return base::string16();
 }
+
+// AuthenticatorPaaskSheetModel -----------------------------------------
+
+gfx::ImageSkia* AuthenticatorPaaskSheetModel::GetStepIllustration() const {
+  return GetImage(IDR_WEBAUTHN_ILLUSTRATION_PHONE_1X);
+}
+
+base::string16 AuthenticatorPaaskSheetModel::GetStepTitle() const {
+  return l10n_util::GetStringUTF16(IDS_WEBAUTHN_CABLE_ACTIVATE_TITLE);
+}
+
+base::string16 AuthenticatorPaaskSheetModel::GetStepDescription() const {
+  return l10n_util::GetStringUTF16(IDS_WEBAUTHN_CABLE_ACTIVATE_DESCRIPTION);
+}

diff --git a/chrome/browser/ui/webauthn/sheet_models.h b/chrome/browser/ui/webauthn/sheet_models.h
index 0f99534..c2bae79f 100644
--- a/chrome/browser/ui/webauthn/sheet_models.h
+++ b/chrome/browser/ui/webauthn/sheet_models.h

@@ -207,4 +207,15 @@
   base::string16 GetStepDescription() const override;
 };
 
+class AuthenticatorPaaskSheetModel : public AuthenticatorSheetModelBase {
+ public:
+  using AuthenticatorSheetModelBase::AuthenticatorSheetModelBase;
+
+ private:
+  // AuthenticatorSheetModelBase:
+  gfx::ImageSkia* GetStepIllustration() const override;
+  base::string16 GetStepTitle() const override;
+  base::string16 GetStepDescription() const override;
+};
+
 #endif  // CHROME_BROWSER_UI_WEBAUTHN_SHEET_MODELS_H_

diff --git a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
index 9cac45c..df99b483 100644
--- a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc

@@ -650,6 +650,9 @@
 }
 
 void CoreOobeHandler::HandleSetupDemoMode() {
+  // Stop idle detection for derelict demo mode.
+  StopDemoModeDetection();
+
   WizardController* wizard_controller = WizardController::default_controller();
   if (wizard_controller && !wizard_controller->login_screen_started()) {
     wizard_controller->StartDemoModeSetup();

diff --git a/chrome/browser/ui/webui/components_ui.cc b/chrome/browser/ui/webui/components_ui.cc
index a3a4fe9b..be13e83 100644
--- a/chrome/browser/ui/webui/components_ui.cc
+++ b/chrome/browser/ui/webui/components_ui.cc

@@ -183,12 +183,14 @@
   for (size_t j = 0; j < component_ids.size(); ++j) {
     update_client::CrxUpdateItem item;
     if (cus->GetComponentDetails(component_ids[j], &item)) {
-      std::unique_ptr<base::DictionaryValue> component_entry(
-          new base::DictionaryValue());
+      auto component_entry = std::make_unique<base::DictionaryValue>();
       component_entry->SetString("id", component_ids[j]);
-      component_entry->SetString("name", item.component.name);
-      component_entry->SetString("version", item.component.version.GetString());
       component_entry->SetString("status", ServiceStatusToString(item.state));
+      if (item.component) {
+        component_entry->SetString("name", item.component->name);
+        component_entry->SetString("version",
+                                   item.component->version.GetString());
+      }
       component_list->Append(std::move(component_entry));
     }
   }
@@ -266,8 +268,8 @@
     if (event == Events::COMPONENT_UPDATED) {
       auto* component_updater = g_browser_process->component_updater();
       update_client::CrxUpdateItem item;
-      if (component_updater->GetComponentDetails(id, &item))
-        parameters.SetString("version", item.component.version.GetString());
+      if (component_updater->GetComponentDetails(id, &item) && item.component)
+        parameters.SetString("version", item.component->version.GetString());
     }
     parameters.SetString("id", id);
   }

diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 563b0c5..8d9a7b0 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc

@@ -2595,8 +2595,6 @@
        IDS_SETTINGS_MULTIDEVICE_INSTANT_TETHERING},
       {"multideviceAndroidMessagesItemTitle",
        IDS_SETTINGS_MULTIDEVICE_ANDROID_MESSAGES},
-      {"multideviceAndroidMessagesItemSummary",
-       IDS_SETTINGS_MULTIDEVICE_ANDROID_MESSAGES_SUMMARY},
       {"multideviceForgetDevice", IDS_SETTINGS_MULTIDEVICE_FORGET_THIS_DEVICE},
       {"multideviceForgetDeviceSummary",
        IDS_SETTINGS_MULTIDEVICE_FORGET_THIS_DEVICE_EXPLANATION},
@@ -2628,6 +2626,11 @@
       l10n_util::GetStringFUTF16(
           IDS_SETTINGS_MULTIDEVICE_SMART_LOCK_SUMMARY,
           GetHelpUrlWithBoard(chrome::kEasyUnlockLearnMoreUrl)));
+  html_source->AddString(
+      "multideviceAndroidMessagesItemSummary",
+      l10n_util::GetStringFUTF16(
+          IDS_SETTINGS_MULTIDEVICE_ANDROID_MESSAGES_SUMMARY,
+          GetHelpUrlWithBoard(chrome::kAndroidMessagesLearnMoreURL)));
 }
 #endif
 

diff --git a/chrome/browser/usb/usb_blocklist.cc b/chrome/browser/usb/usb_blocklist.cc
index 954c87c..8e52437 100644
--- a/chrome/browser/usb/usb_blocklist.cc
+++ b/chrome/browser/usb/usb_blocklist.cc

@@ -10,6 +10,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "components/variations/variations_associated_data.h"
+#include "device/usb/public/mojom/device.mojom.h"
 #include "device/usb/usb_device.h"
 
 namespace {
@@ -129,6 +130,15 @@
                           device->device_version()));
 }
 
+bool UsbBlocklist::IsExcluded(
+    const device::mojom::UsbDeviceInfo& device_info) const {
+  uint16_t device_version = device_info.device_version_major << 8 |
+                            device_info.device_version_minor << 4 |
+                            device_info.device_version_subminor;
+  return IsExcluded(
+      Entry(device_info.vendor_id, device_info.product_id, device_version));
+}
+
 void UsbBlocklist::ResetToDefaultValuesForTest() {
   dynamic_entries_.clear();
   PopulateWithServerProvidedValues();

diff --git a/chrome/browser/usb/usb_blocklist.h b/chrome/browser/usb/usb_blocklist.h
index 643f285a..b277180b 100644
--- a/chrome/browser/usb/usb_blocklist.h
+++ b/chrome/browser/usb/usb_blocklist.h

@@ -15,6 +15,10 @@
 
 namespace device {
 class UsbDevice;
+
+namespace mojom {
+class UsbDeviceInfo;
+}
 }
 
 class UsbBlocklist final {
@@ -43,6 +47,7 @@
   // Returns if a device is excluded from access.
   bool IsExcluded(const Entry& entry) const;
   bool IsExcluded(const scoped_refptr<const device::UsbDevice>& device) const;
+  bool IsExcluded(const device::mojom::UsbDeviceInfo& device_info) const;
 
   // Size of the blocklist.
   size_t GetDynamicEntryCountForTest() const { return dynamic_entries_.size(); }

diff --git a/chrome/browser/usb/usb_chooser_context.cc b/chrome/browser/usb/usb_chooser_context.cc
index 7ded789..8fc8340 100644
--- a/chrome/browser/usb/usb_chooser_context.cc
+++ b/chrome/browser/usb/usb_chooser_context.cc

@@ -13,6 +13,7 @@
 #include "base/values.h"
 #include "chrome/browser/profiles/profile.h"
 #include "device/base/device_client.h"
+#include "device/usb/mojo/type_converters.h"
 #include "device/usb/public/mojom/device.mojom.h"
 #include "device/usb/usb_device.h"
 
@@ -163,14 +164,14 @@
 bool UsbChooserContext::HasDevicePermission(
     const GURL& requesting_origin,
     const GURL& embedding_origin,
-    scoped_refptr<const device::UsbDevice> device) {
+    const device::mojom::UsbDeviceInfo& device_info) {
   if (!CanRequestObjectPermission(requesting_origin, embedding_origin))
     return false;
 
   auto it = ephemeral_devices_.find(
       std::make_pair(requesting_origin, embedding_origin));
   if (it != ephemeral_devices_.end() &&
-      base::ContainsKey(it->second, device->guid())) {
+      base::ContainsKey(it->second, device_info.guid)) {
     return true;
   }
 
@@ -182,11 +183,11 @@
     int product_id;
     base::string16 serial_number;
     if (device_dict->GetInteger(kVendorIdKey, &vendor_id) &&
-        device->vendor_id() == vendor_id &&
+        device_info.vendor_id == vendor_id &&
         device_dict->GetInteger(kProductIdKey, &product_id) &&
-        device->product_id() == product_id &&
+        device_info.product_id == product_id &&
         device_dict->GetString(kSerialNumberKey, &serial_number) &&
-        device->serial_number() == serial_number) {
+        device_info.serial_number == serial_number) {
       return true;
     }
   }
@@ -194,6 +195,20 @@
   return false;
 }
 
+bool UsbChooserContext::HasDevicePermission(
+    const GURL& requesting_origin,
+    const GURL& embedding_origin,
+    scoped_refptr<const device::UsbDevice> device) {
+  if (!device)
+    return false;
+
+  device::mojom::UsbDeviceInfoPtr device_info =
+      device::mojom::UsbDeviceInfo::From(*device);
+  DCHECK(device_info);
+
+  return HasDevicePermission(requesting_origin, embedding_origin, *device_info);
+}
+
 base::WeakPtr<UsbChooserContext> UsbChooserContext::AsWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }

diff --git a/chrome/browser/usb/usb_chooser_context.h b/chrome/browser/usb/usb_chooser_context.h
index 7aeaa73..6a234bf6 100644
--- a/chrome/browser/usb/usb_chooser_context.h
+++ b/chrome/browser/usb/usb_chooser_context.h

@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_USB_USB_CHOOSER_CONTEXT_H_
 
 #include <map>
+#include <memory>
 #include <set>
 #include <string>
 #include <utility>
@@ -18,6 +19,10 @@
 
 namespace device {
 class UsbDevice;
+
+namespace mojom {
+class UsbDeviceInfo;
+}
 }
 
 class UsbChooserContext : public ChooserContextBase,
@@ -47,6 +52,10 @@
   // access to a device with |device_info|.
   bool HasDevicePermission(const GURL& requesting_origin,
                            const GURL& embedding_origin,
+                           const device::mojom::UsbDeviceInfo& device_info);
+
+  bool HasDevicePermission(const GURL& requesting_origin,
+                           const GURL& embedding_origin,
                            scoped_refptr<const device::UsbDevice> device);
 
   base::WeakPtr<UsbChooserContext> AsWeakPtr();

diff --git a/chrome/browser/usb/usb_chooser_controller.cc b/chrome/browser/usb/usb_chooser_controller.cc
index 0c334919..5278d704 100644
--- a/chrome/browser/usb/usb_chooser_controller.cc
+++ b/chrome/browser/usb/usb_chooser_controller.cc

@@ -25,7 +25,6 @@
 #include "device/usb/mojo/type_converters.h"
 #include "device/usb/public/cpp/filter_utils.h"
 #include "device/usb/usb_device.h"
-#include "device/usb/usb_ids.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "url/gurl.h"
 
@@ -125,13 +124,15 @@
 }
 
 bool UsbChooserController::IsPaired(size_t index) const {
-  scoped_refptr<UsbDevice> device = devices_[index].first;
-
   if (!chooser_context_)
     return false;
 
+  auto device_info = device::mojom::UsbDeviceInfo::From(*devices_[index].first);
+  DCHECK(device_info);
+
   return WebUSBPermissionProvider::HasDevicePermission(
-      chooser_context_.get(), requesting_origin_, embedding_origin_, device);
+      chooser_context_.get(), requesting_origin_, embedding_origin_,
+      *device_info);
 }
 
 void UsbChooserController::Select(const std::vector<size_t>& indices) {

diff --git a/chrome/browser/usb/web_usb_permission_provider.cc b/chrome/browser/usb/web_usb_permission_provider.cc
index 4deb803..28c0a2a 100644
--- a/chrome/browser/usb/web_usb_permission_provider.cc
+++ b/chrome/browser/usb/web_usb_permission_provider.cc

@@ -16,7 +16,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
-#include "device/usb/usb_device.h"
 
 using content::RenderFrameHost;
 using content::WebContents;
@@ -26,14 +25,14 @@
     UsbChooserContext* chooser_context,
     const GURL& requesting_origin,
     const GURL& embedding_origin,
-    scoped_refptr<const device::UsbDevice> device) {
+    const device::mojom::UsbDeviceInfo& device_info) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
-  if (UsbBlocklist::Get().IsExcluded(device))
+  if (UsbBlocklist::Get().IsExcluded(device_info))
     return false;
 
   return chooser_context->HasDevicePermission(requesting_origin,
-                                              embedding_origin, device);
+                                              embedding_origin, device_info);
 }
 
 WebUSBPermissionProvider::WebUSBPermissionProvider(
@@ -51,7 +50,7 @@
 }
 
 bool WebUSBPermissionProvider::HasDevicePermission(
-    scoped_refptr<const device::UsbDevice> device) const {
+    const device::mojom::UsbDeviceInfo& device_info) const {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
   WebContents* web_contents =
@@ -63,7 +62,7 @@
   return HasDevicePermission(
       UsbChooserContextFactory::GetForProfile(profile),
       render_frame_host_->GetLastCommittedURL().GetOrigin(),
-      main_frame->GetLastCommittedURL().GetOrigin(), device);
+      main_frame->GetLastCommittedURL().GetOrigin(), device_info);
 }
 
 void WebUSBPermissionProvider::IncrementConnectionCount() {

diff --git a/chrome/browser/usb/web_usb_permission_provider.h b/chrome/browser/usb/web_usb_permission_provider.h
index 5fd2e6d..9b03884 100644
--- a/chrome/browser/usb/web_usb_permission_provider.h
+++ b/chrome/browser/usb/web_usb_permission_provider.h

@@ -14,6 +14,12 @@
 class RenderFrameHost;
 }
 
+namespace device {
+namespace mojom {
+class UsbDeviceInfo;
+}
+}  // namespace device
+
 class GURL;
 class UsbChooserContext;
 
@@ -27,7 +33,7 @@
       UsbChooserContext* chooser_context,
       const GURL& requesting_origin,
       const GURL& embedding_origin,
-      scoped_refptr<const device::UsbDevice> device);
+      const device::mojom::UsbDeviceInfo& device_info);
 
   explicit WebUSBPermissionProvider(
       content::RenderFrameHost* render_frame_host);
@@ -37,7 +43,7 @@
 
   // device::usb::PermissionProvider implementation.
   bool HasDevicePermission(
-      scoped_refptr<const device::UsbDevice> device) const override;
+      const device::mojom::UsbDeviceInfo& device_info) const override;
   void IncrementConnectionCount() override;
   void DecrementConnectionCount() override;
 

diff --git a/chrome/browser/usb/web_usb_service_impl.cc b/chrome/browser/usb/web_usb_service_impl.cc
index 3218a27..1ed6617 100644
--- a/chrome/browser/usb/web_usb_service_impl.cc
+++ b/chrome/browser/usb/web_usb_service_impl.cc

@@ -34,8 +34,7 @@
   // Bind |device_manager_| to UsbDeviceManager and set error handler.
   // TODO(donna.wu@intel.com): Request UsbDeviceManagerPtr from the Device
   // Service after moving //device/usb to //services/device.
-  device::usb::DeviceManagerImpl::Create(permission_provider_,
-                                         mojo::MakeRequest(&device_manager_));
+  device::usb::DeviceManagerImpl::Create(mojo::MakeRequest(&device_manager_));
   device_manager_.set_connection_error_handler(base::BindOnce(
       &WebUsbServiceImpl::OnConnectionError, base::Unretained(this)));
   // Listen for add/remove device events from UsbService.
@@ -52,14 +51,30 @@
 WebUsbServiceImpl::~WebUsbServiceImpl() = default;
 
 void WebUsbServiceImpl::GetDevices(GetDevicesCallback callback) {
-  device_manager_->GetDevices(nullptr, std::move(callback));
+  device_manager_->GetDevices(
+      nullptr, base::BindOnce(&WebUsbServiceImpl::OnGetDevices,
+                              weak_factory_.GetWeakPtr(), std::move(callback)));
+}
+
+void WebUsbServiceImpl::OnGetDevices(
+    GetDevicesCallback callback,
+    std::vector<device::mojom::UsbDeviceInfoPtr> device_info_list) {
+  std::vector<device::mojom::UsbDeviceInfoPtr> device_infos;
+  for (auto& device_info : device_info_list) {
+    if (device_info && permission_provider_ &&
+        permission_provider_->HasDevicePermission(*device_info)) {
+      device_infos.push_back(device_info.Clone());
+    }
+  }
+  std::move(callback).Run(std::move(device_infos));
 }
 
 void WebUsbServiceImpl::GetDevice(
     const std::string& guid,
     device::mojom::UsbDeviceRequest device_request) {
   // Try to bind with the new device to be created for DeviceOpened/Closed
-  // events.
+  // events. It is safe to pass this request directly to |device_manager_|
+  // because |guid| is unguessable.
   device::mojom::UsbDeviceClientPtr device_client;
   device_client_bindings_.AddBinding(this, mojo::MakeRequest(&device_client));
   device_manager_->GetDevice(guid, std::move(device_request),
@@ -81,17 +96,21 @@
 }
 
 void WebUsbServiceImpl::OnDeviceAdded(scoped_refptr<device::UsbDevice> device) {
+  auto device_info = device::mojom::UsbDeviceInfo::From(*device);
+  DCHECK(device_info);
   if (client_ && permission_provider_ &&
-      permission_provider_->HasDevicePermission(device)) {
-    client_->OnDeviceAdded(device::mojom::UsbDeviceInfo::From(*device));
+      permission_provider_->HasDevicePermission(*device_info)) {
+    client_->OnDeviceAdded(std::move(device_info));
   }
 }
 
 void WebUsbServiceImpl::OnDeviceRemoved(
     scoped_refptr<device::UsbDevice> device) {
+  auto device_info = device::mojom::UsbDeviceInfo::From(*device);
+  DCHECK(device_info);
   if (client_ && permission_provider_ &&
-      permission_provider_->HasDevicePermission(device)) {
-    client_->OnDeviceRemoved(device::mojom::UsbDeviceInfo::From(*device));
+      permission_provider_->HasDevicePermission(*device_info)) {
+    client_->OnDeviceRemoved(std::move(device_info));
   }
 }
 

diff --git a/chrome/browser/usb/web_usb_service_impl.h b/chrome/browser/usb/web_usb_service_impl.h
index 9dc24d9..01b7c74d 100644
--- a/chrome/browser/usb/web_usb_service_impl.h
+++ b/chrome/browser/usb/web_usb_service_impl.h

@@ -52,6 +52,10 @@
       GetPermissionCallback callback) override;
   void SetClient(device::mojom::UsbDeviceManagerClientPtr client) override;
 
+  void OnGetDevices(
+      GetDevicesCallback callback,
+      std::vector<device::mojom::UsbDeviceInfoPtr> device_info_list);
+
   // device::UsbService::Observer implementation:
   void OnDeviceAdded(scoped_refptr<device::UsbDevice> device) override;
   void OnDeviceRemoved(scoped_refptr<device::UsbDevice> device) override;

diff --git a/chrome/browser/vr/service/xr_runtime_manager.cc b/chrome/browser/vr/service/xr_runtime_manager.cc
index d32601c..55038de 100644
--- a/chrome/browser/vr/service/xr_runtime_manager.cc
+++ b/chrome/browser/vr/service/xr_runtime_manager.cc

@@ -153,8 +153,7 @@
 }
 
 bool XRRuntimeManager::HasAnyRuntime() {
-  device::mojom::XRSessionOptions options = device::mojom::XRSessionOptions();
-  return GetRuntimeForOptions(&options) != nullptr;
+  return runtimes_.size() > 0;
 }
 
 bool XRRuntimeManager::HasInstance() {

diff --git a/chrome/browser/web_applications/bookmark_apps/BUILD.gn b/chrome/browser/web_applications/bookmark_apps/BUILD.gn
index e82bc38..f46136e 100644
--- a/chrome/browser/web_applications/bookmark_apps/BUILD.gn
+++ b/chrome/browser/web_applications/bookmark_apps/BUILD.gn

@@ -35,6 +35,7 @@
   deps = [
     ":bookmark_apps",
     "//chrome/browser/web_applications:web_app_group",
+    "//chrome/browser/web_applications/components:test_support",
     "//skia",
     "//testing/gmock",
   ]

diff --git a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc
index 6a992ee..bc36a6d 100644
--- a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc
+++ b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc

@@ -13,6 +13,7 @@
 #include "chrome/browser/prefs/browser_prefs.h"
 #include "chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_constants.h"
 #include "chrome/browser/web_applications/components/pending_app_manager.h"
+#include "chrome/browser/web_applications/components/test_pending_app_manager.h"
 #include "chrome/common/pref_names.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "content/public/test/test_browser_thread_bundle.h"
@@ -41,28 +42,6 @@
   DISALLOW_COPY_AND_ASSIGN(WebAppPolicyManagerTest);
 };
 
-class TestPendingAppManager : public PendingAppManager {
- public:
-  TestPendingAppManager() = default;
-  ~TestPendingAppManager() override = default;
-
-  void Install(AppInfo app_to_install,
-               PendingAppManager::OnceInstallCallback callback) override {}
-
-  void InstallApps(std::vector<AppInfo> apps_to_install,
-                   const RepeatingInstallCallback& callback) override {
-    last_apps_to_install_ = std::move(apps_to_install);
-  }
-
-  const std::vector<AppInfo>& last_apps_to_install() {
-    return last_apps_to_install_;
-  }
-
- private:
-  std::vector<AppInfo> last_apps_to_install_;
-
-  DISALLOW_COPY_AND_ASSIGN(TestPendingAppManager);
-};
 
 TEST_F(WebAppPolicyManagerTest, NoForceInstalledAppsPrefValue) {
   auto prefs = std::make_unique<TestingPrefServiceSyncable>();
@@ -73,7 +52,7 @@
                                              pending_app_manager.get());
   base::RunLoop().RunUntilIdle();
 
-  const auto& apps_to_install = pending_app_manager->last_apps_to_install();
+  const auto& apps_to_install = pending_app_manager->installed_apps();
   EXPECT_TRUE(apps_to_install.empty());
 }
 
@@ -89,7 +68,7 @@
                                              pending_app_manager.get());
   base::RunLoop().RunUntilIdle();
 
-  const auto& apps_to_install = pending_app_manager->last_apps_to_install();
+  const auto& apps_to_install = pending_app_manager->installed_apps();
   EXPECT_TRUE(apps_to_install.empty());
 }
 
@@ -119,7 +98,7 @@
                                              pending_app_manager.get());
   base::RunLoop().RunUntilIdle();
 
-  const auto& apps_to_install = pending_app_manager->last_apps_to_install();
+  const auto& apps_to_install = pending_app_manager->installed_apps();
 
   std::vector<PendingAppManager::AppInfo> expected_apps_to_install;
   expected_apps_to_install.emplace_back(

diff --git a/chrome/browser/web_applications/components/BUILD.gn b/chrome/browser/web_applications/components/BUILD.gn
index 5818e46..4963eeb 100644
--- a/chrome/browser/web_applications/components/BUILD.gn
+++ b/chrome/browser/web_applications/components/BUILD.gn

@@ -40,11 +40,26 @@
 
   deps = [
     "//chrome/browser/web_applications:web_app_group",
+    "//chrome/common",
     "//content/public/browser",
     "//skia",
   ]
 }
 
+static_library("test_support") {
+  testonly = true
+
+  sources = [
+    "test_pending_app_manager.cc",
+    "test_pending_app_manager.h",
+  ]
+
+  deps = [
+    ":components",
+    "//base",
+  ]
+}
+
 source_set("unit_tests") {
   testonly = true
 

diff --git a/chrome/browser/web_applications/components/test_pending_app_manager.cc b/chrome/browser/web_applications/components/test_pending_app_manager.cc
new file mode 100644
index 0000000..71f0aff
--- /dev/null
+++ b/chrome/browser/web_applications/components/test_pending_app_manager.cc

@@ -0,0 +1,36 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/web_applications/components/test_pending_app_manager.h"
+
+#include "base/callback.h"
+#include "url/gurl.h"
+
+namespace web_app {
+
+namespace {
+const char kFakeAppId[] = "lolcjfkgbenioifhfnehnlkogckoebae";
+}  // namespace
+
+TestPendingAppManager::TestPendingAppManager() = default;
+
+TestPendingAppManager::~TestPendingAppManager() = default;
+
+void TestPendingAppManager::Install(AppInfo app_to_install,
+                                    OnceInstallCallback callback) {
+  // TODO(jlklein): Add error simulation when error codes are added to the API.
+  // Copy the URL before moving it so it can be passed in the callback.
+  const GURL url(app_to_install.url);
+  installed_apps_.push_back(std::move(app_to_install));
+  std::move(callback).Run(url, std::string(kFakeAppId));
+}
+
+void TestPendingAppManager::InstallApps(
+    std::vector<AppInfo> apps_to_install,
+    const RepeatingInstallCallback& callback) {
+  for (auto& app : apps_to_install)
+    Install(std::move(app), callback);
+}
+
+}  // namespace web_app

diff --git a/chrome/browser/web_applications/components/test_pending_app_manager.h b/chrome/browser/web_applications/components/test_pending_app_manager.h
new file mode 100644
index 0000000..6d900f0
--- /dev/null
+++ b/chrome/browser/web_applications/components/test_pending_app_manager.h

@@ -0,0 +1,35 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_WEB_APPLICATIONS_COMPONENTS_TEST_PENDING_APP_MANAGER_H_
+#define CHROME_BROWSER_WEB_APPLICATIONS_COMPONENTS_TEST_PENDING_APP_MANAGER_H_
+
+#include <string>
+#include <vector>
+
+#include "base/macros.h"
+#include "chrome/browser/web_applications/components/pending_app_manager.h"
+
+namespace web_app {
+
+class TestPendingAppManager : public PendingAppManager {
+ public:
+  TestPendingAppManager();
+  ~TestPendingAppManager() override;
+  const std::vector<AppInfo>& installed_apps() const { return installed_apps_; }
+
+  // PendingAppManager:
+  void Install(AppInfo app_to_install, OnceInstallCallback callback) override;
+  void InstallApps(std::vector<AppInfo> apps_to_install,
+                   const RepeatingInstallCallback& callback) override;
+
+ private:
+  std::vector<AppInfo> installed_apps_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestPendingAppManager);
+};
+
+}  // namespace web_app
+
+#endif  // CHROME_BROWSER_WEB_APPLICATIONS_COMPONENTS_TEST_PENDING_APP_MANAGER_H_

diff --git a/chrome/browser/web_applications/components/web_app_shortcut_linux.cc b/chrome/browser/web_applications/components/web_app_shortcut_linux.cc
index 51b34ed..53250a0 100644
--- a/chrome/browser/web_applications/components/web_app_shortcut_linux.cc
+++ b/chrome/browser/web_applications/components/web_app_shortcut_linux.cc

@@ -22,6 +22,7 @@
 #include "chrome/browser/shell_integration_linux.h"
 #include "chrome/browser/web_applications/components/web_app_helpers.h"
 #include "chrome/browser/web_applications/components/web_app_shortcut.h"
+#include "chrome/common/buildflags.h"
 #include "chrome/common/chrome_constants.h"
 
 namespace {

diff --git a/chrome/browser/webauthn/authenticator_request_dialog_model.cc b/chrome/browser/webauthn/authenticator_request_dialog_model.cc
index 4f25b871..5f58324 100644
--- a/chrome/browser/webauthn/authenticator_request_dialog_model.cc
+++ b/chrome/browser/webauthn/authenticator_request_dialog_model.cc

@@ -45,6 +45,9 @@
     case AuthenticatorTransport::kInternal:
       SetCurrentStep(Step::kTouchId);
       break;
+    case AuthenticatorTransport::kCloudAssistedBluetoothLowEnergy:
+      SetCurrentStep(Step::kCableActivate);
+      break;
     default:
       break;
   }

diff --git a/chrome/browser/webauthn/authenticator_request_dialog_model.h b/chrome/browser/webauthn/authenticator_request_dialog_model.h
index 6168d6bf..290ee5f 100644
--- a/chrome/browser/webauthn/authenticator_request_dialog_model.h
+++ b/chrome/browser/webauthn/authenticator_request_dialog_model.h

@@ -46,6 +46,9 @@
 
     // Touch ID.
     kTouchId,
+
+    // Phone as a security key.
+    kCableActivate,
   };
 
   // Encapsulates information about authenticators that have been found but are

diff --git a/chrome/common/url_constants.cc b/chrome/common/url_constants.cc
index cbe63df..3fd2fb69 100644
--- a/chrome/common/url_constants.cc
+++ b/chrome/common/url_constants.cc

@@ -270,6 +270,9 @@
 const char kMultiDeviceLearnMoreURL[] =
     "https://support.google.com/chromebook?p=multidevice-placeholder";
 
+const char kAndroidMessagesLearnMoreURL[] =
+    "https://support.google.com/chromebook?p=messages-for-web-placeholder";
+
 const char kLanguageSettingsLearnMoreUrl[] =
     "https://support.google.com/chromebook/answer/1059490";
 

diff --git a/chrome/common/url_constants.h b/chrome/common/url_constants.h
index e98daf83..06456d6 100644
--- a/chrome/common/url_constants.h
+++ b/chrome/common/url_constants.h

@@ -225,6 +225,9 @@
 // The URL for the "Learn more" link in the connected devices.
 extern const char kMultiDeviceLearnMoreURL[];
 
+// The URL for the "Learn more" link for Android Messages.
+extern const char kAndroidMessagesLearnMoreURL[];
+
 // The URL for the "Learn more" link in the language settings.
 extern const char kLanguageSettingsLearnMoreUrl[];
 

diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index dfabe32..3a402fc 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc

@@ -87,6 +87,7 @@
 #include "components/subresource_filter/content/renderer/unverified_ruleset_dealer.h"
 #include "components/subresource_filter/core/common/common_features.h"
 #include "components/task_scheduler_util/variations_util.h"
+#include "components/variations/net/variations_http_headers.h"
 #include "components/variations/variations_switches.h"
 #include "components/version_info/version_info.h"
 #include "components/visitedlink/renderer/visitedlink_slave.h"
@@ -1626,6 +1627,11 @@
 #endif
 }
 
+bool ChromeContentRendererClient::IsExcludedHeaderForServiceWorkerFetchEvent(
+    const std::string& header_name) {
+  return header_name == variations::kClientDataHeader;
+}
+
 // If we're in an extension, there is no need disabling multiple routes as
 // chrome.system.network.getNetworkInterfaces provides the same
 // information. Also, the enforcement of sending and binding UDP is already done

diff --git a/chrome/renderer/chrome_content_renderer_client.h b/chrome/renderer/chrome_content_renderer_client.h
index 53785d89..9cd2609 100644
--- a/chrome/renderer/chrome_content_renderer_client.h
+++ b/chrome/renderer/chrome_content_renderer_client.h

@@ -219,6 +219,8 @@
       int64_t service_worker_version_id,
       const GURL& service_worker_scope,
       const GURL& script_url) override;
+  bool IsExcludedHeaderForServiceWorkerFetchEvent(
+      const std::string& header_name) override;
   bool ShouldEnforceWebRTCRoutingPreferences() override;
   GURL OverrideFlashEmbedWithHTML(const GURL& url) override;
   std::unique_ptr<base::TaskScheduler::InitParams> GetTaskSchedulerInitParams()

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 5b5176f..8f5d4151 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -4513,6 +4513,8 @@
       "../browser/ui/app_list/search/arc/arc_app_shortcuts_search_provider_unittest.cc",
       "../browser/ui/app_list/search/arc/arc_playstore_search_provider_unittest.cc",
       "../browser/ui/app_list/search/launcher_search/launcher_search_icon_image_loader_unittest.cc",
+      "../browser/ui/app_list/search/search_result_ranker/app_launch_predictor_unittest.cc",
+      "../browser/ui/app_list/search/search_result_ranker/app_search_result_ranker_unittest.cc",
       "../browser/ui/app_list/search/settings_shortcut/settings_shortcut_provider_unittest.cc",
       "../browser/ui/app_list/search/settings_shortcut/settings_shortcut_result_unittest.cc",
       "../browser/ui/app_list/search/tests/app_search_provider_unittest.cc",

diff --git a/chrome/test/data/webui/md_history/md_history_browsertest.js b/chrome/test/data/webui/md_history/md_history_browsertest.js
index 33f64825..362b09e 100644
--- a/chrome/test/data/webui/md_history/md_history_browsertest.js
+++ b/chrome/test/data/webui/md_history/md_history_browsertest.js

@@ -82,12 +82,9 @@
   ]),
 };
 
-// https://crbug.com/874976, fails on Mac.
-GEN('#if !defined(OS_MACOSX)');
 TEST_F('MaterialHistoryItemTest', 'All', function() {
   mocha.run();
 });
-GEN('#endif');
 
 function MaterialHistoryListTest() {}
 

diff --git a/chrome/test/data/webui/print_preview/new_print_preview_ui_browsertest.js b/chrome/test/data/webui/print_preview/new_print_preview_ui_browsertest.js
index a4289dd1..6fb8e5d 100644
--- a/chrome/test/data/webui/print_preview/new_print_preview_ui_browsertest.js
+++ b/chrome/test/data/webui/print_preview/new_print_preview_ui_browsertest.js

@@ -192,6 +192,30 @@
   this.runMochaTest(settings_select_test.TestNames.CustomMediaNames);
 });
 
+PrintPreviewSelectBehaviorTest = class extends NewPrintPreviewTest {
+  /** @override */
+  get browsePreload() {
+    return 'chrome://print/new/select_behavior.html';
+  }
+
+  /** @override */
+  get extraLibraries() {
+    return super.extraLibraries.concat([
+      '../settings/test_util.js',
+      'select_behavior_test.js',
+    ]);
+  }
+
+  /** @override */
+  get suiteName() {
+    return select_behavior_test.suiteName;
+  }
+};
+
+TEST_F('PrintPreviewSelectBehaviorTest', 'CallProcessSelectChange', function() {
+  this.runMochaTest(select_behavior_test.TestNames.CallProcessSelectChange);
+});
+
 PrintPreviewNumberSettingsSectionTest = class extends NewPrintPreviewTest {
   /** @override */
   get browsePreload() {

diff --git a/chrome/test/data/webui/print_preview/select_behavior_test.js b/chrome/test/data/webui/print_preview/select_behavior_test.js
new file mode 100644
index 0000000..4d8166e
--- /dev/null
+++ b/chrome/test/data/webui/print_preview/select_behavior_test.js

@@ -0,0 +1,85 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+cr.define('select_behavior_test', function() {
+  /** @enum {string} */
+  const TestNames = {
+    CallProcessSelectChange: 'call process select change',
+  };
+
+  const suiteName = 'SelectBehaviorTest';
+  suite(suiteName, function() {
+    /** @type {?TestSelectElement} */
+    let testSelect = null;
+
+    /** @type {string} */
+    let settingValue = '0';
+
+    /** @override */
+    suiteSetup(function() {
+      document.body.innerHTML = `
+        <dom-module id="test-select">
+          <template>
+            <select value="{{selectedValue::change}}">
+              <option value="0" selected>0</option>
+              <option value="1">1</option>
+              <option value="2">2</option>
+            </select>
+          </template>
+        </dom-module>
+      `;
+
+      Polymer({
+        is: 'test-select',
+        behaviors: [print_preview_new.SelectBehavior],
+
+        onProcessSelectChange: function(value) {
+          settingValue = value;
+          this.fire('process-select-change-called', value);
+        },
+      });
+    });
+
+    /** @override */
+    setup(function() {
+      PolymerTest.clearBody();
+      testSelect = document.createElement('test-select');
+      document.body.appendChild(testSelect);
+      testSelect.selectedValue = '0';
+    });
+
+    // Tests that onProcessSelectChange() is called when the select value is
+    // set programmatically or by changing the select element.
+    test(assert(TestNames.CallProcessSelectChange), function() {
+      const select = testSelect.$$('select');
+      assertEquals('0', testSelect.selectedValue);
+      assertEquals('0', select.value);
+      let whenProcessSelectCalled =
+          test_util.eventToPromise('process-select-change-called', testSelect);
+      testSelect.selectedValue = '1';
+      // Should be debounced so settingValue has not changed yet.
+      assertEquals('0', settingValue);
+      return whenProcessSelectCalled
+          .then((e) => {
+            assertEquals('1', e.detail);
+            assertEquals('1', select.value);
+            whenProcessSelectCalled = test_util.eventToPromise(
+                'process-select-change-called', testSelect);
+            select.value = '0';
+            select.dispatchEvent(new CustomEvent('change'));
+            assertEquals('1', settingValue);
+            return whenProcessSelectCalled;
+          })
+          .then((e) => {
+            assertEquals('0', e.detail);
+            assertEquals('0', testSelect.selectedValue);
+          });
+    });
+  });
+
+  return {
+    suiteName: suiteName,
+    TestNames: TestNames,
+  };
+});

diff --git a/chrome/test/data/webui/settings/cr_settings_browsertest.js b/chrome/test/data/webui/settings/cr_settings_browsertest.js
index f45cb6b1..7ba9bf7 100644
--- a/chrome/test/data/webui/settings/cr_settings_browsertest.js
+++ b/chrome/test/data/webui/settings/cr_settings_browsertest.js

@@ -367,33 +367,6 @@
 
 /**
  * Test fixture for
- * chrome/browser/resources/settings/people_page/
- * fingerprint_dialog_progress_arc.html.
- *
- * This is ChromeOS only.
- * @constructor
- * @extends {CrSettingsBrowserTest}
- */
-function CrSettingsFingerprintProgressArcTest() {}
-
-CrSettingsFingerprintProgressArcTest.prototype = {
-  __proto__: CrSettingsBrowserTest.prototype,
-
-  /** @override */
-  browsePreload: 'chrome://settings/people_page/fingerprint_progress_arc.html',
-
-  /** @override */
-  extraLibraries: CrSettingsBrowserTest.prototype.extraLibraries.concat([
-    'fingerprint_progress_arc_browsertest_chromeos.js',
-  ]),
-};
-
-TEST_F('CrSettingsFingerprintProgressArcTest', 'All', function() {
-  mocha.run();
-});
-
-/**
- * Test fixture for
  * chrome/browser/resources/settings/people_page/fingerprint_list.html.
  *
  * This is ChromeOS only.

diff --git a/chrome/test/data/webui/settings/fingerprint_progress_arc_browsertest_chromeos.js b/chrome/test/data/webui/settings/fingerprint_progress_arc_browsertest_chromeos.js
deleted file mode 100644
index aebe51e..0000000
--- a/chrome/test/data/webui/settings/fingerprint_progress_arc_browsertest_chromeos.js
+++ /dev/null

@@ -1,211 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-suite('settings-fingerprint-progress-arc', function() {
-  /**
-   * An object descrbing a 2d point.
-   * @typedef {{
-   *   x: number,
-   *   y: number,
-   * }}
-   */
-  let Point;
-
-  /**
-   * An object descrbing a color with r, g and b values.
-   * @typedef {{
-   *   r: number,
-   *   g: number,
-   *   b: number,
-   * }}
-   */
-  let Color;
-
-  /** @type {?SettingsFingerprintProgressArcElement} */
-  let progressArc = null;
-
-  /** @type {?HTMLCanvasElement} */
-  let canvas = null;
-
-  /** @type {Color} */
-  const black = {r: 0, g: 0, b: 0};
-  /** @type {Color} */
-  const blue = {r: 0, g: 0, b: 255};
-  /** @type {Color} */
-  const white = {r: 255, g: 255, b: 255};
-
-  /**
-   * Helper function which gets the rgb values at |point| on the canvas.
-   * @param {Point} point
-   * @return {Color}
-   */
-  function getRGBData(point) {
-    const ctx = canvas.getContext('2d');
-    const pixel = ctx.getImageData(point.x, point.y, 1, 1).data;
-    return {r: pixel[0], g: pixel[1], b: pixel[2]};
-  }
-
-  /**
-   * Helper function which checks if the given color is white. This is used to
-   * test the shadows, where getting the exact color at a certain point is
-   * difficult, so we just check that it is not white.
-   * @param {Color} actualColor
-   */
-  function checkColorNotWhite(actualColor) {
-    assertNotEquals(white.r, actualColor.r);
-    assertNotEquals(white.g, actualColor.g);
-    assertNotEquals(white.b, actualColor.b);
-  }
-
-  /**
-   * Helper function which checks that a list of points are not white on the
-   * canvas.
-   * @param {!Array<Point>} listOfPoints
-   */
-  function checkListOfNotWhiteData(listOfPoints) {
-    for (let i = 0; i < listOfPoints.length; ++i)
-      checkColorNotWhite(getRGBData(listOfPoints[i]));
-  }
-
-  /**
-   * Helper function which checks if the given color is matches the expected
-   * color.
-   * @param {Color} expectedColor
-   * @param {Color} actualColor
-   */
-  function checkRGBData(expectedColor, actualColor) {
-    assertEquals(expectedColor.r, actualColor.r);
-    assertEquals(expectedColor.g, actualColor.g);
-    assertEquals(expectedColor.b, actualColor.b);
-  }
-
-  /**
-   * Helper function which checks that a list of points match the color the are
-   * expected to have on the canvas.
-   * @param {Color} expectedColor
-   * @param {!Array<Point>} listOfPoints
-   */
-  function checkListOfRGBData(expectedColor, listOfPoints) {
-    for (let i = 0; i < listOfPoints.length; ++i)
-      checkRGBData(expectedColor, getRGBData(listOfPoints[i]));
-  }
-
-  setup(function() {
-    PolymerTest.clearBody();
-    progressArc = document.createElement('settings-fingerprint-progress-arc');
-    canvas = progressArc.$.canvas;
-
-    // Override some parameters and function for testing purposes.
-    progressArc.canvasCircleRadius_ = 50;
-    progressArc.canvasCircleStrokeWidth_ = 3;
-    progressArc.canvasCircleBackgroundColor_ = 'rgba(0,0,0,1.0)';
-    progressArc.canvasCircleProgressColor_ = 'rgba(0,0,255,1.0)';
-    progressArc.canvasCircleShadowColor_ = 'rgba(0,0,0,1.0)';
-    progressArc.clearCanvas = function() {
-      const ctx = canvas.getContext('2d');
-      ctx.fillStyle = 'rgba(255,255,255,1.0)';
-      ctx.fillRect(0, 0, canvas.width, canvas.height);
-    };
-    progressArc.clearCanvas();
-
-    document.body.appendChild(progressArc);
-    Polymer.dom.flush();
-  });
-
-  test('TestDrawArc', function() {
-    // Verify that by drawing an arc from 0 to PI/2 with radius 50 and center at
-    // (150, 75), points along that arc should be blue, and points not on that
-    // arc should remain white.
-    progressArc.drawArc(0, Math.PI / 2, progressArc.canvasCircleProgressColor_);
-    /** @type {Array<Point>} */
-    let expectedPointsOnArc = [
-      {x: 200, y: 75} /* 0rad */, {x: 185, y: 110} /* PI/4rad */,
-      {x: 150, y: 125} /* PI/2rad */
-    ];
-    /** @type {Array<Point>} */
-    let expectedPointsNotOnArc =
-        [{x: 115, y: 110} /* 3PI/4rad */, {x: 100, y: 75} /* PI */];
-    checkListOfRGBData(blue, expectedPointsOnArc);
-    checkListOfRGBData(white, expectedPointsNotOnArc);
-
-    // After clearing, the points that were blue should be white.
-    progressArc.clearCanvas();
-    checkListOfRGBData(white, expectedPointsOnArc);
-
-    // Verify that by drawing an arc from 3PI/2 to 5PI/2 with radius 50 and
-    // center at (150, 75), points along that arc should be blue, and points not
-    // on that arc should remain white.
-    progressArc.drawArc(
-        3 * Math.PI / 2, 5 * Math.PI / 2,
-        progressArc.canvasCircleProgressColor_);
-    expectedPointsOnArc = [
-      {x: 150, y: 25} /* 3PI/2 */, {x: 185, y: 40} /* 7PI/4 */,
-      {x: 200, y: 75} /* 2PI */, {x: 185, y: 110} /* 9PI/4 */,
-      {x: 150, y: 125} /* 5PI/2rad */
-    ];
-    expectedPointsNotOnArc = [
-      {x: 115, y: 110} /* 3PI/4rad */, {x: 100, y: 75} /* PI */, {x: 115, y: 40}
-      /* 5PI/4 */
-    ];
-    checkListOfRGBData(blue, expectedPointsOnArc);
-    checkListOfRGBData(white, expectedPointsNotOnArc);
-  });
-
-  test('TestDrawBackgroundCircle', function() {
-    // Verify that by drawing an circle with radius 50 and center at (150, 75),
-    // points along that arc should be black, and points not on that arc should
-    // remain white.
-    progressArc.drawBackgroundCircle();
-    /** @type {Array<Point>} */
-    const expectedPointsInCircle = [
-      {x: 200, y: 75} /* 0rad */, {x: 150, y: 125} /* PI/2rad */,
-      {x: 100, y: 75} /* PIrad */, {x: 150, y: 25} /* 3PI/2rad */
-    ];
-    /** @type {Array<Point>} */
-    const expectedPointsNotInCircle = [
-      {x: 110, y: 75} /* Too left, outside of stroke */,
-      {x: 90, y: 75} /* Too right, inside of stroke */,
-      {x: 200, y: 100} /* Outside of circle */,
-      {x: 150, y: 75} /* In the center */
-    ];
-    checkListOfRGBData(black, expectedPointsInCircle);
-    checkListOfRGBData(white, expectedPointsNotInCircle);
-
-    // After clearing, the points that were black should be white.
-    progressArc.clearCanvas();
-    checkListOfRGBData(white, expectedPointsInCircle);
-  });
-
-  test('TestDrawShadow', function() {
-    // Verify that by drawing a shadow with radius 50 and center at (150,75)
-    // with blur 20, points that have distance between 50 and 70 from the center
-    // should not be white.
-    progressArc.drawShadow(20, 0, 0);
-    /** @type {Array<Point>} */
-    const expectedPointsInShadowBlur10 = [
-      {x: 210, y: 75} /* 0rad */, {x: 150, y: 135} /* PI/2rad */,
-      {x: 90, y: 75} /* PIrad */, {x: 150, y: 15} /* 3PI/2rad */
-    ];
-    /** @type {Array<Point>} */
-    const expectedPointsInShadowBlur20 = [
-      {x: 220, y: 75} /* 0rad */, {x: 150, y: 145} /* PI/2rad */,
-      {x: 80, y: 75} /* PIrad */, {x: 150, y: 5} /* 3PI/2rad */
-    ];
-
-    checkListOfNotWhiteData(expectedPointsInShadowBlur10);
-    checkListOfNotWhiteData(expectedPointsInShadowBlur20);
-
-    // After clearing, the points that were black should be white.
-    progressArc.clearCanvas();
-    checkListOfRGBData(white, expectedPointsInShadowBlur10);
-    checkListOfRGBData(white, expectedPointsInShadowBlur20);
-
-    // Verify that by drawing a shadow with radius 50 and center at (150,75)
-    // with blur 20, points that have distance between 50 and 60 from the center
-    // should not be white. Points greater than 60 distance should be white.
-    progressArc.drawShadow(10, 0, 0);
-    checkListOfNotWhiteData(expectedPointsInShadowBlur10);
-    checkListOfRGBData(white, expectedPointsInShadowBlur20);
-  });
-});

diff --git a/chromecast/base/statistics/weighted_mean.cc b/chromecast/base/statistics/weighted_mean.cc
index ed66f0f..e9fa9a2 100644
--- a/chromecast/base/statistics/weighted_mean.cc
+++ b/chromecast/base/statistics/weighted_mean.cc

@@ -4,16 +4,21 @@
 
 #include "chromecast/base/statistics/weighted_mean.h"
 
+#include <cmath>
+
 namespace chromecast {
 
 WeightedMean::WeightedMean()
-    : weighted_mean_(0), variance_sum_(0), sum_weights_(0) {}
-
-WeightedMean::~WeightedMean() {}
+    : weighted_mean_(0),
+      variance_sum_(0),
+      sum_weights_(0),
+      sum_squared_weights_(0) {}
 
 void WeightedMean::AddSample(int64_t value, double weight) {
   double old_sum_weights = sum_weights_;
   sum_weights_ += weight;
+  // Use std::abs() to handle negative weights (ie, removing a sample).
+  sum_squared_weights_ += weight * std::abs(weight);
   if (sum_weights_ == 0) {
     weighted_mean_ = 0;
     variance_sum_ = 0;

diff --git a/chromecast/base/statistics/weighted_mean.h b/chromecast/base/statistics/weighted_mean.h
index ffd087a..64a7145 100644
--- a/chromecast/base/statistics/weighted_mean.h
+++ b/chromecast/base/statistics/weighted_mean.h

@@ -14,12 +14,12 @@
 class WeightedMean {
  public:
   WeightedMean();
-  ~WeightedMean();
 
   double weighted_mean() const { return weighted_mean_; }
   // The weighted variance should be calculated as variance_sum()/sum_weights().
   double variance_sum() const { return variance_sum_; }
   double sum_weights() const { return sum_weights_; }
+  double sum_squared_weights() const { return sum_squared_weights_; }
 
   // Adds |value| to the mean if |weight| is positive. Removes |value| from
   // the mean if |weight| is negative. Has no effect if |weight| is 0.
@@ -29,6 +29,7 @@
   double weighted_mean_;
   double variance_sum_;
   double sum_weights_;
+  double sum_squared_weights_;
 };
 
 }  // namespace chromecast

diff --git a/chromecast/base/statistics/weighted_moving_average.cc b/chromecast/base/statistics/weighted_moving_average.cc
index 9be96a8d..b3df4b56a 100644
--- a/chromecast/base/statistics/weighted_moving_average.cc
+++ b/chromecast/base/statistics/weighted_moving_average.cc

@@ -40,7 +40,11 @@
     return false;
 
   *average = static_cast<int64_t>(round(mean_.weighted_mean()));
-  *error = sqrt(mean_.variance_sum() / mean_.sum_weights());
+
+  const double effective_sample_size =
+      mean_.sum_weights() * mean_.sum_weights() / mean_.sum_squared_weights();
+  const double variance = mean_.variance_sum() / mean_.sum_weights();
+  *error = sqrt(variance / effective_sample_size);
   return true;
 }
 

diff --git a/chromecast/base/statistics/weighted_moving_average_unittest.cc b/chromecast/base/statistics/weighted_moving_average_unittest.cc
index 8375605..3744b17a 100644
--- a/chromecast/base/statistics/weighted_moving_average_unittest.cc
+++ b/chromecast/base/statistics/weighted_moving_average_unittest.cc

@@ -53,7 +53,7 @@
   double error = 0;
   EXPECT_TRUE(averager.Average(&avg, &error));
   EXPECT_EQ(3, avg);
-  EXPECT_NEAR(sqrt(2), error, 1e-9);
+  EXPECT_NEAR(sqrt(2) / sqrt(5), error, 1e-9);
 }
 
 TEST(WeightedMovingAverageTest, Clear) {
@@ -65,7 +65,7 @@
   double error = 0;
   EXPECT_TRUE(averager.Average(&avg, &error));
   EXPECT_EQ(3, avg);
-  EXPECT_NEAR(sqrt(2), error, 1e-9);
+  EXPECT_NEAR(sqrt(2) / sqrt(5), error, 1e-9);
 
   averager.Clear();
   EXPECT_FALSE(averager.Average(&avg, &error));
@@ -77,7 +77,7 @@
   error = 0;
   EXPECT_TRUE(averager.Average(&avg, &error));
   EXPECT_EQ(3, avg);
-  EXPECT_NEAR(sqrt(2), error, 1e-9);
+  EXPECT_NEAR(sqrt(2) / sqrt(5), error, 1e-9);
 }
 
 TEST(WeightedMovingAverageTest, AverageSeveralWeightedValues) {
@@ -92,7 +92,9 @@
   double error = 0;
   EXPECT_TRUE(averager.Average(&avg, &error));
   EXPECT_EQ(3, avg);
-  EXPECT_NEAR(sqrt(3), error, 1e-9);
+  // <sum of weights>^2 / <sum of weights^2>
+  double effective_sample_size = 36.0 / 10.0;
+  EXPECT_NEAR(sqrt(3) / sqrt(effective_sample_size), error, 1e-9);
 }
 
 TEST(WeightedMovingAverageTest, DropOldValues) {
@@ -107,7 +109,7 @@
   double error = 0;
   EXPECT_TRUE(averager.Average(&avg, &error));
   EXPECT_EQ(2, avg);
-  EXPECT_DOUBLE_EQ(1.0, error);
+  EXPECT_DOUBLE_EQ(1.0 / sqrt(2), error);
 }
 
 TEST(WeightedMovingAverageTest, DropOldValuesUneven) {
@@ -122,7 +124,7 @@
   double error = 0;
   EXPECT_TRUE(averager.Average(&avg, &error));
   EXPECT_EQ(2, avg);
-  EXPECT_DOUBLE_EQ(1.0, error);
+  EXPECT_DOUBLE_EQ(1.0 / sqrt(2), error);
 }
 
 TEST(WeightedMovingAverageTest, DropOldValuesByAddingZeroWeightValues) {

diff --git a/chromecast/browser/BUILD.gn b/chromecast/browser/BUILD.gn
index fa7d4c7..62b9e42 100644
--- a/chromecast/browser/BUILD.gn
+++ b/chromecast/browser/BUILD.gn

@@ -77,8 +77,6 @@
     "network_context_manager.h",
     "pref_service_helper.cc",
     "pref_service_helper.h",
-    "renderer_config.cc",
-    "renderer_config.h",
     "renderer_prelauncher.cc",
     "renderer_prelauncher.h",
     "service/cast_service_simple.cc",
@@ -290,8 +288,8 @@
         "accessibility/accessibility_manager.cc",
         "accessibility/accessibility_manager.h",
         "accessibility/accessibility_sound_player.h",
-        "accessibility/accessibility_sound_proxy.h",
         "accessibility/accessibility_sound_proxy.cc",
+        "accessibility/accessibility_sound_proxy.h",
         "accessibility/touch_exploration_controller.cc",
         "accessibility/touch_exploration_controller.h",
         "accessibility/touch_exploration_manager.cc",
@@ -479,7 +477,6 @@
     "devtools/cast_devtools_manager_delegate_unittest.cc",
     "lru_renderer_cache_test.cc",
     "network_context_manager_unittest.cc",
-    "renderer_config_unittest.cc",
   ]
 
   deps = [

diff --git a/chromecast/browser/cast_content_browser_client.cc b/chromecast/browser/cast_content_browser_client.cc
index 6133c0a3..e2cb9ad6 100644
--- a/chromecast/browser/cast_content_browser_client.cc
+++ b/chromecast/browser/cast_content_browser_client.cc

@@ -37,7 +37,6 @@
 #include "chromecast/browser/devtools/cast_devtools_manager_delegate.h"
 #include "chromecast/browser/grit/cast_browser_resources.h"
 #include "chromecast/browser/media/media_caps_impl.h"
-#include "chromecast/browser/renderer_config.h"
 #include "chromecast/browser/service/cast_service_simple.h"
 #include "chromecast/browser/tts/tts_controller.h"
 #include "chromecast/browser/url_request_context_factory.h"
@@ -154,8 +153,7 @@
 
 CastContentBrowserClient::CastContentBrowserClient()
     : cast_browser_main_parts_(nullptr),
-      url_request_context_factory_(new URLRequestContextFactory()),
-      renderer_config_manager_(std::make_unique<RendererConfigManager>()) {}
+      url_request_context_factory_(new URLRequestContextFactory()) {}
 
 CastContentBrowserClient::~CastContentBrowserClient() {
   content::BrowserThread::DeleteSoon(content::BrowserThread::IO, FROM_HERE,
@@ -469,12 +467,6 @@
     }
 #endif  // defined(USE_AURA)
   }
-
-  auto renderer_config =
-      renderer_config_manager_->GetRendererConfig(child_process_id);
-  if (renderer_config) {
-    renderer_config->AppendSwitchesTo(command_line);
-  }
 }
 
 std::string CastContentBrowserClient::GetAcceptLangs(

diff --git a/chromecast/browser/cast_content_browser_client.h b/chromecast/browser/cast_content_browser_client.h
index 1e8a5d33..57bd7faf 100644
--- a/chromecast/browser/cast_content_browser_client.h
+++ b/chromecast/browser/cast_content_browser_client.h

@@ -61,7 +61,6 @@
 namespace shell {
 class CastBrowserMainParts;
 class CastResourceDispatcherHostDelegate;
-class RendererConfigManager;
 class URLRequestContextFactory;
 
 class CastContentBrowserClient : public content::ContentBrowserClient {
@@ -194,10 +193,6 @@
       content::NavigationHandle* navigation_handle) override;
   bool ShouldEnableStrictSiteIsolation() override;
 
-  RendererConfigManager* renderer_config_manager() const {
-    return renderer_config_manager_.get();
-  }
-
 #if BUILDFLAG(USE_CHROMECAST_CDMS)
   virtual std::unique_ptr<::media::CdmFactory> CreateCdmFactory();
 #endif  // BUILDFLAG(USE_CHROMECAST_CDMS)
@@ -248,7 +243,6 @@
   std::unique_ptr<CastResourceDispatcherHostDelegate>
       resource_dispatcher_host_delegate_;
   std::unique_ptr<media::CmaBackendFactory> cma_backend_factory_;
-  std::unique_ptr<RendererConfigManager> renderer_config_manager_;
 
   DISALLOW_COPY_AND_ASSIGN(CastContentBrowserClient);
 };

diff --git a/chromecast/browser/lru_renderer_cache.cc b/chromecast/browser/lru_renderer_cache.cc
index 552c8fd..e17760e 100644
--- a/chromecast/browser/lru_renderer_cache.cc
+++ b/chromecast/browser/lru_renderer_cache.cc

@@ -8,7 +8,6 @@
 
 #include "base/bind.h"
 #include "base/threading/sequenced_task_runner_handle.h"
-#include "chromecast/browser/renderer_config.h"
 #include "chromecast/browser/renderer_prelauncher.h"
 #include "content/public/browser/site_instance.h"
 
@@ -16,15 +15,12 @@
 
 LRURendererCache::LRURendererCache(
     content::BrowserContext* browser_context,
-    shell::RendererConfigManager* renderer_config_manager,
     size_t max_renderers)
     : browser_context_(browser_context),
-      renderer_config_manager_(renderer_config_manager),
       max_renderers_(max_renderers),
       in_use_count_(0),
       weak_factory_(this) {
   DCHECK(browser_context_);
-  DCHECK(renderer_config_manager_);
   memory_pressure_listener_ =
       std::make_unique<base::MemoryPressureListener>(base::BindRepeating(
           &LRURendererCache::OnMemoryPressure, weak_factory_.GetWeakPtr()));
@@ -100,9 +96,8 @@
   if (factory_for_testing_) {
     cache_.push_front(factory_for_testing_->Create(browser_context_, page_url));
   } else {
-    cache_.push_front(std::make_unique<RendererPrelauncher>(
-        browser_context_,
-        renderer_config_manager_->CreateRendererConfigurator(), page_url));
+    cache_.push_front(
+        std::make_unique<RendererPrelauncher>(browser_context_, page_url));
   }
   // Evict the cache before prelaunching.
   EvictCache();

diff --git a/chromecast/browser/lru_renderer_cache.h b/chromecast/browser/lru_renderer_cache.h
index 836d4c3..0e94ed5 100644
--- a/chromecast/browser/lru_renderer_cache.h
+++ b/chromecast/browser/lru_renderer_cache.h

@@ -21,10 +21,6 @@
 namespace chromecast {
 class RendererPrelauncher;
 
-namespace shell {
-class RendererConfigManager;
-}  // namespace shell
-
 // Factory class for testing.
 class RendererPrelauncherFactory {
  public:
@@ -39,7 +35,6 @@
 class LRURendererCache {
  public:
   LRURendererCache(content::BrowserContext* browser_context,
-                   shell::RendererConfigManager* renderer_config_manager,
                    size_t max_renderers);
   virtual ~LRURendererCache();
 
@@ -69,7 +64,6 @@
   void EvictCache();
 
   content::BrowserContext* const browser_context_;
-  shell::RendererConfigManager* const renderer_config_manager_;
   const size_t max_renderers_;
   size_t in_use_count_;
   std::list<std::unique_ptr<RendererPrelauncher>> cache_;

diff --git a/chromecast/browser/lru_renderer_cache_test.cc b/chromecast/browser/lru_renderer_cache_test.cc
index 6ed903d..da8a86a8 100644
--- a/chromecast/browser/lru_renderer_cache_test.cc
+++ b/chromecast/browser/lru_renderer_cache_test.cc

@@ -8,7 +8,6 @@
 #include <utility>
 
 #include "base/memory/ptr_util.h"
-#include "chromecast/browser/renderer_config.h"
 #include "chromecast/browser/renderer_prelauncher.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/test/test_browser_context.h"
@@ -17,12 +16,10 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
-#define EXPECT_CREATE_AND_PRELAUNCH(ptr, url)                      \
-  ptr = new MockPrelauncher(                                       \
-      &browser_context_,                                           \
-      renderer_config_manager_.CreateRendererConfigurator(), url); \
-  EXPECT_CALL(*ptr, Prelaunch());                                  \
-  EXPECT_CALL(factory_, Create(&browser_context_, url))            \
+#define EXPECT_CREATE_AND_PRELAUNCH(ptr, url)           \
+  ptr = new MockPrelauncher(&browser_context_, url);    \
+  EXPECT_CALL(*ptr, Prelaunch());                       \
+  EXPECT_CALL(factory_, Create(&browser_context_, url)) \
       .WillOnce(Return(ByMove(std::unique_ptr<MockPrelauncher>(ptr))));
 
 #define EXPECT_EVICTION(ptr) EXPECT_CALL(*ptr, Destroy());
@@ -47,10 +44,8 @@
 class MockPrelauncher : public RendererPrelauncher {
  public:
   MockPrelauncher(content::BrowserContext* browser_context,
-                  shell::RendererConfigurator renderer_configurator,
                   const GURL& page_url)
       : RendererPrelauncher(browser_context,
-                            std::move(renderer_configurator),
                             page_url) {}
   virtual ~MockPrelauncher() { Destroy(); }
 
@@ -78,13 +73,11 @@
   content::TestBrowserThreadBundle threads_;
   content::TestBrowserContext browser_context_;
   MockFactory factory_;
-  shell::RendererConfigManager renderer_config_manager_;
   std::unique_ptr<LRURendererCache> lru_cache_;
 };
 
 TEST_F(LRURendererCacheTest, SimpleTakeAndRelease) {
-  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_,
-                                                  &renderer_config_manager_, 1);
+  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_, 1);
   SetFactory();
   MockPrelauncher* p1;
   std::unique_ptr<RendererPrelauncher> taken;
@@ -119,8 +112,7 @@
 }
 
 TEST_F(LRURendererCacheTest, SimpleCacheEviction) {
-  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_,
-                                                  &renderer_config_manager_, 1);
+  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_, 1);
   SetFactory();
   MockPrelauncher* p1;
   std::unique_ptr<RendererPrelauncher> taken;
@@ -145,8 +137,7 @@
 }
 
 TEST_F(LRURendererCacheTest, CapacityOne) {
-  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_,
-                                                  &renderer_config_manager_, 1);
+  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_, 1);
   SetFactory();
   MockPrelauncher* p1;
   MockPrelauncher* p2;
@@ -233,8 +224,7 @@
 }
 
 TEST_F(LRURendererCacheTest, CapacityTwo) {
-  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_,
-                                                  &renderer_config_manager_, 2);
+  lru_cache_ = std::make_unique<LRURendererCache>(&browser_context_, 2);
   SetFactory();
   MockPrelauncher* p1;
   MockPrelauncher* p2;

diff --git a/chromecast/browser/renderer_config.cc b/chromecast/browser/renderer_config.cc
deleted file mode 100644
index 956a2dd..0000000
--- a/chromecast/browser/renderer_config.cc
+++ /dev/null

@@ -1,154 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chromecast/browser/renderer_config.h"
-
-#include <utility>
-
-#include "base/bind.h"
-#include "base/callback.h"
-#include "base/command_line.h"
-#include "content/public/common/child_process_host.h"
-
-namespace chromecast {
-namespace shell {
-
-namespace {
-
-class RendererConfigImpl : public RendererConfig {
- public:
-  RendererConfigImpl(int render_process_id,
-                     base::flat_set<std::string> switches,
-                     base::flat_map<std::string, std::string> ascii_switches)
-      : render_process_id_(render_process_id),
-        switches_(std::move(switches)),
-        ascii_switches_(std::move(ascii_switches)) {
-    DCHECK_NE(content::ChildProcessHost::kInvalidUniqueID, render_process_id);
-  }
-
-  int GetRenderProcessId() const override { return render_process_id_; }
-
-  void AppendSwitchesTo(base::CommandLine* command_line) const override {
-    DCHECK(command_line);
-    for (const std::string& switch_string : switches_) {
-      command_line->AppendSwitch(switch_string);
-    }
-    for (const auto& ascii_switch : ascii_switches_) {
-      command_line->AppendSwitchASCII(ascii_switch.first, ascii_switch.second);
-    }
-  }
-
- private:
-  ~RendererConfigImpl() override = default;
-
-  const int render_process_id_;
-  const base::flat_set<std::string> switches_;
-  const base::flat_map<std::string /* switch */, std::string /* value */>
-      ascii_switches_;
-
-  DISALLOW_COPY_AND_ASSIGN(RendererConfigImpl);
-};
-
-}  // namespace
-
-RendererConfig::RendererConfig() = default;
-RendererConfig::~RendererConfig() = default;
-
-RendererConfigurator::RendererConfigurator(
-    AddRendererConfigCallback add_renderer_config_callback,
-    RemoveRendererConfigCallback remove_renderer_config_callback)
-    : add_renderer_config_callback_(std::move(add_renderer_config_callback)),
-      remove_renderer_config_callback_(
-          std::move(remove_renderer_config_callback)) {
-  DCHECK(add_renderer_config_callback_);
-  DCHECK(remove_renderer_config_callback_);
-}
-
-RendererConfigurator::RendererConfigurator(RendererConfigurator&& other)
-    : add_renderer_config_callback_(
-          std::move(other.add_renderer_config_callback_)),
-      remove_renderer_config_callback_(
-          std::move(other.remove_renderer_config_callback_)),
-      render_process_id_(other.render_process_id_),
-      switches_(std::move(other.switches_)),
-      ascii_switches_(std::move(other.ascii_switches_)) {
-  other.render_process_id_ = content::ChildProcessHost::kInvalidUniqueID;
-}
-
-RendererConfigurator::~RendererConfigurator() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (!add_renderer_config_callback_ && remove_renderer_config_callback_) {
-    std::move(remove_renderer_config_callback_).Run(render_process_id_);
-  }
-}
-
-void RendererConfigurator::Configure(int render_process_id) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DCHECK(add_renderer_config_callback_);
-  DCHECK_NE(content::ChildProcessHost::kInvalidUniqueID, render_process_id);
-  render_process_id_ = render_process_id;
-  std::move(add_renderer_config_callback_)
-      .Run(render_process_id_, base::MakeRefCounted<RendererConfigImpl>(
-                                   render_process_id, std::move(switches_),
-                                   std::move(ascii_switches_)));
-}
-
-void RendererConfigurator::AppendSwitch(const std::string& switch_string) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DCHECK(add_renderer_config_callback_);
-  switches_.insert(switch_string);
-}
-
-void RendererConfigurator::AppendSwitchASCII(const std::string& switch_string,
-                                             const std::string& value) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DCHECK(add_renderer_config_callback_);
-  ascii_switches_[switch_string] = value;
-}
-
-RendererConfigManager::RendererConfigManager() : weak_factory_(this) {}
-
-RendererConfigManager::~RendererConfigManager() = default;
-
-RendererConfigurator RendererConfigManager::CreateRendererConfigurator() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  return RendererConfigurator(
-      base::BindOnce(&RendererConfigManager::AddRendererConfig,
-                     weak_factory_.GetWeakPtr()),
-      base::BindOnce(&RendererConfigManager::RemoveRendererConfig,
-                     weak_factory_.GetWeakPtr()));
-}
-
-scoped_refptr<const RendererConfig> RendererConfigManager::GetRendererConfig(
-    int render_process_id) {
-  if (render_process_id == content::ChildProcessHost::kInvalidUniqueID) {
-    return nullptr;
-  }
-  base::AutoLock lock(renderer_configs_lock_);
-  auto it = renderer_configs_.find(render_process_id);
-  if (it == renderer_configs_.end()) {
-    return nullptr;
-  }
-  return it->second;
-}
-
-void RendererConfigManager::AddRendererConfig(
-    int render_process_id,
-    scoped_refptr<RendererConfig> renderer_config) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DCHECK_NE(content::ChildProcessHost::kInvalidUniqueID, render_process_id);
-  base::AutoLock lock(renderer_configs_lock_);
-  DCHECK_EQ(0U, renderer_configs_.count(render_process_id));
-  renderer_configs_.emplace(render_process_id, std::move(renderer_config));
-}
-
-void RendererConfigManager::RemoveRendererConfig(int render_process_id) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  base::AutoLock lock(renderer_configs_lock_);
-  DCHECK_NE(0U, renderer_configs_.count(render_process_id));
-  renderer_configs_.erase(render_process_id);
-}
-
-}  // namespace shell
-}  // namespace chromecast

diff --git a/chromecast/browser/renderer_config.h b/chromecast/browser/renderer_config.h
deleted file mode 100644
index 6639eb3a..0000000
--- a/chromecast/browser/renderer_config.h
+++ /dev/null

@@ -1,120 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROMECAST_BROWSER_RENDERER_CONFIG_H_
-#define CHROMECAST_BROWSER_RENDERER_CONFIG_H_
-
-#include <string>
-
-#include "base/callback.h"
-#include "base/containers/flat_map.h"
-#include "base/containers/flat_set.h"
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/memory/weak_ptr.h"
-#include "base/sequence_checker.h"
-#include "base/synchronization/lock.h"
-
-namespace base {
-class CommandLine;
-}  // namespace base
-
-namespace chromecast {
-namespace shell {
-
-// Application-specific configuration for the renderer.
-// All methods are thread-safe.
-class RendererConfig : public base::RefCountedThreadSafe<RendererConfig> {
- public:
-  REQUIRE_ADOPTION_FOR_REFCOUNTED_TYPE();
-
-  RendererConfig();
-
-  // Returns the render process ID.
-  virtual int GetRenderProcessId() const = 0;
-
-  // Appends all switches to |command line|.
-  virtual void AppendSwitchesTo(base::CommandLine* command_line) const = 0;
-
- protected:
-  virtual ~RendererConfig();
-
- private:
-  friend class base::RefCountedThreadSafe<RendererConfig>;
-
-  DISALLOW_COPY_AND_ASSIGN(RendererConfig);
-};
-
-// Used to configure the renderer for individual applications.
-// All methods must be called on the main thread.
-class RendererConfigurator {
- public:
-  using AddRendererConfigCallback =
-      base::OnceCallback<void(int render_process_id,
-                              scoped_refptr<RendererConfig> renderer_config)>;
-  using RemoveRendererConfigCallback =
-      base::OnceCallback<void(int render_process_id)>;
-
-  RendererConfigurator(
-      AddRendererConfigCallback add_renderer_config_callback,
-      RemoveRendererConfigCallback remove_renderer_config_callback);
-  RendererConfigurator(RendererConfigurator&& other);
-  virtual ~RendererConfigurator();
-
-  // Configures the renderer with |render_process_id|. Must only be called once,
-  // and no other methods may be called afterward. Must be called before the
-  // render process is started.
-  void Configure(int render_process_id);
-
-  // Appends a switch, with an optional value, to the command line.
-  void AppendSwitch(const std::string& switch_string);
-  void AppendSwitchASCII(const std::string& switch_string,
-                         const std::string& value);
-
- private:
-  AddRendererConfigCallback add_renderer_config_callback_;
-  RemoveRendererConfigCallback remove_renderer_config_callback_;
-  int render_process_id_;
-  base::flat_set<std::string> switches_;
-  base::flat_map<std::string /* switch */, std::string /* value */>
-      ascii_switches_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  DISALLOW_COPY_AND_ASSIGN(RendererConfigurator);
-};
-
-class RendererConfigManager {
- public:
-  RendererConfigManager();
-  ~RendererConfigManager();
-
-  // Returns a new renderer configurator.
-  // Must be called on the main thread.
-  RendererConfigurator CreateRendererConfigurator();
-
-  // Returns the config for the renderer with |render_process_id|.
-  // May be called on any thread.
-  scoped_refptr<const RendererConfig> GetRendererConfig(int render_process_id);
-
- private:
-  void AddRendererConfig(int render_process_id,
-                         scoped_refptr<RendererConfig> renderer_config);
-  void RemoveRendererConfig(int render_process_id);
-
-  base::flat_map<int /* render_process_id */, scoped_refptr<RendererConfig>>
-      renderer_configs_;
-  base::Lock renderer_configs_lock_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  base::WeakPtrFactory<RendererConfigManager> weak_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(RendererConfigManager);
-};
-
-}  // namespace shell
-}  // namespace chromecast
-
-#endif  // CHROMECAST_BROWSER_RENDERER_CONFIG_H_

diff --git a/chromecast/browser/renderer_config_unittest.cc b/chromecast/browser/renderer_config_unittest.cc
deleted file mode 100644
index 3507630..0000000
--- a/chromecast/browser/renderer_config_unittest.cc
+++ /dev/null

@@ -1,62 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chromecast/browser/renderer_config.h"
-
-#include <memory>
-
-#include "base/command_line.h"
-#include "base/memory/ref_counted.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace chromecast {
-namespace shell {
-
-namespace {
-
-constexpr char kSwitch1[] = "switch1";
-constexpr char kSwitch2[] = "switch2";
-constexpr char kValue[] = "value";
-constexpr int kRenderProcessId = 123;
-
-}  // namespace
-
-TEST(RendererConfigTest, AppendCommandLineSwitches) {
-  RendererConfigManager manager;
-  ASSERT_FALSE(manager.GetRendererConfig(kRenderProcessId));
-  scoped_refptr<const RendererConfig> config;
-  {
-    auto configurator = manager.CreateRendererConfigurator();
-    configurator.AppendSwitch(kSwitch1);
-    configurator.AppendSwitchASCII(kSwitch2, kValue);
-    configurator.Configure(kRenderProcessId);
-    config = manager.GetRendererConfig(kRenderProcessId);
-    ASSERT_TRUE(config);
-  }
-  EXPECT_FALSE(manager.GetRendererConfig(kRenderProcessId));
-  base::CommandLine command_line(base::CommandLine::NO_PROGRAM);
-  config->AppendSwitchesTo(&command_line);
-  EXPECT_TRUE(command_line.HasSwitch(kSwitch1));
-  EXPECT_TRUE(command_line.HasSwitch(kSwitch2));
-  EXPECT_EQ(kValue, command_line.GetSwitchValueASCII(kSwitch2));
-}
-
-TEST(RendererConfigTest, ConfiguratorOutlivesManager) {
-  auto manager = std::make_unique<RendererConfigManager>();
-  ASSERT_FALSE(manager->GetRendererConfig(kRenderProcessId));
-  auto configurator = manager->CreateRendererConfigurator();
-  configurator.Configure(kRenderProcessId);
-  EXPECT_TRUE(manager->GetRendererConfig(kRenderProcessId));
-  manager.reset();
-}
-
-TEST(RendererConfigTest, ConfigureAfterManagerDestroyed) {
-  auto manager = std::make_unique<RendererConfigManager>();
-  auto configurator = manager->CreateRendererConfigurator();
-  manager.reset();
-  configurator.Configure(kRenderProcessId);
-}
-
-}  // namespace shell
-}  // namespace chromecast

diff --git a/chromecast/browser/renderer_prelauncher.cc b/chromecast/browser/renderer_prelauncher.cc
index c5ff082..f9ac8f5 100644
--- a/chromecast/browser/renderer_prelauncher.cc
+++ b/chromecast/browser/renderer_prelauncher.cc

@@ -14,10 +14,8 @@
 
 RendererPrelauncher::RendererPrelauncher(
     content::BrowserContext* browser_context,
-    shell::RendererConfigurator renderer_configurator,
     const GURL& gurl)
     : browser_context_(browser_context),
-      renderer_configurator_(std::move(renderer_configurator)),
       gurl_(gurl),
       rph_routing_id_(MSG_ROUTING_NONE) {}
 
@@ -31,7 +29,6 @@
 void RendererPrelauncher::Prelaunch() {
   DLOG(INFO) << "Prelaunching for: " << gurl_;
   site_instance_ = content::SiteInstance::CreateForURL(browser_context_, gurl_);
-  renderer_configurator_.Configure(site_instance_->GetProcess()->GetID());
   content::RenderProcessHost* rph = site_instance_->GetProcess();
   rph_routing_id_ = rph->GetNextRoutingID();
   rph->AddRoute(rph_routing_id_, this);

diff --git a/chromecast/browser/renderer_prelauncher.h b/chromecast/browser/renderer_prelauncher.h
index bce85da..eb17e8b 100644
--- a/chromecast/browser/renderer_prelauncher.h
+++ b/chromecast/browser/renderer_prelauncher.h

@@ -7,7 +7,6 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "chromecast/browser/renderer_config.h"
 #include "ipc/ipc_listener.h"
 #include "url/gurl.h"
 
@@ -26,7 +25,6 @@
 class RendererPrelauncher : private IPC::Listener {
  public:
   RendererPrelauncher(content::BrowserContext* browser_context,
-                      shell::RendererConfigurator renderer_configurator,
                       const GURL& gurl);
   ~RendererPrelauncher() override;
 
@@ -43,7 +41,6 @@
   bool OnMessageReceived(const IPC::Message& message) override;
 
   content::BrowserContext* const browser_context_;
-  shell::RendererConfigurator renderer_configurator_;
   scoped_refptr<content::SiteInstance> site_instance_;
   const GURL gurl_;
   int32_t rph_routing_id_;

diff --git a/chromecast/browser/renderer_prelauncher_test.cc b/chromecast/browser/renderer_prelauncher_test.cc
index 9157bdf..4e88258 100644
--- a/chromecast/browser/renderer_prelauncher_test.cc
+++ b/chromecast/browser/renderer_prelauncher_test.cc

@@ -13,7 +13,6 @@
 #include "chromecast/base/metrics/cast_metrics_helper.h"
 #include "chromecast/browser/cast_browser_context.h"
 #include "chromecast/browser/cast_browser_process.h"
-#include "chromecast/browser/renderer_config.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
@@ -60,10 +59,8 @@
   EXPECT_TRUE(browser_context);
 
   // Prelaunch a renderer process for the url.
-  shell::RendererConfigManager renderer_config_manager;
-  auto prelauncher = std::make_unique<RendererPrelauncher>(
-      browser_context, renderer_config_manager.CreateRendererConfigurator(),
-      gurl);
+  auto prelauncher =
+      std::make_unique<RendererPrelauncher>(browser_context, gurl);
   prelauncher->Prelaunch();
   scoped_refptr<content::SiteInstance> site_instance =
       prelauncher->site_instance();

diff --git a/chromeos/components/drivefs/fake_drivefs.cc b/chromeos/components/drivefs/fake_drivefs.cc
index d52bc07..d1d2e85f 100644
--- a/chromeos/components/drivefs/fake_drivefs.cc
+++ b/chromeos/components/drivefs/fake_drivefs.cc

@@ -183,6 +183,6 @@
   std::move(callback).Run(drive::FILE_ERROR_OK);
 }
 
-void FakeDriveFs::SetPauseSyncing(bool pause) {}
+void FakeDriveFs::UpdateNetworkState(bool pause_syncing, bool is_offline) {}
 
 }  // namespace drivefs

diff --git a/chromeos/components/drivefs/fake_drivefs.h b/chromeos/components/drivefs/fake_drivefs.h
index 28ea7a1..30968fc 100644
--- a/chromeos/components/drivefs/fake_drivefs.h
+++ b/chromeos/components/drivefs/fake_drivefs.h

@@ -53,7 +53,7 @@
                  bool pinned,
                  SetPinnedCallback callback) override;
 
-  void SetPauseSyncing(bool pause) override;
+  void UpdateNetworkState(bool pause_syncing, bool is_offline) override;
 
   const base::FilePath mount_path_;
 

diff --git a/chromeos/components/drivefs/mojom/drivefs.mojom b/chromeos/components/drivefs/mojom/drivefs.mojom
index b054416c..0847594 100644
--- a/chromeos/components/drivefs/mojom/drivefs.mojom
+++ b/chromeos/components/drivefs/mojom/drivefs.mojom

@@ -30,8 +30,9 @@
   // |pinned|.
   SetPinned(mojo_base.mojom.FilePath path, bool pinned) => (FileError error);
 
-  // Set whether syncing should be paused.
-  SetPauseSyncing(bool pause);
+  // Update DriveFS with the current network state, including whether the
+  // network is available and whether syncing should be paused.
+  UpdateNetworkState(bool pause_syncing, bool is_offline);
 };
 
 // Implemented by Chrome, used from DriveFS.

diff --git a/chromeos/dbus/fake_cryptohome_client.cc b/chromeos/dbus/fake_cryptohome_client.cc
index 4b6817b7..9610aeb 100644
--- a/chromeos/dbus/fake_cryptohome_client.cc
+++ b/chromeos/dbus/fake_cryptohome_client.cc

@@ -731,6 +731,11 @@
                                              : base::make_optional(it->second);
 }
 
+void FakeCryptohomeClient::NotifyLowDiskSpace(uint64_t disk_free_bytes) {
+  for (auto& observer : observer_list_)
+    observer.LowDiskSpace(disk_free_bytes);
+}
+
 // static
 std::vector<uint8_t> FakeCryptohomeClient::GetStubSystemSalt() {
   const char kStubSystemSalt[] = "stub_system_salt";
@@ -814,11 +819,6 @@
     observer.AsyncCallStatusWithData(async_id, return_status, data);
 }
 
-void FakeCryptohomeClient::NotifyLowDiskSpace(uint64_t disk_free_bytes) {
-  for (auto& observer : observer_list_)
-    observer.LowDiskSpace(disk_free_bytes);
-}
-
 void FakeCryptohomeClient::NotifyDircryptoMigrationProgress(
     cryptohome::DircryptoMigrationStatus status,
     uint64_t current,

diff --git a/chromeos/dbus/fake_cryptohome_client.h b/chromeos/dbus/fake_cryptohome_client.h
index 9eb1ea29..f777b1e 100644
--- a/chromeos/dbus/fake_cryptohome_client.h
+++ b/chromeos/dbus/fake_cryptohome_client.h

@@ -297,6 +297,9 @@
       uint64_t current,
       uint64_t total);
 
+  // Notifies LowDiskSpace() to Observer instances.
+  void NotifyLowDiskSpace(uint64_t disk_free_bytes);
+
   // MountEx getters.
   bool to_migrate_from_ecryptfs() const {
     return last_mount_request_.to_migrate_from_ecryptfs();
@@ -347,9 +350,6 @@
                                      bool return_status,
                                      const std::string& data);
 
-  // Notifies LowDiskSpace() to Observer instances.
-  void NotifyLowDiskSpace(uint64_t disk_free_bytes);
-
   // Loads install attributes from the stub file.
   bool LoadInstallAttributes();
 

diff --git a/chromeos/services/assistant/platform/audio_output_provider_impl.cc b/chromeos/services/assistant/platform/audio_output_provider_impl.cc
index 1562d2d..53b7088 100644
--- a/chromeos/services/assistant/platform/audio_output_provider_impl.cc
+++ b/chromeos/services/assistant/platform/audio_output_provider_impl.cc

@@ -85,7 +85,7 @@
                   assistant_client::OutputStreamType type,
                   assistant_client::OutputStreamFormat format)
       : connector_(connector),
-        main_thread_task_runner_(std::move(task_runner)),
+        main_thread_task_runner_(task_runner),
         stream_type_(type),
         format_(format),
         device_owner_(std::make_unique<AudioDeviceOwner>(task_runner)) {}
@@ -221,7 +221,7 @@
 
 AudioDeviceOwner::AudioDeviceOwner(
     scoped_refptr<base::SequencedTaskRunner> task_runner)
-    : main_thread_task_runner_(std::move(task_runner)) {}
+    : main_thread_task_runner_(task_runner) {}
 
 AudioDeviceOwner::~AudioDeviceOwner() = default;
 
@@ -246,7 +246,11 @@
   audio_fifo_ = std::make_unique<media::AudioBlockFifo>(
       format.pcm_num_channels, audio_param_.frames_per_buffer(), 3);
   audio_data_.resize(GetBufferSizeInBytesFromBufferFormat(format_));
-  ScheduleFillLocked(base::TimeTicks::Now());
+
+  {
+    base::AutoLock lock(lock_);
+    ScheduleFillLocked(base::TimeTicks::Now());
+  }
 
   // |connector| is null in unittest.
   if (connector) {

diff --git a/chromeos/services/multidevice_setup/BUILD.gn b/chromeos/services/multidevice_setup/BUILD.gn
index 6bd0e83..ba60b5f8 100644
--- a/chromeos/services/multidevice_setup/BUILD.gn
+++ b/chromeos/services/multidevice_setup/BUILD.gn

@@ -52,6 +52,7 @@
     "//chromeos/services/device_sync/public/cpp",
     "//chromeos/services/device_sync/public/mojom",
     "//chromeos/services/multidevice_setup/proto",
+    "//chromeos/services/multidevice_setup/public/cpp:android_sms_app_install_delegate",
     "//chromeos/services/multidevice_setup/public/cpp:prefs",
     "//chromeos/services/multidevice_setup/public/mojom",
     "//chromeos/services/secure_channel/public/cpp/client",

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_impl.cc b/chromeos/services/multidevice_setup/multidevice_setup_impl.cc
index 0d0191da..cf4b3270 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_impl.cc
+++ b/chromeos/services/multidevice_setup/multidevice_setup_impl.cc

@@ -14,6 +14,7 @@
 #include "chromeos/services/multidevice_setup/host_backend_delegate_impl.h"
 #include "chromeos/services/multidevice_setup/host_status_provider_impl.h"
 #include "chromeos/services/multidevice_setup/host_verifier_impl.h"
+#include "chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h"
 #include "chromeos/services/multidevice_setup/setup_flow_completion_recorder_impl.h"
 
 namespace chromeos {
@@ -46,18 +47,24 @@
     PrefService* pref_service,
     device_sync::DeviceSyncClient* device_sync_client,
     secure_channel::SecureChannelClient* secure_channel_client,
-    AuthTokenValidator* auth_token_validator) {
-  return base::WrapUnique(
-      new MultiDeviceSetupImpl(pref_service, device_sync_client,
-                               secure_channel_client, auth_token_validator));
+    AuthTokenValidator* auth_token_validator,
+    std::unique_ptr<AndroidSmsAppInstallDelegate>
+        android_sms_app_install_delegate) {
+  return base::WrapUnique(new MultiDeviceSetupImpl(
+      pref_service, device_sync_client, secure_channel_client,
+      auth_token_validator, std::move(android_sms_app_install_delegate)));
 }
 
 MultiDeviceSetupImpl::MultiDeviceSetupImpl(
     PrefService* pref_service,
     device_sync::DeviceSyncClient* device_sync_client,
     secure_channel::SecureChannelClient* secure_channel_client,
-    AuthTokenValidator* auth_token_validator)
-    : eligible_host_devices_provider_(
+    AuthTokenValidator* auth_token_validator,
+    std::unique_ptr<AndroidSmsAppInstallDelegate>
+        android_sms_app_install_delegate)
+    : android_sms_app_install_delegate_(
+          std::move(android_sms_app_install_delegate)),
+      eligible_host_devices_provider_(
           EligibleHostDevicesProviderImpl::Factory::Get()->BuildInstance(
               device_sync_client)),
       host_backend_delegate_(
@@ -144,6 +151,7 @@
   }
 
   host_backend_delegate_->AttemptToSetMultiDeviceHostOnBackend(*it);
+  android_sms_app_install_delegate_->InstallAndroidSmsApp();
   std::move(callback).Run(true /* success */);
 }
 

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_impl.h b/chromeos/services/multidevice_setup/multidevice_setup_impl.h
index 9a06e57..5a134ffe 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_impl.h
+++ b/chromeos/services/multidevice_setup/multidevice_setup_impl.h

@@ -13,6 +13,7 @@
 #include "chromeos/services/multidevice_setup/public/mojom/multidevice_setup.mojom.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/bindings/interface_ptr_set.h"
+#include "url/gurl.h"
 
 class PrefService;
 
@@ -29,6 +30,7 @@
 namespace multidevice_setup {
 
 class AccountStatusChangeDelegateNotifier;
+class AndroidSmsAppInstallDelegate;
 class AuthTokenValidator;
 class HostBackendDelegate;
 class HostStatusProvider;
@@ -50,7 +52,9 @@
         PrefService* pref_service,
         device_sync::DeviceSyncClient* device_sync_client,
         secure_channel::SecureChannelClient* secure_channel_client,
-        AuthTokenValidator* auth_token_validator);
+        AuthTokenValidator* auth_token_validator,
+        std::unique_ptr<AndroidSmsAppInstallDelegate>
+            android_sms_app_install_delegate);
 
    private:
     static Factory* test_factory_;
@@ -65,7 +69,9 @@
       PrefService* pref_service,
       device_sync::DeviceSyncClient* device_sync_client,
       secure_channel::SecureChannelClient* secure_channel_client,
-      AuthTokenValidator* auth_token_validator);
+      AuthTokenValidator* auth_token_validator,
+      std::unique_ptr<AndroidSmsAppInstallDelegate>
+          android_sms_app_install_delegate);
 
   // mojom::MultiDeviceSetup:
   void SetAccountStatusChangeDelegate(
@@ -97,6 +103,8 @@
 
   void FlushForTesting();
 
+  std::unique_ptr<AndroidSmsAppInstallDelegate>
+      android_sms_app_install_delegate_;
   std::unique_ptr<EligibleHostDevicesProvider> eligible_host_devices_provider_;
   std::unique_ptr<HostBackendDelegate> host_backend_delegate_;
   std::unique_ptr<HostVerifier> host_verifier_;

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_impl_unittest.cc b/chromeos/services/multidevice_setup/multidevice_setup_impl_unittest.cc
index d607c6cf..c1722bc3 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_impl_unittest.cc
+++ b/chromeos/services/multidevice_setup/multidevice_setup_impl_unittest.cc

@@ -26,6 +26,7 @@
 #include "chromeos/services/multidevice_setup/host_status_provider_impl.h"
 #include "chromeos/services/multidevice_setup/host_verifier_impl.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_impl.h"
+#include "chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.h"
 #include "chromeos/services/multidevice_setup/public/cpp/fake_auth_token_validator.h"
 #include "chromeos/services/multidevice_setup/public/mojom/multidevice_setup.mojom.h"
 #include "chromeos/services/multidevice_setup/setup_flow_completion_recorder_impl.h"
@@ -363,6 +364,10 @@
     fake_secure_channel_client_ =
         std::make_unique<secure_channel::FakeSecureChannelClient>();
     fake_auth_token_validator_ = std::make_unique<FakeAuthTokenValidator>();
+    auto fake_android_sms_app_install_delegate =
+        std::make_unique<FakeAndroidSmsAppInstallDelegate>();
+    fake_android_sms_app_install_delegate_ =
+        fake_android_sms_app_install_delegate.get();
 
     fake_eligible_host_devices_provider_factory_ =
         std::make_unique<FakeEligibleHostDevicesProviderFactory>(
@@ -413,7 +418,8 @@
 
     multidevice_setup_ = MultiDeviceSetupImpl::Factory::Get()->BuildInstance(
         test_pref_service_.get(), fake_device_sync_client_.get(),
-        fake_secure_channel_client_.get(), fake_auth_token_validator_.get());
+        fake_secure_channel_client_.get(), fake_auth_token_validator_.get(),
+        std::move(fake_android_sms_app_install_delegate));
   }
 
   void TearDown() override {
@@ -598,6 +604,10 @@
     return fake_account_status_change_delegate_notifier_factory_->instance();
   }
 
+  FakeAndroidSmsAppInstallDelegate* fake_android_sms_app_install_delegate() {
+    return fake_android_sms_app_install_delegate_;
+  }
+
   cryptauth::RemoteDeviceRefList& test_devices() { return test_devices_; }
 
   mojom::MultiDeviceSetup* multidevice_setup() {
@@ -679,6 +689,7 @@
       fake_setup_flow_completion_recorder_factory_;
   std::unique_ptr<FakeAccountStatusChangeDelegateNotifierFactory>
       fake_account_status_change_delegate_notifier_factory_;
+  FakeAndroidSmsAppInstallDelegate* fake_android_sms_app_install_delegate_;
 
   std::unique_ptr<FakeAccountStatusChangeDelegate>
       fake_account_status_change_delegate_;
@@ -828,6 +839,9 @@
   VerifyCurrentHostStatus(mojom::HostStatus::kHostVerified, test_devices()[0],
                           observer.get(), 3u /* expected_observer_index */);
 
+  // Messages App install should have succeeded.
+  EXPECT_TRUE(fake_android_sms_app_install_delegate()->HasInstalledApp());
+
   // Remove the host.
   multidevice_setup()->RemoveHostDevice();
   fake_host_verifier()->set_is_host_verified(false);

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_initializer.cc b/chromeos/services/multidevice_setup/multidevice_setup_initializer.cc
index 320cbc4..9fe5310 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_initializer.cc
+++ b/chromeos/services/multidevice_setup/multidevice_setup_initializer.cc

@@ -9,6 +9,7 @@
 #include "base/no_destructor.h"
 #include "chromeos/components/proximity_auth/logging/logging.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_impl.h"
+#include "chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h"
 
 namespace chromeos {
 
@@ -41,21 +42,27 @@
     PrefService* pref_service,
     device_sync::DeviceSyncClient* device_sync_client,
     secure_channel::SecureChannelClient* secure_channel_client,
-    AuthTokenValidator* auth_token_validator) {
+    AuthTokenValidator* auth_token_validator,
+    std::unique_ptr<AndroidSmsAppInstallDelegate>
+        android_sms_app_install_delegate) {
   return base::WrapUnique(new MultiDeviceSetupInitializer(
       pref_service, device_sync_client, secure_channel_client,
-      auth_token_validator));
+      auth_token_validator, std::move(android_sms_app_install_delegate)));
 }
 
 MultiDeviceSetupInitializer::MultiDeviceSetupInitializer(
     PrefService* pref_service,
     device_sync::DeviceSyncClient* device_sync_client,
     secure_channel::SecureChannelClient* secure_channel_client,
-    AuthTokenValidator* auth_token_validator)
+    AuthTokenValidator* auth_token_validator,
+    std::unique_ptr<AndroidSmsAppInstallDelegate>
+        android_sms_app_install_delegate)
     : pref_service_(pref_service),
       device_sync_client_(device_sync_client),
       secure_channel_client_(secure_channel_client),
-      auth_token_validator_(auth_token_validator) {
+      auth_token_validator_(auth_token_validator),
+      android_sms_app_install_delegate_(
+          std::move(android_sms_app_install_delegate)) {
   if (device_sync_client_->is_ready()) {
     InitializeImplementation();
     return;
@@ -210,7 +217,7 @@
 
   multidevice_setup_impl_ = MultiDeviceSetupImpl::Factory::Get()->BuildInstance(
       pref_service_, device_sync_client_, secure_channel_client_,
-      auth_token_validator_);
+      auth_token_validator_, std::move(android_sms_app_install_delegate_));
 
   if (pending_delegate_) {
     multidevice_setup_impl_->SetAccountStatusChangeDelegate(

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_initializer.h b/chromeos/services/multidevice_setup/multidevice_setup_initializer.h
index baf7f1a..89eedc32 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_initializer.h
+++ b/chromeos/services/multidevice_setup/multidevice_setup_initializer.h

@@ -24,6 +24,7 @@
 
 namespace multidevice_setup {
 
+class AndroidSmsAppInstallDelegate;
 class AuthTokenValidator;
 
 // Initializes the MultiDeviceSetup service. This class is responsible for
@@ -42,7 +43,9 @@
         PrefService* pref_service,
         device_sync::DeviceSyncClient* device_sync_client,
         secure_channel::SecureChannelClient* secure_channel_client,
-        AuthTokenValidator* auth_token_validator);
+        AuthTokenValidator* auth_token_validator,
+        std::unique_ptr<AndroidSmsAppInstallDelegate>
+            android_sms_app_install_delegate);
 
    private:
     static Factory* test_factory_;
@@ -55,7 +58,9 @@
       PrefService* pref_service,
       device_sync::DeviceSyncClient* device_sync_client,
       secure_channel::SecureChannelClient* secure_channel_client,
-      AuthTokenValidator* auth_token_validator);
+      AuthTokenValidator* auth_token_validator,
+      std::unique_ptr<AndroidSmsAppInstallDelegate>
+          android_sms_app_install_delegate);
 
   // mojom::MultiDeviceSetup:
   void SetAccountStatusChangeDelegate(
@@ -86,6 +91,8 @@
   device_sync::DeviceSyncClient* device_sync_client_;
   secure_channel::SecureChannelClient* secure_channel_client_;
   AuthTokenValidator* auth_token_validator_;
+  std::unique_ptr<AndroidSmsAppInstallDelegate>
+      android_sms_app_install_delegate_;
 
   std::unique_ptr<mojom::MultiDeviceSetup> multidevice_setup_impl_;
 

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_service.cc b/chromeos/services/multidevice_setup/multidevice_setup_service.cc
index b3e45c3..14dabc5 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_service.cc
+++ b/chromeos/services/multidevice_setup/multidevice_setup_service.cc

@@ -10,6 +10,7 @@
 #include "chromeos/services/multidevice_setup/host_verifier_impl.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_base.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_initializer.h"
+#include "chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h"
 #include "chromeos/services/multidevice_setup/public/cpp/prefs.h"
 
 namespace chromeos {
@@ -29,13 +30,16 @@
     PrefService* pref_service,
     device_sync::DeviceSyncClient* device_sync_client,
     secure_channel::SecureChannelClient* secure_channel_client,
-    AuthTokenValidator* auth_token_validator)
+    AuthTokenValidator* auth_token_validator,
+    std::unique_ptr<AndroidSmsAppInstallDelegate>
+        android_sms_app_install_delegate)
     : multidevice_setup_(
           MultiDeviceSetupInitializer::Factory::Get()->BuildInstance(
               pref_service,
               device_sync_client,
               secure_channel_client,
-              auth_token_validator)) {}
+              auth_token_validator,
+              std::move(android_sms_app_install_delegate))) {}
 
 MultiDeviceSetupService::~MultiDeviceSetupService() = default;
 

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_service.h b/chromeos/services/multidevice_setup/multidevice_setup_service.h
index 820dd0f..fa6b440 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_service.h
+++ b/chromeos/services/multidevice_setup/multidevice_setup_service.h

@@ -26,6 +26,7 @@
 
 namespace multidevice_setup {
 
+class AndroidSmsAppInstallDelegate;
 class AuthTokenValidator;
 class MultiDeviceSetupBase;
 
@@ -38,7 +39,9 @@
       PrefService* pref_service,
       device_sync::DeviceSyncClient* device_sync_client,
       secure_channel::SecureChannelClient* secure_channel_client,
-      AuthTokenValidator* auth_token_validator);
+      AuthTokenValidator* auth_token_validator,
+      std::unique_ptr<AndroidSmsAppInstallDelegate>
+          android_sms_app_install_delegate);
   ~MultiDeviceSetupService() override;
 
   static void RegisterProfilePrefs(PrefRegistrySimple* registry);

diff --git a/chromeos/services/multidevice_setup/multidevice_setup_service_unittest.cc b/chromeos/services/multidevice_setup/multidevice_setup_service_unittest.cc
index 1832d47..cfe0a01 100644
--- a/chromeos/services/multidevice_setup/multidevice_setup_service_unittest.cc
+++ b/chromeos/services/multidevice_setup/multidevice_setup_service_unittest.cc

@@ -11,6 +11,7 @@
 #include "chromeos/services/multidevice_setup/fake_host_status_observer.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_impl.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_service.h"
+#include "chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.h"
 #include "chromeos/services/multidevice_setup/public/cpp/fake_auth_token_validator.h"
 #include "chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup.h"
 #include "chromeos/services/multidevice_setup/public/mojom/constants.mojom.h"
@@ -36,11 +37,15 @@
           expected_testing_pref_service,
       device_sync::FakeDeviceSyncClient* expected_device_sync_client,
       secure_channel::FakeSecureChannelClient* expected_secure_channel_client,
-      FakeAuthTokenValidator* expected_auth_token_validator)
+      FakeAuthTokenValidator* expected_auth_token_validator,
+      FakeAndroidSmsAppInstallDelegate*
+          expected_android_sms_app_install_delegate)
       : expected_testing_pref_service_(expected_testing_pref_service),
         expected_device_sync_client_(expected_device_sync_client),
         expected_secure_channel_client_(expected_secure_channel_client),
-        expected_auth_token_validator_(expected_auth_token_validator) {}
+        expected_auth_token_validator_(expected_auth_token_validator),
+        expected_android_sms_app_install_delegate_(
+            expected_android_sms_app_install_delegate) {}
 
   ~FakeMultiDeviceSetupFactory() override = default;
 
@@ -51,12 +56,16 @@
       PrefService* pref_service,
       device_sync::DeviceSyncClient* device_sync_client,
       secure_channel::SecureChannelClient* secure_channel_client,
-      AuthTokenValidator* auth_token_validator) override {
+      AuthTokenValidator* auth_token_validator,
+      std::unique_ptr<AndroidSmsAppInstallDelegate>
+          android_sms_app_install_delegate) override {
     EXPECT_FALSE(instance_);
     EXPECT_EQ(expected_testing_pref_service_, pref_service);
     EXPECT_EQ(expected_device_sync_client_, device_sync_client);
     EXPECT_EQ(expected_secure_channel_client_, secure_channel_client);
     EXPECT_EQ(expected_auth_token_validator_, auth_token_validator);
+    EXPECT_EQ(expected_android_sms_app_install_delegate_,
+              android_sms_app_install_delegate.get());
 
     auto instance = std::make_unique<FakeMultiDeviceSetup>();
     instance_ = instance.get();
@@ -67,6 +76,7 @@
   device_sync::FakeDeviceSyncClient* expected_device_sync_client_;
   secure_channel::FakeSecureChannelClient* expected_secure_channel_client_;
   FakeAuthTokenValidator* expected_auth_token_validator_;
+  FakeAndroidSmsAppInstallDelegate* expected_android_sms_app_install_delegate_;
 
   FakeMultiDeviceSetup* instance_ = nullptr;
 
@@ -91,12 +101,16 @@
     fake_secure_channel_client_ =
         std::make_unique<secure_channel::FakeSecureChannelClient>();
     fake_auth_token_validator_ = std::make_unique<FakeAuthTokenValidator>();
+    auto fake_android_sms_app_install_delegate =
+        std::make_unique<FakeAndroidSmsAppInstallDelegate>();
+    fake_android_sms_app_install_delegate_ =
+        fake_android_sms_app_install_delegate.get();
 
     fake_multidevice_setup_factory_ =
         std::make_unique<FakeMultiDeviceSetupFactory>(
             test_pref_service_.get(), fake_device_sync_client_.get(),
-            fake_secure_channel_client_.get(),
-            fake_auth_token_validator_.get());
+            fake_secure_channel_client_.get(), fake_auth_token_validator_.get(),
+            fake_android_sms_app_install_delegate_);
     MultiDeviceSetupImpl::Factory::SetFactoryForTesting(
         fake_multidevice_setup_factory_.get());
 
@@ -105,7 +119,8 @@
             std::make_unique<MultiDeviceSetupService>(
                 test_pref_service_.get(), fake_device_sync_client_.get(),
                 fake_secure_channel_client_.get(),
-                fake_auth_token_validator_.get()));
+                fake_auth_token_validator_.get(),
+                std::move(fake_android_sms_app_install_delegate)));
 
     auto connector = connector_factory_->CreateConnector();
     connector->BindInterface(mojom::kServiceName, &multidevice_setup_ptr_);
@@ -162,6 +177,7 @@
   std::unique_ptr<secure_channel::FakeSecureChannelClient>
       fake_secure_channel_client_;
   std::unique_ptr<FakeAuthTokenValidator> fake_auth_token_validator_;
+  FakeAndroidSmsAppInstallDelegate* fake_android_sms_app_install_delegate_;
 
   std::unique_ptr<FakeMultiDeviceSetupFactory> fake_multidevice_setup_factory_;
 

diff --git a/chromeos/services/multidevice_setup/public/cpp/BUILD.gn b/chromeos/services/multidevice_setup/public/cpp/BUILD.gn
index 3f12e322..234c194f 100644
--- a/chromeos/services/multidevice_setup/public/cpp/BUILD.gn
+++ b/chromeos/services/multidevice_setup/public/cpp/BUILD.gn

@@ -30,6 +30,16 @@
   ]
 }
 
+source_set("android_sms_app_install_delegate") {
+  sources = [
+    "android_sms_app_install_delegate.h",
+  ]
+
+  public_deps = [
+    "//base",
+  ]
+}
+
 source_set("prefs") {
   sources = [
     "prefs.cc",
@@ -46,6 +56,8 @@
   testonly = true
 
   sources = [
+    "fake_android_sms_app_install_delegate.cc",
+    "fake_android_sms_app_install_delegate.h",
     "fake_auth_token_validator.cc",
     "fake_auth_token_validator.h",
     "fake_multidevice_setup.cc",
@@ -55,6 +67,7 @@
   ]
 
   public_deps = [
+    ":android_sms_app_install_delegate",
     ":auth_token_validator",
     ":cpp",
     "//chromeos/services/multidevice_setup",

diff --git a/chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h b/chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h
new file mode 100644
index 0000000..37eade13
--- /dev/null
+++ b/chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h

@@ -0,0 +1,31 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROMEOS_SERVICES_MULTIDEVICE_SETUP_PUBLIC_CPP_ANDROID_SMS_APP_INSTALL_DELEGATE_H_
+#define CHROMEOS_SERVICES_MULTIDEVICE_SETUP_PUBLIC_CPP_ANDROID_SMS_APP_INSTALL_DELEGATE_H_
+
+#include "base/macros.h"
+
+namespace chromeos {
+namespace multidevice_setup {
+
+// A delegate class used to install the Messages for Web PWA.
+class AndroidSmsAppInstallDelegate {
+ public:
+  virtual ~AndroidSmsAppInstallDelegate() = default;
+
+  // Installs the Messages for Web PWA. Handles retries and errors internally.
+  virtual void InstallAndroidSmsApp() = 0;
+
+ protected:
+  AndroidSmsAppInstallDelegate() = default;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(AndroidSmsAppInstallDelegate);
+};
+
+}  // namespace multidevice_setup
+}  // namespace chromeos
+
+#endif  // CHROMEOS_SERVICES_MULTIDEVICE_SETUP_PUBLIC_CPP_ANDROID_SMS_APP_INSTALL_DELEGATE_H_

diff --git a/chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.cc b/chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.cc
new file mode 100644
index 0000000..e6d2a406
--- /dev/null
+++ b/chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.cc

@@ -0,0 +1,28 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.h"
+
+#include "url/gurl.h"
+
+namespace chromeos {
+
+namespace multidevice_setup {
+
+FakeAndroidSmsAppInstallDelegate::FakeAndroidSmsAppInstallDelegate() {}
+
+FakeAndroidSmsAppInstallDelegate::~FakeAndroidSmsAppInstallDelegate() = default;
+
+void FakeAndroidSmsAppInstallDelegate::InstallAndroidSmsApp() {
+  // TODO(jlklein): Add error simulation when error codes are added to the API.
+  has_installed_ = true;
+}
+
+bool FakeAndroidSmsAppInstallDelegate::HasInstalledApp() {
+  return has_installed_;
+}
+
+}  // namespace multidevice_setup
+
+}  // namespace chromeos

diff --git a/chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.h b/chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.h
new file mode 100644
index 0000000..0d1c6543
--- /dev/null
+++ b/chromeos/services/multidevice_setup/public/cpp/fake_android_sms_app_install_delegate.h

@@ -0,0 +1,32 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROMEOS_SERVICES_MULTIDEVICE_SETUP_PUBLIC_CPP_FAKE_ANDROID_SMS_APP_INSTALL_DELEGATE_H_
+#define CHROMEOS_SERVICES_MULTIDEVICE_SETUP_PUBLIC_CPP_FAKE_ANDROID_SMS_APP_INSTALL_DELEGATE_H_
+
+#include "base/macros.h"
+#include "chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h"
+
+namespace chromeos {
+namespace multidevice_setup {
+
+class FakeAndroidSmsAppInstallDelegate : public AndroidSmsAppInstallDelegate {
+ public:
+  FakeAndroidSmsAppInstallDelegate();
+  ~FakeAndroidSmsAppInstallDelegate() override;
+  bool HasInstalledApp();
+
+  // AndroidSmsAppInstallDelegate:
+  void InstallAndroidSmsApp() override;
+
+ private:
+  bool has_installed_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(FakeAndroidSmsAppInstallDelegate);
+};
+
+}  // namespace multidevice_setup
+}  // namespace chromeos
+
+#endif  // CHROMEOS_SERVICES_MULTIDEVICE_SETUP_PUBLIC_CPP_FAKE_ANDROID_SMS_APP_INSTALL_DELEGATE_H_

diff --git a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc
index 483140fe..5b7cf40 100644
--- a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc
+++ b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc

@@ -14,6 +14,7 @@
 #include "base/test/scoped_task_environment.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_initializer.h"
 #include "chromeos/services/multidevice_setup/multidevice_setup_service.h"
+#include "chromeos/services/multidevice_setup/public/cpp/android_sms_app_install_delegate.h"
 #include "chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup.h"
 #include "chromeos/services/multidevice_setup/public/mojom/constants.mojom.h"
 #include "chromeos/services/multidevice_setup/public/mojom/multidevice_setup.mojom.h"
@@ -43,7 +44,9 @@
       PrefService* pref_service,
       device_sync::DeviceSyncClient* device_sync_client,
       secure_channel::SecureChannelClient* secure_channel_client,
-      AuthTokenValidator* auth_token_validator) override {
+      AuthTokenValidator* auth_token_validator,
+      std::unique_ptr<AndroidSmsAppInstallDelegate>
+          android_sms_app_install_delegate) override {
     EXPECT_TRUE(fake_multidevice_setup_);
     return std::move(fake_multidevice_setup_);
   }
@@ -98,8 +101,8 @@
 
     auto multidevice_setup_service = std::make_unique<MultiDeviceSetupService>(
         nullptr /* pref_service */, nullptr /* device_sync_client */,
-        nullptr /* secure_channel_client */,
-        nullptr /* auth_token_validator */);
+        nullptr /* secure_channel_client */, nullptr /* auth_token_validator */,
+        nullptr /* android_sms_app_install_delegate */);
 
     connector_factory_ =
         service_manager::TestConnectorFactory::CreateForUniqueService(

diff --git a/components/BUILD.gn b/components/BUILD.gn
index a8704c1f..aa24cb3 100644
--- a/components/BUILD.gn
+++ b/components/BUILD.gn

@@ -220,6 +220,7 @@
       "//components/gcm_driver/instance_id:unit_tests",
       "//components/history/content/browser:unit_tests",
       "//components/invalidation/impl:unit_tests",
+      "//components/invalidation/public:unit_tests",
       "//components/keyed_service/content:unit_tests",
       "//components/language/content/browser:unit_tests",
       "//components/link_header_util:unit_tests",

diff --git a/components/component_updater/component_installer_unittest.cc b/components/component_updater/component_installer_unittest.cc
index 03987aa..3bb5d08 100644
--- a/components/component_updater/component_installer_unittest.cc
+++ b/components/component_updater/component_installer_unittest.cc

@@ -311,7 +311,8 @@
 
   CrxUpdateItem item;
   EXPECT_TRUE(component_updater()->GetComponentDetails(id, &item));
-  const CrxComponent& component(item.component);
+  ASSERT_TRUE(item.component);
+  const CrxComponent& component = *item.component;
 
   update_client::InstallerAttributes expected_attrs;
   expected_attrs["ap"] = "fake-ap";

diff --git a/components/component_updater/component_updater_service.cc b/components/component_updater/component_updater_service.cc
index 5833ba3e..2c11f11 100644
--- a/components/component_updater/component_updater_service.cc
+++ b/components/component_updater/component_updater_service.cc

@@ -98,7 +98,6 @@
       base::TimeDelta::FromSeconds(config_->NextCheckDelay()),
       base::Bind(base::IgnoreResult(&CrxUpdateService::CheckForUpdates),
                  base::Unretained(this)),
-      // TODO: Stop component update if requested.
       base::DoNothing());
 }
 
@@ -200,7 +199,7 @@
   const auto it = component_ids_by_mime_type_.find(mime_type);
   if (it == component_ids_by_mime_type_.end())
     return nullptr;
-  auto* const component = GetComponent(it->second);
+  const auto component = GetComponent(it->second);
   if (!component)
     return nullptr;
   return std::make_unique<ComponentInfo>(
@@ -224,11 +223,13 @@
   return *this;
 }
 
-const CrxComponent* CrxUpdateService::GetComponent(
+base::Optional<CrxComponent> CrxUpdateService::GetComponent(
     const std::string& id) const {
   DCHECK(thread_checker_.CalledOnValidThread());
-  const auto it(components_.find(id));
-  return it != components_.end() ? &(it->second) : nullptr;
+  const auto it = components_.find(id);
+  if (it != components_.end())
+    return it->second;
+  return base::nullopt;
 }
 
 const CrxUpdateItem* CrxUpdateService::GetComponentState(
@@ -328,7 +329,7 @@
   for (const auto id : components_order_) {
     DCHECK(components_.find(id) != components_.end());
 
-    auto* component(GetComponent(id));
+    const auto component = GetComponent(id);
     if (!component || component->requires_network_encryption)
       secure_ids.push_back(id);
     else
@@ -392,16 +393,12 @@
   return false;
 }
 
-std::vector<std::unique_ptr<CrxComponent>> CrxUpdateService::GetCrxComponents(
+std::vector<base::Optional<CrxComponent>> CrxUpdateService::GetCrxComponents(
     const std::vector<std::string>& ids) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  std::vector<std::unique_ptr<CrxComponent>> components;
-  for (const auto& id : ids) {
-    const auto* registered_component = GetComponent(id);
-    components.push_back(registered_component ? std::make_unique<CrxComponent>(
-                                                    *registered_component)
-                                              : nullptr);
-  }
+  std::vector<base::Optional<CrxComponent>> components;
+  for (const auto& id : ids)
+    components.push_back(GetComponent(id));
   return components;
 }
 
@@ -420,7 +417,7 @@
 
   for (const auto id : components_pending_unregistration_) {
     if (!update_client_->IsUpdating(id)) {
-      const auto* component = GetComponent(id);
+      const auto component = GetComponent(id);
       if (component)
         DoUnregisterComponent(*component);
     }
@@ -451,16 +448,16 @@
     return;
 
   // Update the state of the item.
-  auto it = component_states_.find(id);
-  DCHECK(it != component_states_.end());
-  it->second = update_item;
+  const auto it = component_states_.find(id);
+  if (it != component_states_.end())
+    it->second = update_item;
 
   // Update the component registration with the new version.
   if (event == Observer::Events::COMPONENT_UPDATED) {
-    auto* component(const_cast<CrxComponent*>(GetComponent(id)));
-    if (component) {
-      component->version = update_item.next_version;
-      component->fingerprint = update_item.next_fp;
+    const auto it = components_.find(id);
+    if (it != components_.end()) {
+      it->second.version = update_item.next_version;
+      it->second.fingerprint = update_item.next_fp;
     }
   }
 }

diff --git a/components/component_updater/component_updater_service_internal.h b/components/component_updater/component_updater_service_internal.h
index 38db35c..341fbf7 100644
--- a/components/component_updater/component_updater_service_internal.h
+++ b/components/component_updater/component_updater_service_internal.h

@@ -12,6 +12,7 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/optional.h"
 #include "base/threading/thread_checker.h"
 #include "components/component_updater/update_scheduler.h"
 
@@ -77,11 +78,11 @@
 
   bool DoUnregisterComponent(const CrxComponent& component);
 
-  const CrxComponent* GetComponent(const std::string& id) const;
+  base::Optional<CrxComponent> GetComponent(const std::string& id) const;
 
   const CrxUpdateItem* GetComponentState(const std::string& id) const;
 
-  std::vector<std::unique_ptr<CrxComponent>> GetCrxComponents(
+  std::vector<base::Optional<CrxComponent>> GetCrxComponents(
       const std::vector<std::string>& ids);
   void OnUpdateComplete(Callback callback,
                         const base::TimeTicks& start_time,

diff --git a/components/drive/chromeos/file_system.cc b/components/drive/chromeos/file_system.cc
index 787c9cca..e922cfac 100644
--- a/components/drive/chromeos/file_system.cc
+++ b/components/drive/chromeos/file_system.cc

@@ -664,10 +664,7 @@
 
   if (util::GetDriveTeamDrivesRootPath().IsParent(directory_path)) {
     // If we do not match a single team drive then we will run the default
-    // corpus loader to read the directory. More than one team drive may match
-    // the path so we loop through all of them (team drive roots may have the
-    // same name).
-    bool matched_team_drive = false;
+    // corpus loader to read the directory.
     for (auto& team_drive_loader : team_drive_change_list_loaders_) {
       const base::FilePath& team_drive_path =
           team_drive_loader.second->root_entry_path();
@@ -675,14 +672,9 @@
           team_drive_path.IsParent(directory_path)) {
         team_drive_loader.second->ReadDirectory(
             directory_path, entries_callback, completion_callback);
-        matched_team_drive = true;
+        return;
       }
     }
-    if (matched_team_drive) {
-      return;
-    } else {
-      DVLOG(1) << "No team drive loader for path, " << directory_path;
-    }
   }
   // Fall through to the default corpus loader if no team drive loader is found.
   // We do not refresh the list of team drives from the server until the first

diff --git a/components/exo/client_controlled_shell_surface.cc b/components/exo/client_controlled_shell_surface.cc
index ac6ac5c..830f8ab 100644
--- a/components/exo/client_controlled_shell_surface.cc
+++ b/components/exo/client_controlled_shell_surface.cc

@@ -875,6 +875,20 @@
       break;
   }
 
+  // PIP windows should not be able to be active.
+  if (pending_window_state_ == ash::mojom::WindowStateType::PIP) {
+    auto* window = widget_->GetNativeWindow();
+    if (wm::IsActiveWindow(window)) {
+      // In the case that a window changed state into PIP while activated,
+      // make sure to deactivate it now.
+      wm::DeactivateWindow(window);
+    }
+
+    widget_->widget_delegate()->set_can_activate(false);
+  } else {
+    widget_->widget_delegate()->set_can_activate(true);
+  }
+
   client_controlled_state_->EnterNextState(window_state, pending_window_state_,
                                            animation_type);
 }

diff --git a/components/exo/client_controlled_shell_surface_unittest.cc b/components/exo/client_controlled_shell_surface_unittest.cc
index 4f539b2..155c239 100644
--- a/components/exo/client_controlled_shell_surface_unittest.cc
+++ b/components/exo/client_controlled_shell_surface_unittest.cc

@@ -1658,4 +1658,33 @@
   EXPECT_TRUE(frame_view->GetHeaderView()->in_immersive_mode());
 }
 
+TEST_F(ClientControlledShellSurfaceTest, PipWindowCannotBeActivated) {
+  const gfx::Size buffer_size(256, 256);
+  std::unique_ptr<Buffer> buffer(
+      new Buffer(exo_test_helper()->CreateGpuMemoryBuffer(buffer_size)));
+  std::unique_ptr<Surface> surface(new Surface());
+  auto shell_surface =
+      exo_test_helper()->CreateClientControlledShellSurface(surface.get());
+
+  surface->Attach(buffer.get());
+  surface->Commit();
+
+  EXPECT_TRUE(shell_surface->GetWidget()->IsActive());
+  EXPECT_TRUE(shell_surface->GetWidget()->CanActivate());
+
+  // Entering PIP should unactivate the window and make the widget
+  // unactivatable.
+  shell_surface->SetPip();
+  surface->Commit();
+
+  EXPECT_FALSE(shell_surface->GetWidget()->IsActive());
+  EXPECT_FALSE(shell_surface->GetWidget()->CanActivate());
+
+  // Leaving PIP should make it activatable again.
+  shell_surface->SetRestored();
+  surface->Commit();
+
+  EXPECT_TRUE(shell_surface->GetWidget()->CanActivate());
+}
+
 }  // namespace exo

diff --git a/components/invalidation/impl/per_user_topic_registration_manager.cc b/components/invalidation/impl/per_user_topic_registration_manager.cc
index cbc94d6..740e9fc 100644
--- a/components/invalidation/impl/per_user_topic_registration_manager.cc
+++ b/components/invalidation/impl/per_user_topic_registration_manager.cc

@@ -81,9 +81,13 @@
       pref(pref) {
   const base::DictionaryValue* registered_for_invalidation =
       pref->GetDictionary(kTypeRegisteredForInvalidation);
-  if (registered_for_invalidation &&
-      registered_for_invalidation->FindKey(id.name())) {
-    state = RegistrationEntry::REGISTERED;
+  if (registered_for_invalidation) {
+    auto* value =
+        registered_for_invalidation->FindKey(SerializeInvalidationObjectId(id));
+    if (value) {
+      value->GetAsString(&private_topic_name);
+      state = RegistrationEntry::REGISTERED;
+    }
   }
 }
 
@@ -95,9 +99,9 @@
   if (code.IsSuccess()) {
     private_topic_name = topic_name;
     state = RegistrationEntry::REGISTERED;
-    ScopedUserPrefUpdate<base::DictionaryValue, base::Value::Type::DICTIONARY>
-        topics_update(pref, kTypeRegisteredForInvalidation);
-    topics_update->SetKey(id.name(), base::Value(private_topic_name));
+    DictionaryPrefUpdate update(pref, kTypeRegisteredForInvalidation);
+    base::DictionaryValue* pref_data = update.Get();
+    pref_data->SetString(SerializeInvalidationObjectId(id), private_topic_name);
   }
 }
 

diff --git a/components/invalidation/impl/per_user_topic_registration_manager_unittest.cc b/components/invalidation/impl/per_user_topic_registration_manager_unittest.cc
index 265c1d76..834f005 100644
--- a/components/invalidation/impl/per_user_topic_registration_manager_unittest.cc
+++ b/components/invalidation/impl/per_user_topic_registration_manager_unittest.cc

@@ -152,11 +152,10 @@
   EXPECT_EQ(ids, per_user_topic_registration_manager->GetRegisteredIds());
 
   for (const auto& id : ids) {
-    std::string topic_name = id.name();
     const base::DictionaryValue* topics =
         pref_service()->GetDictionary(kTypeRegisteredForInvalidation);
-    const base::Value* private_topic_value =
-        topics->FindKeyOfType(topic_name, base::Value::Type::STRING);
+    const base::Value* private_topic_value = topics->FindKeyOfType(
+        SerializeInvalidationObjectId(id), base::Value::Type::STRING);
     ASSERT_NE(private_topic_value, nullptr);
   }
 }

diff --git a/components/invalidation/public/BUILD.gn b/components/invalidation/public/BUILD.gn
index c41f8c5..135a4583 100644
--- a/components/invalidation/public/BUILD.gn
+++ b/components/invalidation/public/BUILD.gn

@@ -35,3 +35,16 @@
     "//base",
   ]
 }
+
+source_set("unit_tests") {
+  testonly = true
+  sources = [
+    "invalidation_util_unittest.cc",
+  ]
+  deps = [
+    ":public",
+    "//base",
+    "//base/test:test_support",
+    "//testing/gtest",
+  ]
+}

diff --git a/components/invalidation/public/invalidation_util.cc b/components/invalidation/public/invalidation_util.cc
index 9e016b6..b6a9ce3 100644
--- a/components/invalidation/public/invalidation_util.cc
+++ b/components/invalidation/public/invalidation_util.cc

@@ -8,6 +8,7 @@
 #include <ostream>
 #include <sstream>
 
+#include "base/json/json_string_value_serializer.h"
 #include "base/json/json_writer.h"
 #include "base/values.h"
 #include "components/invalidation/public/invalidation.h"
@@ -15,6 +16,13 @@
 #include "google/cacheinvalidation/include/types.h"
 #include "google/cacheinvalidation/types.pb.h"
 
+namespace {
+
+const char kSourceKey[] = "source";
+const char kNameKey[] = "name";
+
+}  // namespace
+
 namespace syncer {
 
 bool ObjectIdLessThan::operator()(const invalidation::ObjectId& lhs,
@@ -77,11 +85,50 @@
 std::unique_ptr<base::DictionaryValue> InvalidationObjectIdToValue(
     const invalidation::InvalidationObjectId& object_id) {
   std::unique_ptr<base::DictionaryValue> value(new base::DictionaryValue());
-  value->SetInteger("source", object_id.source());
-  value->SetString("name", object_id.name());
+  value->SetString(kNameKey, object_id.name());
+  value->SetInteger(kSourceKey, object_id.source());
   return value;
 }
 
+std::string SerializeInvalidationObjectId(
+    const invalidation::InvalidationObjectId& object_id) {
+  std::unique_ptr<base::DictionaryValue> value =
+      InvalidationObjectIdToValue(object_id);
+  std::string serialized_id;
+  JSONStringValueSerializer serializer(&serialized_id);
+  serializer.Serialize(*value);
+  return serialized_id;
+}
+
+bool DeserializeInvalidationObjectId(const std::string& serialized_id,
+                                     invalidation::InvalidationObjectId* id) {
+  JSONStringValueDeserializer deserializer(serialized_id);
+  int error_code;
+  std::string error_msg;
+  std::unique_ptr<base::Value> value =
+      deserializer.Deserialize(&error_code, &error_msg);
+  base::DictionaryValue* dict = nullptr;
+
+  if (!value->GetAsDictionary(&dict)) {
+    DLOG(WARNING) << "Unable to get dictionary";
+    return false;
+  }
+
+  int source = 0;
+  if (!dict->GetInteger(kSourceKey, &source)) {
+    DLOG(WARNING) << "Unable to deserialize source";
+    return false;
+  }
+
+  std::string name;
+  if (!dict->GetString(kNameKey, &name)) {
+    DLOG(WARNING) << "Unable to deserialize name";
+    return false;
+  }
+  id->Init(source, name);
+  return true;
+}
+
 std::string InvalidationObjectIdToString(
     const invalidation::InvalidationObjectId& object_id) {
   std::string str;

diff --git a/components/invalidation/public/invalidation_util.h b/components/invalidation/public/invalidation_util.h
index 2ce765f..8b325957 100644
--- a/components/invalidation/public/invalidation_util.h
+++ b/components/invalidation/public/invalidation_util.h

@@ -79,6 +79,12 @@
 std::unique_ptr<base::DictionaryValue> InvalidationObjectIdToValue(
     const invalidation::InvalidationObjectId& object_id);
 
+// TODO(melandory): figure out the security implications for such serialization.
+std::string SerializeInvalidationObjectId(
+    const invalidation::InvalidationObjectId& object_id);
+bool DeserializeInvalidationObjectId(const std::string& serialized,
+                                     invalidation::InvalidationObjectId* id);
+
 INVALIDATION_EXPORT std::string InvalidationObjectIdToString(
     const invalidation::InvalidationObjectId& object_id);
 

diff --git a/components/invalidation/public/invalidation_util_unittest.cc b/components/invalidation/public/invalidation_util_unittest.cc
new file mode 100644
index 0000000..c56f5d14
--- /dev/null
+++ b/components/invalidation/public/invalidation_util_unittest.cc

@@ -0,0 +1,27 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/invalidation/public/invalidation_util.h"
+
+#include "components/invalidation/public/invalidation_object_id.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace syncer {
+
+class InvalidationObjectIdSerializationTest : public testing::Test {
+ public:
+  InvalidationObjectIdSerializationTest() : kObjectId_(10, "ASDF") {}
+
+  const invalidation::InvalidationObjectId kObjectId_;
+};
+
+TEST_F(InvalidationObjectIdSerializationTest,
+       ShouldCorrectlyDeserializeSerialized) {
+  std::string serialized = SerializeInvalidationObjectId(kObjectId_);
+  invalidation::InvalidationObjectId id;
+  DeserializeInvalidationObjectId(serialized, &id);
+  EXPECT_EQ(kObjectId_, id);
+}
+
+}  // namespace syncer

diff --git a/components/offline_pages/core/prefetch/BUILD.gn b/components/offline_pages/core/prefetch/BUILD.gn
index 00f782d7..b360751 100644
--- a/components/offline_pages/core/prefetch/BUILD.gn
+++ b/components/offline_pages/core/prefetch/BUILD.gn

@@ -88,6 +88,7 @@
     "store/prefetch_store_utils.h",
     "suggested_articles_observer.cc",
     "suggested_articles_observer.h",
+    "suggestions_provider.cc",
     "suggestions_provider.h",
     "thumbnail_fetcher.h",
   ]

diff --git a/components/offline_pages/core/prefetch/suggestions_provider.cc b/components/offline_pages/core/prefetch/suggestions_provider.cc
new file mode 100644
index 0000000..bb38e28
--- /dev/null
+++ b/components/offline_pages/core/prefetch/suggestions_provider.cc

@@ -0,0 +1,17 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/offline_pages/core/prefetch/suggestions_provider.h"
+
+namespace offline_pages {
+
+PrefetchSuggestion::PrefetchSuggestion() = default;
+
+PrefetchSuggestion::PrefetchSuggestion(const PrefetchSuggestion&) = default;
+
+PrefetchSuggestion::PrefetchSuggestion(PrefetchSuggestion&&) = default;
+
+PrefetchSuggestion::~PrefetchSuggestion() = default;
+
+}  // namespace offline_pages

diff --git a/components/offline_pages/core/prefetch/suggestions_provider.h b/components/offline_pages/core/prefetch/suggestions_provider.h
index 3a94567..9b0150df 100644
--- a/components/offline_pages/core/prefetch/suggestions_provider.h
+++ b/components/offline_pages/core/prefetch/suggestions_provider.h

@@ -16,6 +16,8 @@
 // Data struct for a suggestion of an article to be prefetched.
 struct PrefetchSuggestion {
   PrefetchSuggestion();
+  PrefetchSuggestion(const PrefetchSuggestion&);
+  PrefetchSuggestion(PrefetchSuggestion&&);
   ~PrefetchSuggestion();
 
   // The URL of the suggested article. It acts as a unique key for the

diff --git a/components/test/data/autofill/automated_integration/action_recorder_extension/background/background.js b/components/test/data/autofill/automated_integration/action_recorder_extension/background/background.js
index efbf0ac5..7bccd7f7 100644
--- a/components/test/data/autofill/automated_integration/action_recorder_extension/background/background.js
+++ b/components/test/data/autofill/automated_integration/action_recorder_extension/background/background.js

@@ -312,7 +312,7 @@
               frameId: targetFrame.parentFrameId
             })
             .then((frameName) => {
-              if (frameName !== '') {
+              if (frameName !== '' && frameName !== undefined) {
                 context.browserTest = { name: frameName };
                 resolve(context);
               } else {
@@ -699,19 +699,6 @@
     if (!request) return false;
     switch (request.type) {
       // Tab commands.
-      // Query for a frame's frame id and parent frame id.
-      case RecorderMsgEnum.GET_FRAME_CONTEXT:
-        getIframeContext(sender.tab.id, sender.frameId, request.location)
-        .then((context) => {
-          sendResponse(context);
-        })
-        .catch((error) => {
-          console.error(
-              `Unable to query for context on tab ${sender.tab.id}, ` +
-              `frame ${sender.frameId}!\r\n`,
-              error);
-        });
-        return true;
       case RecorderMsgEnum.SAVE:
         downloadRecipe()
         .then(() => sendResponse(true));

diff --git a/components/test/data/autofill/automated_integration/action_recorder_extension/content/action_handler.js b/components/test/data/autofill/automated_integration/action_recorder_extension/content/action_handler.js
index 4f467d1..26b7576 100644
--- a/components/test/data/autofill/automated_integration/action_recorder_extension/content/action_handler.js
+++ b/components/test/data/autofill/automated_integration/action_recorder_extension/content/action_handler.js

@@ -54,11 +54,13 @@
           // Disabled. Class list is simply too mutable, especially in the
           // case where an element changes class on hover or on focus.
           continue;
-        } else if (attr === 'title') {
-          // 'title' is an attribute inserted by Chrome Autofill to predict
-          // how the field should be filled. Since this attribute is inserted
-          // by Chrome, it may change from build to build. Skip this
-          // attribute.
+        } else if (attr === 'autofill-prediction' ||
+                   attr === 'field_signature' ||
+                   attr === 'pm_parser_annotation' ||
+                   attr === 'title') {
+          // These attributes are inserted by Chrome.
+          // Since Chrome sets these attributes, these attributes may change
+          // from build to build. Skip these attributes.
           continue;
         } else {
           attributes.push(`@${attr}`);
@@ -174,8 +176,8 @@
     return build(target);
   };
 
-  let autofillTriggerElementSelector = null;
-  let lastTypingEventTargetValue = null;
+  let autofillTriggerElementInfo = null;
+  let lastTypingEventInfo = null;
   let frameContext;
   let mutationObserver = null;
   let started = false;
@@ -197,6 +199,18 @@
     return element.getAttribute('type') === 'password';
   }
 
+  function isChromeRecognizedPasswordField(element) {
+    const passwordManagerParserAnnotation =
+        element.getAttribute('pm_parser_annotation');
+    return passwordManagerParserAnnotation === 'password_element' ||
+           passwordManagerParserAnnotation === 'new_password_element' ||
+           passwordManagerParserAnnotation === 'confirmation_password_element';
+  }
+
+  function isChromeRecognizedUserNameField(element) {
+    return element.getAttribute('pm_parser_annotation') === 'username_element';
+  }
+
   function canTriggerAutofill(element) {
     return (element.localName === 'input' &&
             ['checkbox', 'radio', 'button', 'submit', 'hidden', 'reset']
@@ -288,7 +302,9 @@
         }
         addActionToRecipe(action);
       }
-    } else if (lastTypingEventTargetValue === event.target.value) {
+    } else if (lastTypingEventInfo &&
+               lastTypingEventInfo.target === event.target &&
+               lastTypingEventInfo.value === event.target.value) {
       console.log(`Typing detected on: ${selector}`);
 
       // Distinguish between typing inside password input fields and
@@ -317,11 +333,16 @@
     } else {
       // If the user has previously clicked on a field that can trigger
       // autofill, add a trigger autofill action.
-      if (autofillTriggerElementSelector !== null) {
-        console.log(`Triggered autofill on ${autofillTriggerElementSelector}`);
-        action.type = 'autofill';
-        addActionToRecipe(action);
-        autofillTriggerElementSelector = null;
+      if (autofillTriggerElementInfo !== null) {
+        console.log(`Triggered autofill on ${autofillTriggerElementInfo.selector}`);
+        let autofillAction = {
+          selector: autofillTriggerElementInfo.selector,
+          context: frameContext,
+          visibility: autofillTriggerElementInfo.visibility
+        };
+        autofillAction.type = 'autofill';
+        addActionToRecipe(autofillAction);
+        autofillTriggerElementInfo = null;
       }
       action.type = 'validateField';
       action.expectedValue = event.target.value;
@@ -367,7 +388,10 @@
         // the element selector path, as the user could have clicked
         // this element to trigger autofill.
         if (isAutofillableElement(element) && canTriggerAutofill(element)) {
-          autofillTriggerElementSelector = selector;
+          autofillTriggerElementInfo = {
+            selector: selector,
+            visibility: elementReadyState
+          }
         }
       } else {
         addActionToRecipe({
@@ -376,7 +400,7 @@
           context: frameContext,
           type: 'click'
         });
-        autofillTriggerElementSelector = null;
+        autofillTriggerElementInfo = null;
       }
     } else if (event.button === Buttons.RIGHT_BUTTON) {
       const element = event.target;
@@ -407,58 +431,53 @@
     }
 
     if (isEditableInputElement(event.target)) {
-      lastTypingEventTargetValue = event.target.value;
+      lastTypingEventInfo = {
+        target: event.target,
+        value: event.target.value
+      }
     } else {
-      lastTypingEventTargetValue = null;
+      lastTypingEventInfo = null;
     }
   }
 
-  function startRecording() {
-    const promise =
-      // First, obtain the current frame's context.
-      sendRuntimeMessageToBackgroundScript({
-          type: RecorderMsgEnum.GET_FRAME_CONTEXT,
-          location: location})
-      .then((context) => {
-        frameContext = context;
-        // Register on change listeners on all the input elements.
-        registerOnInputChangeActionListener(document);
-        // Register a mouse up listener on the entire document.
-        //
-        // The content script registers a 'Mouse Up' listener rather than a
-        // 'Mouse Down' to correctly handle the following scenario:
-        //
-        // A user types inside a search box, then clicks the search button.
-        //
-        // The following events will fire in quick chronological succession:
-        // * Mouse down on the search button.
-        // * Change on the search input box.
-        // * Mouse up on the search button.
-        //
-        // To capture the correct sequence of actions, the content script
-        // should tie left mouse click actions to the mouseup event.
-        document.addEventListener('mouseup', onClickActionHander);
-        // Register a key press listener on the entire document.
-        document.addEventListener('keyup', onKeyUpActionHandler);
-        // Setup mutation observer to listen for event on nodes added after
-        // recording starts.
-        mutationObserver = new MutationObserver((mutations) => {
-          mutations.forEach(mutation => {
-            mutation.addedNodes.forEach(node => {
-              if (node.nodeType === Node.ELEMENT_NODE) {
-                // Add the onchange listener on any new input elements. This
-                // way the recorder can record user interactions with new
-                // elements.
-                registerOnInputChangeActionListener(node);
-              }
-            });
+  function startRecording(context) {
+      frameContext = context;
+      // Register on change listeners on all the input elements.
+      registerOnInputChangeActionListener(document);
+      // Register a mouse up listener on the entire document.
+      //
+      // The content script registers a 'Mouse Up' listener rather than a
+      // 'Mouse Down' to correctly handle the following scenario:
+      //
+      // A user types inside a search box, then clicks the search button.
+      //
+      // The following events will fire in quick chronological succession:
+      // * Mouse down on the search button.
+      // * Change on the search input box.
+      // * Mouse up on the search button.
+      //
+      // To capture the correct sequence of actions, the content script
+      // should tie left mouse click actions to the mouseup event.
+      document.addEventListener('mouseup', onClickActionHander);
+      // Register a key press listener on the entire document.
+      document.addEventListener('keyup', onKeyUpActionHandler);
+      // Setup mutation observer to listen for event on nodes added after
+      // recording starts.
+      mutationObserver = new MutationObserver((mutations) => {
+        mutations.forEach(mutation => {
+          mutation.addedNodes.forEach(node => {
+            if (node.nodeType === Node.ELEMENT_NODE) {
+              // Add the onchange listener on any new input elements. This
+              // way the recorder can record user interactions with new
+              // elements.
+              registerOnInputChangeActionListener(node);
+            }
           });
         });
-        mutationObserver.observe(document, {childList: true, subtree: true});
-        started = true;
-        return Promise.resolve();
       });
-    return promise;
+      mutationObserver.observe(document, {childList: true, subtree: true});
+      started = true;
+      return Promise.resolve();
   }
 
   function stopRecording() {
@@ -476,8 +495,7 @@
     const iframes = document.querySelectorAll('iframe');
     // Find the target iframe.
     for (let index = 0; index < iframes.length; index++) {
-      const url = new URL(iframes[index].src,
-                          `${location.protocol}//${location.host}`);
+      const url = new URL(iframes[index].src, location.origin);
       // Try to identify the iframe using the entire URL.
       if (frameLocation.href === url.href) {
         iframe = iframes[index];
@@ -490,8 +508,7 @@
       // To handle the scenario described above, this code optionally ignores
       // the iframe url's hash.
       if (iframes === null &&
-          frameLocation.protocol === url.protocol &&
-          frameLocation.host === url.host &&
+          frameLocation.origin === url.origin &&
           frameLocation.pathname === url.pathname &&
           frameLocation.search === url.search) {
         iframe = iframes[index];
@@ -514,7 +531,7 @@
     if (!request) return;
     switch (request.type) {
       case RecorderMsgEnum.START:
-        startRecording()
+        startRecording(request.frameContext)
         .then(() => sendResponse(true))
         .catch((error) => {
           sendResponse(false);
@@ -528,6 +545,7 @@
         sendResponse(true);
         break;
       case RecorderMsgEnum.GET_IFRAME_NAME:
+        console.log(`Cross: ${request.url}`);
         queryIframeName(request.url)
         .then((context) => {
           sendResponse(context);

diff --git a/components/ukm/test_ukm_recorder.h b/components/ukm/test_ukm_recorder.h
index 7db123e2..6950c3c 100644
--- a/components/ukm/test_ukm_recorder.h
+++ b/components/ukm/test_ukm_recorder.h

@@ -36,6 +36,7 @@
   size_t entries_count() const { return entries().size(); }
 
   using UkmRecorderImpl::UpdateSourceURL;
+  using UkmRecorderImpl::RecordOtherURL;
 
   // Gets all recorded UkmSource data.
   const std::map<ukm::SourceId, std::unique_ptr<UkmSource>>& GetSources()

diff --git a/components/ukm/ukm_recorder_impl.h b/components/ukm/ukm_recorder_impl.h
index fbd3578b..028323b 100644
--- a/components/ukm/ukm_recorder_impl.h
+++ b/components/ukm/ukm_recorder_impl.h

@@ -84,6 +84,7 @@
   // UkmRecorder:
   void UpdateSourceURL(SourceId source_id, const GURL& url) override;
   void UpdateAppURL(SourceId source_id, const GURL& url) override;
+  using UkmRecorder::RecordOtherURL;
 
   virtual bool ShouldRestrictToWhitelistedSourceIds() const;
 

diff --git a/components/update_client/action_runner.cc b/components/update_client/action_runner.cc
index 7b823bb..3e5a7d5 100644
--- a/components/update_client/action_runner.cc
+++ b/components/update_client/action_runner.cc

@@ -44,7 +44,7 @@
 
 void ActionRunner::Unpack(
     std::unique_ptr<service_manager::Connector> connector) {
-  const auto& installer = component_.crx_component()->installer;
+  const auto installer = component_.crx_component()->installer;
 
   base::FilePath file_path;
   installer->GetInstalledFile(component_.action_run(), &file_path);

diff --git a/components/update_client/component.cc b/components/update_client/component.cc
index aba3bff..9ca75b69 100644
--- a/components/update_client/component.cc
+++ b/components/update_client/component.cc

@@ -256,7 +256,7 @@
 
   DCHECK_EQ(ComponentState::kNew, state());
 
-  crx_component_ = std::make_unique<CrxComponent>();
+  crx_component_ = CrxComponent();
   crx_component_->version = version;
 
   previous_version_ = version;

diff --git a/components/update_client/component.h b/components/update_client/component.h
index e9adacd7..bb42d07 100644
--- a/components/update_client/component.h
+++ b/components/update_client/component.h

@@ -73,9 +73,11 @@
 
   std::string id() const { return id_; }
 
-  const CrxComponent* crx_component() const { return crx_component_.get(); }
-  void set_crx_component(std::unique_ptr<CrxComponent> crx_component) {
-    crx_component_ = std::move(crx_component);
+  const base::Optional<CrxComponent>& crx_component() const {
+    return crx_component_;
+  }
+  void set_crx_component(const CrxComponent& crx_component) {
+    crx_component_ = crx_component;
   }
 
   const base::Version& previous_version() const { return previous_version_; }
@@ -371,7 +373,7 @@
   base::ThreadChecker thread_checker_;
 
   const std::string id_;
-  std::unique_ptr<CrxComponent> crx_component_;
+  base::Optional<CrxComponent> crx_component_;
 
   // The status of the updatecheck response.
   std::string status_;

diff --git a/components/update_client/crx_update_item.h b/components/update_client/crx_update_item.h
index 9fd7398..ac645b5 100644
--- a/components/update_client/crx_update_item.h
+++ b/components/update_client/crx_update_item.h

@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/time/time.h"
 #include "base/version.h"
 #include "components/update_client/crx_downloader.h"
@@ -27,7 +28,12 @@
   ComponentState state;
 
   std::string id;
-  CrxComponent component;
+
+  // The value of this data member is provided to the |UpdateClient| by the
+  // caller by responding to the |CrxDataCallback|. If the caller can't
+  // provide this value, for instance, in cases where the CRX was uninstalled,
+  // then the |component| member will not be present.
+  base::Optional<CrxComponent> component;
 
   // Time when an update check for this CRX has happened.
   base::TimeTicks last_check;

diff --git a/components/update_client/ping_manager_unittest.cc b/components/update_client/ping_manager_unittest.cc
index 29e5481..3e0b9db9 100644
--- a/components/update_client/ping_manager_unittest.cc
+++ b/components/update_client/ping_manager_unittest.cc

@@ -112,7 +112,7 @@
 
   {
     Component component(*update_context, "abc");
-    component.crx_component_ = std::make_unique<CrxComponent>();
+    component.crx_component_ = CrxComponent();
     component.state_ = std::make_unique<Component::StateUpdated>(&component);
     component.previous_version_ = base::Version("1.0");
     component.next_version_ = base::Version("2.0");
@@ -145,7 +145,7 @@
   {
     // Test eventresult="0" is sent for failed updates.
     Component component(*update_context, "abc");
-    component.crx_component_ = std::make_unique<CrxComponent>();
+    component.crx_component_ = CrxComponent();
     component.state_ =
         std::make_unique<Component::StateUpdateError>(&component);
     component.previous_version_ = base::Version("1.0");
@@ -169,7 +169,7 @@
   {
     // Test the error values and the fingerprints.
     Component component(*update_context, "abc");
-    component.crx_component_ = std::make_unique<CrxComponent>();
+    component.crx_component_ = CrxComponent();
     component.state_ =
         std::make_unique<Component::StateUpdateError>(&component);
     component.previous_version_ = base::Version("1.0");
@@ -206,7 +206,7 @@
   {
     // Test an invalid |next_version| is not serialized.
     Component component(*update_context, "abc");
-    component.crx_component_ = std::make_unique<CrxComponent>();
+    component.crx_component_ = CrxComponent();
     component.state_ =
         std::make_unique<Component::StateUpdateError>(&component);
     component.previous_version_ = base::Version("1.0");
@@ -230,7 +230,7 @@
     // Test a valid |previouversion| and |next_version| = base::Version("0")
     // are serialized correctly under <event...> for uninstall.
     Component component(*update_context, "abc");
-    component.crx_component_ = std::make_unique<CrxComponent>();
+    component.crx_component_ = CrxComponent();
     component.Uninstall(base::Version("1.2.3.4"), 0);
     component.AppendEvent(BuildUninstalledEventElement(component));
 
@@ -251,7 +251,7 @@
   {
     // Test the download metrics.
     Component component(*update_context, "abc");
-    component.crx_component_ = std::make_unique<CrxComponent>();
+    component.crx_component_ = CrxComponent();
     component.state_ = std::make_unique<Component::StateUpdated>(&component);
     component.previous_version_ = base::Version("1.0");
     component.next_version_ = base::Version("2.0");
@@ -309,7 +309,7 @@
   const auto update_context = MakeMockUpdateContext();
 
   Component component(*update_context, "abc");
-  component.crx_component_ = std::make_unique<CrxComponent>();
+  component.crx_component_ = CrxComponent();
 
   // The default value for |requires_network_encryption| is true.
   EXPECT_TRUE(component.crx_component_->requires_network_encryption);

diff --git a/components/update_client/protocol_builder.cc b/components/update_client/protocol_builder.cc
index e708c46..54a172e 100644
--- a/components/update_client/protocol_builder.cc
+++ b/components/update_client/protocol_builder.cc

@@ -336,7 +336,7 @@
     DCHECK_EQ(1u, components.count(id));
     const auto& component = *components.at(id);
     const auto& component_id = component.id();
-    const auto* crx_component = component.crx_component();
+    const auto crx_component = component.crx_component();
 
     DCHECK(crx_component);
 

diff --git a/components/update_client/update_checker_unittest.cc b/components/update_client/update_checker_unittest.cc
index dd521b3f6..753d87d 100644
--- a/components/update_client/update_checker_unittest.cc
+++ b/components/update_client/update_checker_unittest.cc

@@ -227,17 +227,16 @@
 }
 
 std::unique_ptr<Component> UpdateCheckerTest::MakeComponent() const {
-  std::unique_ptr<CrxComponent> crx_component =
-      std::make_unique<CrxComponent>();
-  crx_component->name = "test_jebg";
-  crx_component->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-  crx_component->installer = nullptr;
-  crx_component->version = base::Version("0.9");
-  crx_component->fingerprint = "fp1";
+  CrxComponent crx_component;
+  crx_component.name = "test_jebg";
+  crx_component.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+  crx_component.installer = nullptr;
+  crx_component.version = base::Version("0.9");
+  crx_component.fingerprint = "fp1";
 
   auto component = std::make_unique<Component>(*update_context_, kUpdateItemId);
   component->state_ = std::make_unique<Component::StateNew>(component.get());
-  component->crx_component_ = std::move(crx_component);
+  component->crx_component_ = crx_component;
 
   return component;
 }
@@ -621,7 +620,7 @@
   components[kUpdateItemId] = MakeComponent();
 
   auto& component = components[kUpdateItemId];
-  auto* crx_component = const_cast<CrxComponent*>(component->crx_component());
+  auto crx_component = component->crx_component();
 
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -652,6 +651,7 @@
   update_context_->is_foreground = false;
   crx_component->install_source = "webstore";
   crx_component->install_location = "external";
+  component->set_crx_component(*crx_component);
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
       test_file("updatecheck_reply_1.xml")));
@@ -668,6 +668,7 @@
   update_context_->is_foreground = true;
   crx_component->install_source = "sideload";
   crx_component->install_location = "policy";
+  component->set_crx_component(*crx_component);
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
       test_file("updatecheck_reply_1.xml")));
@@ -689,7 +690,7 @@
   components[kUpdateItemId] = MakeComponent();
 
   auto& component = components[kUpdateItemId];
-  auto* crx_component = const_cast<CrxComponent*>(component->crx_component());
+  auto crx_component = component->crx_component();
 
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -705,6 +706,7 @@
   EXPECT_THAT(body0, testing::Not(testing::HasSubstr("<disabled")));
 
   crx_component->disabled_reasons = {};
+  component->set_crx_component(*crx_component);
   update_checker_ = UpdateChecker::Create(config_, metadata_.get());
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -720,6 +722,7 @@
   EXPECT_THAT(body1, testing::Not(testing::HasSubstr("<disabled")));
 
   crx_component->disabled_reasons = {0};
+  component->set_crx_component(*crx_component);
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
       test_file("updatecheck_reply_1.xml")));
@@ -734,6 +737,7 @@
   EXPECT_THAT(body2, testing::HasSubstr(R"(<disabled reason="0")"));
 
   crx_component->disabled_reasons = {1};
+  component->set_crx_component(*crx_component);
   update_checker_ = UpdateChecker::Create(config_, metadata_.get());
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -749,6 +753,7 @@
   EXPECT_THAT(body3, testing::HasSubstr(R"(<disabled reason="1")"));
 
   crx_component->disabled_reasons = {4, 8, 16};
+  component->set_crx_component(*crx_component);
   update_checker_ = UpdateChecker::Create(config_, metadata_.get());
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -766,6 +771,7 @@
   EXPECT_THAT(body4, testing::HasSubstr(R"(<disabled reason="16")"));
 
   crx_component->disabled_reasons = {0, 4, 8, 16};
+  component->set_crx_component(*crx_component);
   update_checker_ = UpdateChecker::Create(config_, metadata_.get());
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -792,14 +798,14 @@
   components[kUpdateItemId] = MakeComponent();
 
   auto& component = components[kUpdateItemId];
+  auto crx_component = component->crx_component();
 
   // Tests the scenario where:
   //  * the component does not support group policies.
   //  * the component updates are disabled.
   // Expects the group policy to be ignored and the update check to not
   // include the "updatedisabled" attribute.
-  EXPECT_FALSE(component->crx_component_
-                   ->supports_group_policy_enable_component_updates);
+  EXPECT_FALSE(crx_component->supports_group_policy_enable_component_updates);
 
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -818,8 +824,8 @@
   //  * the component supports group policies.
   //  * the component updates are disabled.
   // Expects the update check to include the "updatedisabled" attribute.
-  component->crx_component_->supports_group_policy_enable_component_updates =
-      true;
+  crx_component->supports_group_policy_enable_component_updates = true;
+  component->set_crx_component(*crx_component);
   update_checker_ = UpdateChecker::Create(config_, metadata_.get());
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -839,8 +845,8 @@
   //  * the component does not support group policies.
   //  * the component updates are enabled.
   // Expects the update check to not include the "updatedisabled" attribute.
-  component->crx_component_->supports_group_policy_enable_component_updates =
-      false;
+  crx_component->supports_group_policy_enable_component_updates = false;
+  component->set_crx_component(*crx_component);
   update_checker_ = UpdateChecker::Create(config_, metadata_.get());
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),
@@ -859,8 +865,8 @@
   //  * the component supports group policies.
   //  * the component updates are enabled.
   // Expects the update check to not include the "updatedisabled" attribute.
-  component->crx_component_->supports_group_policy_enable_component_updates =
-      true;
+  crx_component->supports_group_policy_enable_component_updates = true;
+  component->set_crx_component(*crx_component);
   update_checker_ = UpdateChecker::Create(config_, metadata_.get());
   EXPECT_TRUE(post_interceptor_->ExpectRequest(
       std::make_unique<PartialMatch>("updatecheck"),

diff --git a/components/update_client/update_client.cc b/components/update_client/update_client.cc
index 561bbcf9..ea69825 100644
--- a/components/update_client/update_client.cc
+++ b/components/update_client/update_client.cc

@@ -37,21 +37,15 @@
 namespace update_client {
 
 CrxUpdateItem::CrxUpdateItem() : state(ComponentState::kNew) {}
-
-CrxUpdateItem::~CrxUpdateItem() {
-}
-
+CrxUpdateItem::~CrxUpdateItem() = default;
 CrxUpdateItem::CrxUpdateItem(const CrxUpdateItem& other) = default;
 
 CrxComponent::CrxComponent()
     : allows_background_download(true),
       requires_network_encryption(true),
       supports_group_policy_enable_component_updates(false) {}
-
 CrxComponent::CrxComponent(const CrxComponent& other) = default;
-
-CrxComponent::~CrxComponent() {
-}
+CrxComponent::~CrxComponent() = default;
 
 // It is important that an instance of the UpdateClient binds an unretained
 // pointer to itself. Otherwise, a life time circular dependency between this

diff --git a/components/update_client/update_client.h b/components/update_client/update_client.h
index d8d546a1..0577a15 100644
--- a/components/update_client/update_client.h
+++ b/components/update_client/update_client.h

@@ -8,12 +8,12 @@
 #include <stdint.h>
 
 #include <map>
-#include <memory>
 #include <string>
 #include <vector>
 
 #include "base/callback_forward.h"
 #include "base/memory/ref_counted.h"
+#include "base/optional.h"
 #include "base/version.h"
 #include "components/update_client/update_client_errors.h"
 
@@ -211,7 +211,6 @@
 // may be used in the update checks requests.
 using InstallerAttributes = std::map<std::string, std::string>;
 
-// TODO(sorin): this structure will be refactored soon.
 struct CrxComponent {
   CrxComponent();
   CrxComponent(const CrxComponent& other);
@@ -275,7 +274,7 @@
 class UpdateClient : public base::RefCounted<UpdateClient> {
  public:
   using CrxDataCallback =
-      base::OnceCallback<std::vector<std::unique_ptr<CrxComponent>>(
+      base::OnceCallback<std::vector<base::Optional<CrxComponent>>(
           const std::vector<std::string>& ids)>;
 
   // Defines an interface to observe the UpdateClient. It provides

diff --git a/components/update_client/update_client_unittest.cc b/components/update_client/update_client_unittest.cc
index 0418cf7..7e652b8 100644
--- a/components/update_client/update_client_unittest.cc
+++ b/components/update_client/update_client_unittest.cc

@@ -215,15 +215,14 @@
 TEST_F(UpdateClientTest, OneCrxNoUpdate) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.9");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.9");
+      crx.installer = base::MakeRefCounted<TestInstaller>();
+      std::vector<base::Optional<CrxComponent>> component = {crx};
       return component;
     }
   };
@@ -326,24 +325,21 @@
 TEST_F(UpdateClientTest, TwoCrxUpdateNoUpdate) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx1 = std::make_unique<CrxComponent>();
-      crx1->name = "test_jebg";
-      crx1->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx1->version = base::Version("0.9");
-      crx1->installer = base::MakeRefCounted<TestInstaller>();
+      CrxComponent crx1;
+      crx1.name = "test_jebg";
+      crx1.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx1.version = base::Version("0.9");
+      crx1.installer = base::MakeRefCounted<TestInstaller>();
 
-      std::unique_ptr<CrxComponent> crx2 = std::make_unique<CrxComponent>();
-      crx2->name = "test_abag";
-      crx2->pk_hash.assign(abag_hash, abag_hash + base::size(abag_hash));
-      crx2->version = base::Version("2.2");
-      crx2->installer = base::MakeRefCounted<TestInstaller>();
+      CrxComponent crx2;
+      crx2.name = "test_abag";
+      crx2.pk_hash.assign(abag_hash, abag_hash + base::size(abag_hash));
+      crx2.version = base::Version("2.2");
+      crx2.installer = base::MakeRefCounted<TestInstaller>();
 
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx1));
-      component.push_back(std::move(crx2));
-      return component;
+      return {crx1, crx2};
     }
   };
 
@@ -545,24 +541,21 @@
 TEST_F(UpdateClientTest, TwoCrxUpdateFirstServerIgnoresSecond) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx1 = std::make_unique<CrxComponent>();
-      crx1->name = "test_jebg";
-      crx1->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx1->version = base::Version("0.9");
-      crx1->installer = base::MakeRefCounted<TestInstaller>();
+      CrxComponent crx1;
+      crx1.name = "test_jebg";
+      crx1.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx1.version = base::Version("0.9");
+      crx1.installer = base::MakeRefCounted<TestInstaller>();
 
-      std::unique_ptr<CrxComponent> crx2 = std::make_unique<CrxComponent>();
-      crx2->name = "test_abag";
-      crx2->pk_hash.assign(abag_hash, abag_hash + base::size(abag_hash));
-      crx2->version = base::Version("2.2");
-      crx2->installer = base::MakeRefCounted<TestInstaller>();
+      CrxComponent crx2;
+      crx2.name = "test_abag";
+      crx2.pk_hash.assign(abag_hash, abag_hash + base::size(abag_hash));
+      crx2.version = base::Version("2.2");
+      crx2.installer = base::MakeRefCounted<TestInstaller>();
 
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx1));
-      component.push_back(std::move(crx2));
-      return component;
+      return {crx1, crx2};
     }
   };
 
@@ -734,7 +727,7 @@
         .Times(1)
         .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
           CrxUpdateItem item;
-          update_client->GetCrxUpdateState(id, &item);
+          EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
           EXPECT_EQ(ComponentState::kUpdateError, item.state);
           EXPECT_EQ(5, static_cast<int>(item.error_category));
           EXPECT_EQ(-10004, item.error_code);
@@ -763,18 +756,14 @@
 TEST_F(UpdateClientTest, TwoCrxUpdateNoCrxComponentData) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.9");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      component.push_back(std::move(nullptr));
-      return component;
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.9");
+      crx.installer = base::MakeRefCounted<TestInstaller>();
+      return {crx, base::nullopt};
     }
   };
 
@@ -962,12 +951,9 @@
 TEST_F(UpdateClientTest, TwoCrxUpdateNoCrxComponentDataAtAll) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(nullptr));
-      component.push_back(std::move(nullptr));
-      return component;
+      return {base::nullopt, base::nullopt};
     }
   };
 
@@ -1057,24 +1043,21 @@
 TEST_F(UpdateClientTest, TwoCrxUpdateDownloadTimeout) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx1 = std::make_unique<CrxComponent>();
-      crx1->name = "test_jebg";
-      crx1->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx1->version = base::Version("0.9");
-      crx1->installer = base::MakeRefCounted<TestInstaller>();
+      CrxComponent crx1;
+      crx1.name = "test_jebg";
+      crx1.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx1.version = base::Version("0.9");
+      crx1.installer = base::MakeRefCounted<TestInstaller>();
 
-      std::unique_ptr<CrxComponent> crx2 = std::make_unique<CrxComponent>();
-      crx2->name = "test_ihfo";
-      crx2->pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
-      crx2->version = base::Version("0.8");
-      crx2->installer = base::MakeRefCounted<TestInstaller>();
+      CrxComponent crx2;
+      crx2.name = "test_ihfo";
+      crx2.pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
+      crx2.version = base::Version("0.8");
+      crx2.installer = base::MakeRefCounted<TestInstaller>();
 
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx1));
-      component.push_back(std::move(crx2));
-      return component;
+      return {crx1, crx2};
     }
   };
 
@@ -1287,7 +1270,7 @@
         .Times(1)
         .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
           CrxUpdateItem item;
-          update_client->GetCrxUpdateState(id, &item);
+          EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
           EXPECT_EQ(ComponentState::kUpdateError, item.state);
           EXPECT_EQ(1, static_cast<int>(item.error_category));
           EXPECT_EQ(-118, item.error_code);
@@ -1329,7 +1312,7 @@
 TEST_F(UpdateClientTest, OneCrxDiffUpdate) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
       static int num_calls = 0;
 
@@ -1339,21 +1322,19 @@
 
       ++num_calls;
 
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_ihfo";
-      crx->pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
-      crx->installer = installer;
+      CrxComponent crx;
+      crx.name = "test_ihfo";
+      crx.pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
+      crx.installer = installer;
       if (num_calls == 1) {
-        crx->version = base::Version("0.8");
+        crx.version = base::Version("0.8");
       } else if (num_calls == 2) {
-        crx->version = base::Version("1.0");
+        crx.version = base::Version("1.0");
       } else {
         NOTREACHED();
       }
 
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      return {crx};
     }
   };
 
@@ -1668,7 +1649,7 @@
 
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
       scoped_refptr<MockInstaller> installer =
           base::MakeRefCounted<MockInstaller>();
@@ -1678,15 +1659,13 @@
       EXPECT_CALL(*installer, GetInstalledFile(_, _)).Times(0);
       EXPECT_CALL(*installer, Uninstall()).Times(0);
 
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.9");
-      crx->installer = installer;
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.9");
+      crx.installer = installer;
 
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      return {crx};
     }
   };
 
@@ -1856,7 +1835,7 @@
 TEST_F(UpdateClientTest, OneCrxDiffUpdateFailsFullUpdateSucceeds) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
       static int num_calls = 0;
 
@@ -1866,21 +1845,19 @@
 
       ++num_calls;
 
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_ihfo";
-      crx->pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
-      crx->installer = installer;
+      CrxComponent crx;
+      crx.name = "test_ihfo";
+      crx.pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
+      crx.installer = installer;
       if (num_calls == 1) {
-        crx->version = base::Version("0.8");
+        crx.version = base::Version("0.8");
       } else if (num_calls == 2) {
-        crx->version = base::Version("1.0");
+        crx.version = base::Version("1.0");
       } else {
         NOTREACHED();
       }
 
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      return {crx};
     }
   };
 
@@ -2173,16 +2150,14 @@
 TEST_F(UpdateClientTest, OneCrxNoUpdateQueuedCall) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.9");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.9");
+      crx.installer = base::MakeRefCounted<TestInstaller>();
+      return {crx};
     }
   };
 
@@ -2294,17 +2269,14 @@
 TEST_F(UpdateClientTest, OneCrxInstall) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.0");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.0");
+      crx.installer = base::MakeRefCounted<TestInstaller>();
+      return {crx};
     }
   };
 
@@ -2482,11 +2454,9 @@
 TEST_F(UpdateClientTest, OneCrxInstallNoCrxComponentData) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(nullptr);
-      return component;
+      return {base::nullopt};
     }
   };
 
@@ -2550,7 +2520,20 @@
   InSequence seq;
   EXPECT_CALL(observer, OnEvent(Events::COMPONENT_UPDATE_ERROR,
                                 "jebgalgnebhfojomionfpkfelancnnkf"))
-      .Times(1);
+      .Times(1)
+      .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
+        // Tests that the state of the component when the CrxComponent data
+        // is not provided. In this case, the optional |item.component| instance
+        // is not present.
+        CrxUpdateItem item;
+        EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
+        EXPECT_EQ(ComponentState::kUpdateError, item.state);
+        EXPECT_STREQ("jebgalgnebhfojomionfpkfelancnnkf", item.id.c_str());
+        EXPECT_FALSE(item.component);
+        EXPECT_EQ(ErrorCategory::kService, item.error_category);
+        EXPECT_EQ(static_cast<int>(Error::CRX_NOT_FOUND), item.error_code);
+        EXPECT_EQ(0, item.extra_code1);
+      }));
 
   update_client->AddObserver(&observer);
 
@@ -2568,16 +2551,14 @@
 TEST_F(UpdateClientTest, ConcurrentInstallSameCRX) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.0");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.0");
+      crx.installer = base::MakeRefCounted<TestInstaller>();
+      return {crx};
     }
   };
 
@@ -2695,7 +2676,7 @@
 TEST_F(UpdateClientTest, EmptyIdList) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
       return {};
     }
@@ -2834,16 +2815,14 @@
 TEST_F(UpdateClientTest, RetryAfter) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.9");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.9");
+      crx.installer = base::MakeRefCounted<TestInstaller>();
+      return {crx};
     }
   };
 
@@ -3028,25 +3007,22 @@
 TEST_F(UpdateClientTest, TwoCrxUpdateOneUpdateDisabled) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx1 = std::make_unique<CrxComponent>();
-      crx1->name = "test_jebg";
-      crx1->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx1->version = base::Version("0.9");
-      crx1->installer = base::MakeRefCounted<TestInstaller>();
-      crx1->supports_group_policy_enable_component_updates = true;
+      CrxComponent crx1;
+      crx1.name = "test_jebg";
+      crx1.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx1.version = base::Version("0.9");
+      crx1.installer = base::MakeRefCounted<TestInstaller>();
+      crx1.supports_group_policy_enable_component_updates = true;
 
-      std::unique_ptr<CrxComponent> crx2 = std::make_unique<CrxComponent>();
-      crx2->name = "test_ihfo";
-      crx2->pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
-      crx2->version = base::Version("0.8");
-      crx2->installer = base::MakeRefCounted<TestInstaller>();
+      CrxComponent crx2;
+      crx2.name = "test_ihfo";
+      crx2.pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
+      crx2.version = base::Version("0.8");
+      crx2.installer = base::MakeRefCounted<TestInstaller>();
 
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx1));
-      component.push_back(std::move(crx2));
-      return component;
+      return {crx1, crx2};
     }
   };
 
@@ -3286,16 +3262,14 @@
 TEST_F(UpdateClientTest, OneCrxUpdateCheckFails) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.9");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      std::vector<std::unique_ptr<CrxComponent>> component;
-      component.push_back(std::move(crx));
-      return component;
+      CrxComponent crx;
+      crx.name = "test_jebg";
+      crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+      crx.version = base::Version("0.9");
+      crx.installer = base::MakeRefCounted<TestInstaller>();
+      return {crx};
     }
   };
 
@@ -3372,7 +3346,7 @@
       .Times(1)
       .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
         CrxUpdateItem item;
-        update_client->GetCrxUpdateState(id, &item);
+        EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
         EXPECT_EQ(ComponentState::kUpdateError, item.state);
         EXPECT_EQ(5, static_cast<int>(item.error_category));
         EXPECT_EQ(-1, item.error_code);
@@ -3396,38 +3370,41 @@
 TEST_F(UpdateClientTest, OneCrxErrorUnknownApp) {
   class DataCallbackMock {
    public:
-    static std::vector<std::unique_ptr<CrxComponent>> Callback(
+    static std::vector<base::Optional<CrxComponent>> Callback(
         const std::vector<std::string>& ids) {
-      std::vector<std::unique_ptr<CrxComponent>> component;
-
-      std::unique_ptr<CrxComponent> crx = std::make_unique<CrxComponent>();
-      crx->name = "test_jebg";
-      crx->pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
-      crx->version = base::Version("0.9");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      component.push_back(std::move(crx));
-
-      crx = std::make_unique<CrxComponent>();
-      crx->name = "test_abag";
-      crx->pk_hash.assign(abag_hash, abag_hash + base::size(abag_hash));
-      crx->version = base::Version("0.1");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      component.push_back(std::move(crx));
-
-      crx = std::make_unique<CrxComponent>();
-      crx->name = "test_ihfo";
-      crx->pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
-      crx->version = base::Version("0.2");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      component.push_back(std::move(crx));
-
-      crx = std::make_unique<CrxComponent>();
-      crx->name = "test_gjpm";
-      crx->pk_hash.assign(gjpm_hash, gjpm_hash + base::size(gjpm_hash));
-      crx->version = base::Version("0.3");
-      crx->installer = base::MakeRefCounted<TestInstaller>();
-      component.push_back(std::move(crx));
-
+      std::vector<base::Optional<CrxComponent>> component;
+      {
+        CrxComponent crx;
+        crx.name = "test_jebg";
+        crx.pk_hash.assign(jebg_hash, jebg_hash + base::size(jebg_hash));
+        crx.version = base::Version("0.9");
+        crx.installer = base::MakeRefCounted<TestInstaller>();
+        component.push_back(crx);
+      }
+      {
+        CrxComponent crx;
+        crx.name = "test_abag";
+        crx.pk_hash.assign(abag_hash, abag_hash + base::size(abag_hash));
+        crx.version = base::Version("0.1");
+        crx.installer = base::MakeRefCounted<TestInstaller>();
+        component.push_back(crx);
+      }
+      {
+        CrxComponent crx;
+        crx.name = "test_ihfo";
+        crx.pk_hash.assign(ihfo_hash, ihfo_hash + base::size(ihfo_hash));
+        crx.version = base::Version("0.2");
+        crx.installer = base::MakeRefCounted<TestInstaller>();
+        component.push_back(crx);
+      }
+      {
+        CrxComponent crx;
+        crx.name = "test_gjpm";
+        crx.pk_hash.assign(gjpm_hash, gjpm_hash + base::size(gjpm_hash));
+        crx.version = base::Version("0.3");
+        crx.installer = base::MakeRefCounted<TestInstaller>();
+        component.push_back(crx);
+      }
       return component;
     }
   };
@@ -3520,7 +3497,7 @@
         .Times(1)
         .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
           CrxUpdateItem item;
-          update_client->GetCrxUpdateState(id, &item);
+          EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
           EXPECT_EQ(ComponentState::kUpdateError, item.state);
           EXPECT_EQ(5, static_cast<int>(item.error_category));
           EXPECT_EQ(-10006, item.error_code);  // UNKNOWN_APPPLICATION.
@@ -3537,7 +3514,7 @@
         .Times(1)
         .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
           CrxUpdateItem item;
-          update_client->GetCrxUpdateState(id, &item);
+          EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
           EXPECT_EQ(ComponentState::kUpdateError, item.state);
           EXPECT_EQ(5, static_cast<int>(item.error_category));
           EXPECT_EQ(-10007, item.error_code);  // RESTRICTED_APPLICATION.
@@ -3554,7 +3531,7 @@
         .Times(1)
         .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
           CrxUpdateItem item;
-          update_client->GetCrxUpdateState(id, &item);
+          EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
           EXPECT_EQ(ComponentState::kUpdateError, item.state);
           EXPECT_EQ(5, static_cast<int>(item.error_category));
           EXPECT_EQ(-10008, item.error_code);  // INVALID_APPID.
@@ -3571,7 +3548,7 @@
         .Times(1)
         .WillOnce(Invoke([&update_client](Events event, const std::string& id) {
           CrxUpdateItem item;
-          update_client->GetCrxUpdateState(id, &item);
+          EXPECT_TRUE(update_client->GetCrxUpdateState(id, &item));
           EXPECT_EQ(ComponentState::kUpdateError, item.state);
           EXPECT_EQ(5, static_cast<int>(item.error_category));
           EXPECT_EQ(-10004, item.error_code);  // UPDATE_RESPONSE_NOT_FOUND.
@@ -3742,14 +3719,12 @@
   update_client->Install(
       std::string("gjpmebpgbhcamgdgjcmnjfhggjpgcimm"),
       base::BindOnce([](const std::vector<std::string>& ids) {
-        auto crx = std::make_unique<CrxComponent>();
-        crx->name = "test_niea";
-        crx->pk_hash.assign(gjpm_hash, gjpm_hash + base::size(gjpm_hash));
-        crx->version = base::Version("0.0");
-        crx->installer = base::MakeRefCounted<VersionedTestInstaller>();
-        std::vector<std::unique_ptr<CrxComponent>> component;
-        component.push_back(std::move(crx));
-        return component;
+        CrxComponent crx;
+        crx.name = "test_niea";
+        crx.pk_hash.assign(gjpm_hash, gjpm_hash + base::size(gjpm_hash));
+        crx.version = base::Version("0.0");
+        crx.installer = base::MakeRefCounted<VersionedTestInstaller>();
+        return std::vector<base::Optional<CrxComponent>>{crx};
       }),
       base::BindOnce(
           [](base::OnceClosure quit_closure, Error error) {
@@ -3890,15 +3865,13 @@
       base::BindOnce(
           [](const base::FilePath& unpack_path,
              const std::vector<std::string>& ids) {
-            auto crx = std::make_unique<CrxComponent>();
-            crx->name = "test_niea";
-            crx->pk_hash.assign(gjpm_hash, gjpm_hash + base::size(gjpm_hash));
-            crx->version = base::Version("1.0");
-            crx->installer =
+            CrxComponent crx;
+            crx.name = "test_niea";
+            crx.pk_hash.assign(gjpm_hash, gjpm_hash + base::size(gjpm_hash));
+            crx.version = base::Version("1.0");
+            crx.installer =
                 base::MakeRefCounted<ReadOnlyTestInstaller>(unpack_path);
-            std::vector<std::unique_ptr<CrxComponent>> component;
-            component.push_back(std::move(crx));
-            return component;
+            return std::vector<base::Optional<CrxComponent>>{crx};
           },
           unpack_path),
       false,

diff --git a/components/update_client/update_engine.cc b/components/update_client/update_engine.cc
index a778b7d9..0e3dd3ff 100644
--- a/components/update_client/update_engine.cc
+++ b/components/update_client/update_engine.cc

@@ -11,6 +11,7 @@
 #include "base/guid.h"
 #include "base/location.h"
 #include "base/logging.h"
+#include "base/optional.h"
 #include "base/stl_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/prefs/pref_service.h"
@@ -103,7 +104,7 @@
 
   // Calls out to get the corresponding CrxComponent data for the CRXs in this
   // update context.
-  std::vector<std::unique_ptr<CrxComponent>> crx_components =
+  const auto crx_components =
       std::move(update_context->crx_data_callback).Run(update_context->ids);
   DCHECK_EQ(update_context->ids.size(), crx_components.size());
 
@@ -112,12 +113,12 @@
 
     DCHECK(update_context->components[id]->state() == ComponentState::kNew);
 
-    auto& crx_component = crx_components[i];
+    const auto crx_component = crx_components[i];
     if (crx_component) {
       // This component can be checked for updates.
       DCHECK_EQ(id, GetCrxComponentID(*crx_component));
       auto& component = update_context->components[id];
-      component->set_crx_component(std::move(crx_component));
+      component->set_crx_component(*crx_component);
       component->set_previous_version(component->crx_component()->version);
       component->set_previous_fp(component->crx_component()->fingerprint);
       update_context->components_to_check_for_updates.push_back(id);
@@ -379,7 +380,7 @@
   for (const auto& context : update_contexts_) {
     const auto& components = context.second->components;
     const auto it = components.find(id);
-    if (it != components.end() && it->second->crx_component()) {
+    if (it != components.end()) {
       *update_item = it->second->GetCrxUpdateItem();
       return true;
     }

diff --git a/components/variations/net/variations_http_headers.cc b/components/variations/net/variations_http_headers.cc
index c7fb6981..22272050 100644
--- a/components/variations/net/variations_http_headers.cc
+++ b/components/variations/net/variations_http_headers.cc

@@ -141,18 +141,10 @@
   return AppendVariationHeaders(url, incognito, SignedIn::kNo, headers);
 }
 
-std::set<std::string> GetVariationHeaderNames() {
-  std::set<std::string> headers;
-  headers.insert(kClientDataHeader);
-  return headers;
-}
-
 void StripVariationHeaderIfNeeded(const GURL& new_location,
                                   net::URLRequest* request) {
-  if (!ShouldAppendVariationHeaders(new_location)) {
-    for (const std::string& header : GetVariationHeaderNames())
-      request->RemoveRequestHeaderByName(header);
-  }
+  if (!ShouldAppendVariationHeaders(new_location))
+    request->RemoveRequestHeaderByName(kClientDataHeader);
 }
 
 std::unique_ptr<network::SimpleURLLoader>

diff --git a/components/variations/net/variations_http_headers.h b/components/variations/net/variations_http_headers.h
index 402afa3..4530a6d 100644
--- a/components/variations/net/variations_http_headers.h
+++ b/components/variations/net/variations_http_headers.h

@@ -50,9 +50,6 @@
                                            InIncognito incognito,
                                            net::HttpRequestHeaders* headers);
 
-// Returns the HTTP header names which are added by AppendVariationHeaders().
-std::set<std::string> GetVariationHeaderNames();
-
 // Strips the variation header if |new_location| does not point to a location
 // that should receive it. This is being called by the ChromeNetworkDelegate.
 // Components calling AppendVariationsHeaders() don't need to take care of this.

diff --git a/components/viz/service/display/surface_aggregator.cc b/components/viz/service/display/surface_aggregator.cc
index 9dc2839..0e4b289 100644
--- a/components/viz/service/display/surface_aggregator.cc
+++ b/components/viz/service/display/surface_aggregator.cc

@@ -957,27 +957,12 @@
   referenced_surfaces_.insert(surface->surface_id());
   for (const auto& surface_info : child_surfaces) {
     if (will_draw) {
-      // We only pick a surface between primary and fallback if both SurfaceIds
-      // are provided and they have the same FrameSinkId and embed token,
-      // otherwise the only Surface other than fallback that can be shown is the
-      // primary.
-      if (!surface_info.surface_range.start() ||
-          surface_info.surface_range.start()->frame_sink_id() !=
-              surface_info.surface_range.end().frame_sink_id() ||
-          surface_info.surface_range.start()
-                  ->local_surface_id()
-                  .embed_token() != surface_info.surface_range.end()
-                                        .local_surface_id()
-                                        .embed_token()) {
-        damage_ranges_[surface_info.surface_range.end().frame_sink_id()] =
-            std::make_pair(surface_info.surface_range.end().local_surface_id(),
-                           surface_info.surface_range.end().local_surface_id());
-      } else if (surface_info.surface_range.start() !=
-                 surface_info.surface_range.end()) {
-        damage_ranges_[surface_info.surface_range.end().frame_sink_id()] =
-            std::make_pair(
-                surface_info.surface_range.start()->local_surface_id(),
-                surface_info.surface_range.end().local_surface_id());
+      const SurfaceRange& surface_range = surface_info.surface_range;
+      damage_ranges_[surface_range.end().frame_sink_id()].push_back(
+          surface_range);
+      if (surface_range.HasDifferentFrameSinkIds()) {
+        damage_ranges_[surface_range.start()->frame_sink_id()].push_back(
+            surface_range);
       }
     }
 
@@ -1276,11 +1261,12 @@
   if (it == damage_ranges_.end())
     return false;
 
-  const LocalSurfaceId& fallback = it->second.first;
-  const LocalSurfaceId& primary = it->second.second;
-  return (primary == surface_id.local_surface_id()) ||
-         (primary.IsNewerThan(surface_id.local_surface_id()) &&
-          surface_id.local_surface_id().IsNewerThan(fallback));
+  for (const SurfaceRange& surface_range : it->second) {
+    if (surface_range.IsInRangeInclusive(surface_id))
+      return true;
+  }
+
+  return false;
 }
 
 }  // namespace viz

diff --git a/components/viz/service/display/surface_aggregator.h b/components/viz/service/display/surface_aggregator.h
index a2dab40..7647ddb 100644
--- a/components/viz/service/display/surface_aggregator.h
+++ b/components/viz/service/display/surface_aggregator.h

@@ -16,6 +16,7 @@
 #include "components/viz/common/quads/render_pass.h"
 #include "components/viz/common/resources/transferable_resource.h"
 #include "components/viz/common/surfaces/surface_id.h"
+#include "components/viz/common/surfaces/surface_range.h"
 #include "components/viz/service/viz_service_export.h"
 #include "ui/gfx/color_space.h"
 
@@ -276,10 +277,9 @@
   // Tracks UMA stats for SurfaceDrawQuads during a call to Aggregate().
   SurfaceDrawQuadUmaStats uma_stats_;
 
-  // For each FrameSinkId, contains a range of LocalSurfaceIds that will damage
+  // For each FrameSinkId, contains a vector of SurfaceRanges that will damage
   // the display if they're damaged.
-  base::flat_map<FrameSinkId, std::pair<LocalSurfaceId, LocalSurfaceId>>
-      damage_ranges_;
+  base::flat_map<FrameSinkId, std::vector<SurfaceRange>> damage_ranges_;
 
   int32_t display_trace_id_ = -1;
 

diff --git a/components/viz/service/display/surface_aggregator_unittest.cc b/components/viz/service/display/surface_aggregator_unittest.cc
index ebbcce2..471752c6 100644
--- a/components/viz/service/display/surface_aggregator_unittest.cc
+++ b/components/viz/service/display/surface_aggregator_unittest.cc

@@ -2695,7 +2695,6 @@
   LocalSurfaceId id2 = allocator_.GenerateId();
   LocalSurfaceId id3 = allocator_.GenerateId();
   LocalSurfaceId id4 = allocator_.GenerateId();
-  LocalSurfaceId id5 = allocator_.GenerateId();
   SurfaceId fallback_surface_id(kArbitraryFrameSinkId1, id2);
   SurfaceId primary_surface_id(kArbitraryFrameSinkId2, id4);
   Quad embedded_quads[] = {Quad::SolidColorQuad(SK_ColorGREEN, gfx::Rect(5, 5)),
@@ -2726,23 +2725,20 @@
   EXPECT_TRUE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
       SurfaceId(kArbitraryFrameSinkId1, id2)));
 
-  // |id3| is after the fallback but primary has a different FrameSinkId so it
-  // shouldn't damage the display.
-  EXPECT_FALSE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
+  // |id3| is after the fallback and primary has a different FrameSinkId so it
+  // should damage the display.
+  EXPECT_TRUE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
       SurfaceId(kArbitraryFrameSinkId1, id3)));
 
-  // |id3| is before the primary but fallback has a different FrameSinkId so it
-  // shouldn't damage the display.
-  EXPECT_FALSE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
+  // |id3| is before the primary and fallback has a different FrameSinkId so it
+  // should damage the display.
+  EXPECT_TRUE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
       SurfaceId(kArbitraryFrameSinkId2, id3)));
 
   // |id4| is the primary id so it should damage the display.
   EXPECT_TRUE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
       SurfaceId(kArbitraryFrameSinkId2, id4)));
 
-  // |id5| is newer than the primary surface so it shouldn't damage display.
-  EXPECT_FALSE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
-      SurfaceId(kArbitraryFrameSinkId1, id5)));
 
   // This FrameSinkId is not embedded at all so it shouldn't damage the display.
   EXPECT_FALSE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
@@ -2769,9 +2765,8 @@
   CompositorFrame aggregated_frame =
       aggregator_.Aggregate(root_surface_id, GetNextDisplayTimeAndIncrement());
 
-  // |id1| is before the primary id but there is no fallback so it shouldn't
-  // damage the display.
-  EXPECT_FALSE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
+  // |id1| is inside the range so it should damage the display.
+  EXPECT_TRUE(aggregator_.NotifySurfaceDamageAndCheckForDisplayDamage(
       SurfaceId(kArbitraryFrameSinkId1, id1)));
 
   // |id2| is the primary id so it should damage the display.

diff --git a/content/browser/browsing_instance.cc b/content/browser/browsing_instance.cc
index 3758184..9b24ae58 100644
--- a/content/browser/browsing_instance.cc
+++ b/content/browser/browsing_instance.cc

@@ -21,16 +21,15 @@
 }
 
 bool BrowsingInstance::HasSiteInstance(const GURL& url) {
-  std::string site =
-      SiteInstanceImpl::GetSiteForURL(browser_context_, url)
-          .possibly_invalid_spec();
+  std::string site = SiteInstance::GetSiteForURL(browser_context_, url)
+                         .possibly_invalid_spec();
 
   return site_instance_map_.find(site) != site_instance_map_.end();
 }
 
 scoped_refptr<SiteInstanceImpl> BrowsingInstance::GetSiteInstanceForURL(
     const GURL& url) {
-  std::string site = SiteInstanceImpl::GetSiteForURL(browser_context_, url)
+  std::string site = SiteInstance::GetSiteForURL(browser_context_, url)
                          .possibly_invalid_spec();
 
   SiteInstanceMap::iterator i = site_instance_map_.find(site);

diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 1272be3..bd757e4f 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc

@@ -1120,7 +1120,7 @@
   // TODO(creis): We must pass the valid browser_context to convert hosted apps
   // URLs. Currently, hosted apps cannot set cookies in this mode. See
   // http://crbug.com/160576.
-  GURL site_url = SiteInstanceImpl::GetSiteForURL(nullptr, url);
+  GURL site_url = SiteInstance::GetSiteForURL(nullptr, url);
 
   base::AutoLock lock(lock_);
   SecurityStateMap::iterator state = security_state_.find(child_id);
@@ -1153,7 +1153,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   // "gurl" can be currently empty in some cases, such as file://blah.
-  DCHECK(SiteInstanceImpl::GetSiteForURL(nullptr, gurl) == gurl);
+  DCHECK_EQ(SiteInstanceImpl::DetermineProcessLockURL(nullptr, gurl), gurl);
   base::AutoLock lock(lock_);
   SecurityStateMap::iterator state = security_state_.find(child_id);
   DCHECK(state != security_state_.end());

diff --git a/content/browser/frame_host/navigator_impl_unittest.cc b/content/browser/frame_host/navigator_impl_unittest.cc
index 78c1a044..7d748ab 100644
--- a/content/browser/frame_host/navigator_impl_unittest.cc
+++ b/content/browser/frame_host/navigator_impl_unittest.cc

@@ -133,7 +133,7 @@
   EXPECT_TRUE(main_test_rfh()->navigation_request());
   main_test_rfh()->SendNavigate(entry_id, true, kUrl);
   EXPECT_TRUE(main_test_rfh()->is_active());
-  EXPECT_EQ(SiteInstanceImpl::GetSiteForURL(browser_context(), kUrl),
+  EXPECT_EQ(SiteInstance::GetSiteForURL(browser_context(), kUrl),
             main_test_rfh()->GetSiteInstance()->GetSiteURL());
   EXPECT_EQ(kUrl, contents()->GetLastCommittedURL());
 
@@ -187,7 +187,7 @@
   // Commit the navigation.
   navigation->Commit();
   EXPECT_TRUE(main_test_rfh()->is_active());
-  EXPECT_EQ(SiteInstanceImpl::GetSiteForURL(browser_context(), kUrl2),
+  EXPECT_EQ(SiteInstance::GetSiteForURL(browser_context(), kUrl2),
             main_test_rfh()->GetSiteInstance()->GetSiteURL());
   EXPECT_EQ(kUrl2, contents()->GetLastCommittedURL());
   EXPECT_FALSE(GetSpeculativeRenderFrameHost(node));
@@ -878,7 +878,7 @@
   // Receive the beforeUnload ACK.
   main_test_rfh()->SendBeforeUnloadACK(true);
   EXPECT_EQ(speculative_rfh, GetSpeculativeRenderFrameHost(node));
-  EXPECT_EQ(SiteInstanceImpl::GetSiteForURL(browser_context(), kUrl),
+  EXPECT_EQ(SiteInstance::GetSiteForURL(browser_context(), kUrl),
             speculative_rfh->GetSiteInstance()->GetSiteURL());
   int32_t site_instance_id = speculative_rfh->GetSiteInstance()->GetId();
   int64_t navigation_id =
@@ -923,7 +923,7 @@
   EXPECT_NE(init_site_instance_id, site_instance_id);
   EXPECT_EQ(init_site_instance_id, main_test_rfh()->GetSiteInstance()->GetId());
   EXPECT_NE(speculative_rfh, main_test_rfh());
-  EXPECT_EQ(SiteInstanceImpl::GetSiteForURL(browser_context(), kUrl),
+  EXPECT_EQ(SiteInstance::GetSiteForURL(browser_context(), kUrl),
             speculative_rfh->GetSiteInstance()->GetSiteURL());
 
   // Receive the beforeUnload ACK.
@@ -960,7 +960,7 @@
 
   // Once commit happens the speculative RenderFrameHost is updated to match the
   // known final SiteInstance.
-  EXPECT_EQ(SiteInstanceImpl::GetSiteForURL(browser_context(), kUrlRedirect),
+  EXPECT_EQ(SiteInstance::GetSiteForURL(browser_context(), kUrlRedirect),
             speculative_rfh->GetSiteInstance()->GetSiteURL());
   int32_t redirect_site_instance_id =
       speculative_rfh->GetSiteInstance()->GetId();

diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 2484bfa..34bb732 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc

@@ -1218,7 +1218,8 @@
     // thus use the correct process.
     bool use_process_per_site =
         RenderProcessHost::ShouldUseProcessPerSite(browser_context, dest_url) &&
-        RenderProcessHostImpl::GetProcessHostForSite(browser_context, dest_url);
+        RenderProcessHostImpl::GetSoleProcessHostForURL(browser_context,
+                                                        dest_url);
     if (current_instance_impl->HasRelatedSiteInstance(dest_url) ||
         use_process_per_site) {
       return SiteInstanceDescriptor(browser_context, dest_url,

diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
index a7524d5..3d6b6be8 100644
--- a/content/browser/gpu/gpu_process_host.cc
+++ b/content/browser/gpu/gpu_process_host.cc

@@ -709,7 +709,7 @@
       in_process_(false),
       kind_(kind),
       process_launched_(false),
-      status_(UNKNOWN),
+      initialized_(false),
       gpu_host_binding_(this),
       weak_ptr_factory_(this) {
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -743,12 +743,6 @@
   }
 #endif
 
-  if (status_ == UNKNOWN) {
-    RunRequestGPUInfoCallbacks(gpu::GPUInfo());
-  } else {
-    DCHECK(request_gpu_info_callbacks_.empty());
-  }
-
   // In case we never started, clean up.
   while (!queued_messages_.empty()) {
     delete queued_messages_.front();
@@ -1086,15 +1080,6 @@
   gpu_main_ptr_->CreateFrameSinkManager(std::move(params));
 }
 
-void GpuProcessHost::RequestGPUInfo(RequestGPUInfoCallback request_cb) {
-  if (status_ == SUCCESS || status_ == FAILURE) {
-    std::move(request_cb).Run(GpuDataManagerImpl::GetInstance()->GetGPUInfo());
-    return;
-  }
-
-  request_gpu_info_callbacks_.push_back(std::move(request_cb));
-}
-
 void GpuProcessHost::RequestHDRStatus(RequestHDRStatusCallback request_cb) {
   gpu_service_ptr_->RequestHDRStatus(std::move(request_cb));
 }
@@ -1203,7 +1188,7 @@
     const base::Optional<gpu::GpuFeatureInfo>&
         gpu_feature_info_for_hardware_gpu) {
   UMA_HISTOGRAM_BOOLEAN("GPU.GPUProcessInitialized", true);
-  status_ = SUCCESS;
+  initialized_ = true;
 
   // Set GPU driver bug workaround flags that are checked on the browser side.
   if (gpu_feature_info.IsWorkaroundEnabled(gpu::WAKE_UP_GPU_BEFORE_DRAWING)) {
@@ -1220,16 +1205,12 @@
   gpu_data_manager->UpdateGpuFeatureInfo(gpu_feature_info,
                                          gpu_feature_info_for_hardware_gpu);
   gpu_data_manager->UpdateGpuInfo(gpu_info, gpu_info_for_hardware_gpu);
-  RunRequestGPUInfoCallbacks(gpu_data_manager->GetGPUInfo());
 }
 
 void GpuProcessHost::DidFailInitialize() {
   UMA_HISTOGRAM_BOOLEAN("GPU.GPUProcessInitialized", false);
-  status_ = FAILURE;
-  GpuDataManagerImpl* gpu_data_manager = GpuDataManagerImpl::GetInstance();
   if (kind_ == GPU_PROCESS_KIND_SANDBOXED)
-    gpu_data_manager->FallBackToNextGpuMode();
-  RunRequestGPUInfoCallbacks(gpu_data_manager->GetGPUInfo());
+    GpuDataManagerImpl::GetInstance()->FallBackToNextGpuMode();
 }
 
 void GpuProcessHost::DidCreateContextSuccessfully() {
@@ -1502,13 +1483,6 @@
     base::ResetAndReturn(&send_destroying_video_surface_done_cb_).Run();
 }
 
-void GpuProcessHost::RunRequestGPUInfoCallbacks(const gpu::GPUInfo& gpu_info) {
-  for (auto& callback : request_gpu_info_callbacks_)
-    std::move(callback).Run(gpu_info);
-
-  request_gpu_info_callbacks_.clear();
-}
-
 void GpuProcessHost::BlockLiveOffscreenContexts() {
   for (std::multiset<GURL>::iterator iter =
            urls_with_live_offscreen_contexts_.begin();
@@ -1577,7 +1551,7 @@
   base::debug::Alias(&display_compositor_crash_count);
 
   // GPU process initialization failed and fallback already happened.
-  if (status_ == FAILURE)
+  if (!initialized_)
     return;
 
   bool disable_crash_limit = base::CommandLine::ForCurrentProcess()->HasSwitch(

diff --git a/content/browser/gpu/gpu_process_host.h b/content/browser/gpu/gpu_process_host.h
index 324152f..9956e34 100644
--- a/content/browser/gpu/gpu_process_host.h
+++ b/content/browser/gpu/gpu_process_host.h

@@ -92,7 +92,6 @@
       base::OnceCallback<void(gfx::GpuMemoryBufferHandle handle,
                               BufferCreationStatus status)>;
 
-  using RequestGPUInfoCallback = base::Callback<void(const gpu::GPUInfo&)>;
   using RequestHDRStatusCallback = base::RepeatingCallback<void(bool)>;
 
   static int GetGpuCrashCount();
@@ -162,7 +161,6 @@
       viz::mojom::FrameSinkManagerRequest request,
       viz::mojom::FrameSinkManagerClientPtrInfo client);
 
-  void RequestGPUInfo(RequestGPUInfoCallback request_cb);
   void RequestHDRStatus(RequestHDRStatusCallback request_cb);
 
   // What kind of GPU process, e.g. sandboxed or unsandboxed.
@@ -186,8 +184,6 @@
  private:
   class ConnectionFilterImpl;
 
-  enum GpuInitializationStatus { UNKNOWN, SUCCESS, FAILURE };
-
   enum class GpuTerminationOrigin {
     kUnknownOrigin = 0,
     kOzoneWaylandProxy = 1,
@@ -258,8 +254,6 @@
 
   void SendOutstandingReplies();
 
-  void RunRequestGPUInfoCallbacks(const gpu::GPUInfo& gpu_info);
-
   void BlockLiveOffscreenContexts();
 
   // Update GPU crash counters.  Disable GPU if crash limit is reached.
@@ -280,8 +274,6 @@
   // A callback to signal the completion of a SendDestroyingVideoSurface call.
   base::Closure send_destroying_video_surface_done_cb_;
 
-  std::vector<RequestGPUInfoCallback> request_gpu_info_callbacks_;
-
   // Qeueud messages to send when the process launches.
   base::queue<IPC::Message*> queued_messages_;
 
@@ -299,7 +291,7 @@
   // Whether we actually launched a GPU process.
   bool process_launched_;
 
-  GpuInitializationStatus status_;
+  bool initialized_;
 
   GpuTerminationOrigin termination_origin_ =
       GpuTerminationOrigin::kUnknownOrigin;

diff --git a/content/browser/isolated_origin_browsertest.cc b/content/browser/isolated_origin_browsertest.cc
index d945f2d..7c0f014d 100644
--- a/content/browser/isolated_origin_browsertest.cc
+++ b/content/browser/isolated_origin_browsertest.cc

@@ -568,10 +568,12 @@
   // Sanity-check IsSuitableHost values for the current processes.
   BrowserContext* browser_context = web_contents()->GetBrowserContext();
   auto is_suitable_host = [browser_context](RenderProcessHost* process,
-                                            GURL url) {
-    return RenderProcessHostImpl::IsSuitableHost(
-        process, browser_context,
-        SiteInstance::GetSiteForURL(browser_context, url));
+                                            const GURL& url) {
+    GURL site_url(SiteInstance::GetSiteForURL(browser_context, url));
+    GURL lock_url(
+        SiteInstanceImpl::DetermineProcessLockURL(browser_context, url));
+    return RenderProcessHostImpl::IsSuitableHost(process, browser_context,
+                                                 site_url, lock_url);
   };
   EXPECT_TRUE(is_suitable_host(foo_process, foo_url));
   EXPECT_FALSE(is_suitable_host(foo_process, isolated_foo_url));

diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 4e81b65..700cb0df 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc

@@ -908,11 +908,11 @@
       map_.erase(site_url);
   }
 
-  void FindRenderProcessesForSite(
-      const GURL& site_url,
+  void FindRenderProcessesForSiteInstance(
+      SiteInstanceImpl* site_instance,
       std::set<RenderProcessHost*>* foreground_processes,
       std::set<RenderProcessHost*>* background_processes) {
-    auto result = map_.find(site_url);
+    auto result = map_.find(site_instance->GetSiteURL());
     if (result == map_.end())
       return;
 
@@ -934,8 +934,10 @@
       // allow such hosts to be reused.  See https://crbug.com/780661.
       if (!host->MayReuseHost() ||
           !RenderProcessHostImpl::IsSuitableHost(
-              host, host->GetBrowserContext(), site_url))
+              host, host->GetBrowserContext(), site_instance->GetSiteURL(),
+              site_instance->lock_url())) {
         continue;
+      }
 
       if (host->VisibleClientCount())
         foreground_processes->insert(host);
@@ -1030,13 +1032,13 @@
       public RenderProcessHostObserver {
  public:
   // Registers |render_process_host| as having an unmatched service worker for
-  // |site_url|.
-  static void Register(BrowserContext* browser_context,
-                       RenderProcessHost* render_process_host,
-                       const GURL& site_url) {
-    DCHECK(!site_url.is_empty());
+  // |site_instance|.
+  static void Register(RenderProcessHost* render_process_host,
+                       SiteInstanceImpl* site_instance) {
+    BrowserContext* browser_context = site_instance->GetBrowserContext();
+    DCHECK(!site_instance->GetSiteURL().is_empty());
     if (!ShouldTrackProcessForSite(browser_context, render_process_host,
-                                   site_url))
+                                   site_instance->GetSiteURL()))
       return;
 
     UnmatchedServiceWorkerProcessTracker* tracker =
@@ -1048,14 +1050,15 @@
       browser_context->SetUserData(kUnmatchedServiceWorkerProcessTrackerKey,
                                    base::WrapUnique(tracker));
     }
-    tracker->RegisterProcessForSite(render_process_host, site_url);
+    tracker->RegisterProcessForSite(render_process_host, site_instance);
   }
 
-  // Find a process with an unmatched service worker for |site_url| and removes
-  // the process from the tracker if it exists.
-  static RenderProcessHost* MatchWithSite(BrowserContext* browser_context,
-                                          const GURL& site_url) {
-    if (!ShouldFindReusableProcessHostForSite(browser_context, site_url))
+  // Find a process with an unmatched service worker for |site_instance| and
+  // removes the process from the tracker if it exists.
+  static RenderProcessHost* MatchWithSite(SiteInstanceImpl* site_instance) {
+    BrowserContext* browser_context = site_instance->GetBrowserContext();
+    if (!ShouldFindReusableProcessHostForSite(browser_context,
+                                              site_instance->GetSiteURL()))
       return nullptr;
 
     UnmatchedServiceWorkerProcessTracker* tracker =
@@ -1064,7 +1067,7 @@
                 kUnmatchedServiceWorkerProcessTrackerKey));
     if (!tracker)
       return nullptr;
-    return tracker->TakeFreshestProcessForSite(site_url);
+    return tracker->TakeFreshestProcessForSite(site_instance);
   }
 
   UnmatchedServiceWorkerProcessTracker() {}
@@ -1088,14 +1091,17 @@
   }
 
  private:
-  void RegisterProcessForSite(RenderProcessHost* host, const GURL& site_url) {
+  void RegisterProcessForSite(RenderProcessHost* host,
+                              SiteInstanceImpl* site_instance) {
     if (!HasProcess(host))
       host->AddObserver(this);
-    site_process_set_.insert(SiteProcessIDPair(site_url, host->GetID()));
+    site_process_set_.insert(
+        SiteProcessIDPair(site_instance->GetSiteURL(), host->GetID()));
   }
 
-  RenderProcessHost* TakeFreshestProcessForSite(const GURL& site_url) {
-    RenderProcessHost* host = FindFreshestProcessForSite(site_url);
+  RenderProcessHost* TakeFreshestProcessForSite(
+      SiteInstanceImpl* site_instance) {
+    RenderProcessHost* host = FindFreshestProcessForSite(site_instance);
     if (!host)
       return nullptr;
 
@@ -1103,8 +1109,10 @@
     // |site_url|, for example if it was used for a ServiceWorker for a
     // nonexistent extension URL.  See https://crbug.com/782349 and
     // https://crbug.com/780661.
+    GURL site_url(site_instance->GetSiteURL());
     if (!host->MayReuseHost() || !RenderProcessHostImpl::IsSuitableHost(
-                                     host, host->GetBrowserContext(), site_url))
+                                     host, host->GetBrowserContext(), site_url,
+                                     site_instance->lock_url()))
       return nullptr;
 
     site_process_set_.erase(SiteProcessIDPair(site_url, host->GetID()));
@@ -1113,7 +1121,9 @@
     return host;
   }
 
-  RenderProcessHost* FindFreshestProcessForSite(const GURL& site_url) const {
+  RenderProcessHost* FindFreshestProcessForSite(
+      SiteInstanceImpl* site_instance) const {
+    GURL site_url(site_instance->GetSiteURL());
     for (const auto& site_process_pair : base::Reversed(site_process_set_)) {
       if (site_process_pair.first == site_url)
         return RenderProcessHost::FromID(site_process_pair.second);
@@ -1155,6 +1165,28 @@
   GetNetworkService()->GetNetworkChangeManager(std::move(request));
 }
 
+std::string DetermineKeyForSiteProcessMap(BrowserContext* browser_context,
+                                          const GURL& site_url,
+                                          const GURL& lock_url) {
+  // TODO(alexmos): See if |site_url| or |lock_url| can actually be invalid.
+  std::string key = site_url.possibly_invalid_spec();
+
+  // When process-per-site is combined with effective URLs, which is the case
+  // for hosted apps, we can't use the site URL (which is an effective URL) as
+  // an index to |map_|. This is because processes are locked to web sites
+  // that are resolved without effective URLs, and when multiple sites map to
+  // the same effective URL (e.g., when a hosted app spans multiple sites),
+  // one process cannot be used for all of them when in
+  // --site-per-process mode. Instead, augment the site URL with the process
+  // lock, so that all same-site parts of the app are placed in one process
+  // and maintain process-per-site behavior. See https://crbug.com/791796.
+  if (SiteInstanceImpl::ShouldLockToOrigin(browser_context, site_url) &&
+      site_url != lock_url) {
+    key += '|' + lock_url.possibly_invalid_spec();
+  }
+  return key;
+}
+
 }  // namespace
 
 // Held by the RPH and used to control an (unowned) ConnectionFilterImpl from
@@ -3498,7 +3530,8 @@
 // static
 bool RenderProcessHostImpl::IsSuitableHost(RenderProcessHost* host,
                                            BrowserContext* browser_context,
-                                           const GURL& site_url) {
+                                           const GURL& site_url,
+                                           const GURL& lock_url) {
   if (run_renderer_in_process()) {
     DCHECK_EQ(host->GetBrowserContext(), browser_context)
         << " Single-process mode does not support multiple browser contexts.";
@@ -3523,10 +3556,11 @@
   if (!host->InSameStoragePartition(dest_partition))
     return false;
 
-  // Check WebUI bindings and origin locks.
+  // Check WebUI bindings and origin locks.  Note that |lock_url| may differ
+  // from |site_url| if an effective URL is used.
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   bool host_has_web_ui_bindings = policy->HasWebUIBindings(host->GetID());
-  auto lock_state = policy->CheckOriginLock(host->GetID(), site_url);
+  auto lock_state = policy->CheckOriginLock(host->GetID(), lock_url);
   if (host->HostHasNotBeenUsed()) {
     // If the host hasn't been used, it won't have the expected WebUI bindings
     // or origin locks just *yet* - skip the checks in this case.  One example
@@ -3639,8 +3673,7 @@
 
 // static
 RenderProcessHost* RenderProcessHostImpl::GetExistingProcessHost(
-    BrowserContext* browser_context,
-    const GURL& site_url) {
+    SiteInstanceImpl* site_instance) {
   // First figure out which existing renderers we can use.
   std::vector<RenderProcessHost*> suitable_renderers;
   suitable_renderers.reserve(g_all_hosts.Get().size());
@@ -3648,8 +3681,9 @@
   iterator iter(AllHostsIterator());
   while (!iter.IsAtEnd()) {
     if (iter.GetCurrentValue()->MayReuseHost() &&
-        RenderProcessHostImpl::IsSuitableHost(iter.GetCurrentValue(),
-                                              browser_context, site_url)) {
+        RenderProcessHostImpl::IsSuitableHost(
+            iter.GetCurrentValue(), site_instance->GetBrowserContext(),
+            site_instance->GetSiteURL(), site_instance->lock_url())) {
       // The spare is always considered before process reuse.
       DCHECK_NE(iter.GetCurrentValue(),
                 g_spare_render_process_host_manager.Get()
@@ -3703,19 +3737,32 @@
 }
 
 // static
-RenderProcessHost* RenderProcessHostImpl::GetProcessHostForSite(
+RenderProcessHost* RenderProcessHostImpl::GetSoleProcessHostForURL(
     BrowserContext* browser_context,
     const GURL& url) {
+  GURL site_url = SiteInstance::GetSiteForURL(browser_context, url);
+  GURL lock_url =
+      SiteInstanceImpl::DetermineProcessLockURL(browser_context, url);
+  return GetSoleProcessHostForSite(browser_context, site_url, lock_url);
+}
+
+// static
+RenderProcessHost* RenderProcessHostImpl::GetSoleProcessHostForSite(
+    BrowserContext* browser_context,
+    const GURL& site_url,
+    const GURL& lock_url) {
   // Look up the map of site to process for the given browser_context.
   SiteProcessMap* map = GetSiteProcessMapForBrowserContext(browser_context);
 
+  std::string key =
+      DetermineKeyForSiteProcessMap(browser_context, site_url, lock_url);
+
   // See if we have an existing process with appropriate bindings for this site.
   // If not, the caller should create a new process and register it.  Note that
   // IsSuitableHost expects a site URL rather than the full |url|.
-  GURL site_url = SiteInstance::GetSiteForURL(browser_context, url);
-  RenderProcessHost* host = map->FindProcess(site_url.possibly_invalid_spec());
+  RenderProcessHost* host = map->FindProcess(key);
   if (host && (!host->MayReuseHost() ||
-               !IsSuitableHost(host, browser_context, site_url))) {
+               !IsSuitableHost(host, browser_context, site_url, lock_url))) {
     // The registered process does not have an appropriate set of bindings for
     // the url.  Remove it from the map so we can register a better one.
     RecordAction(
@@ -3727,25 +3774,27 @@
   return host;
 }
 
-void RenderProcessHostImpl::RegisterProcessHostForSite(
+void RenderProcessHostImpl::RegisterSoleProcessHostForSite(
     BrowserContext* browser_context,
     RenderProcessHost* process,
-    const GURL& url) {
+    SiteInstanceImpl* site_instance) {
   // Look up the map of site to process for the given browser_context.
   SiteProcessMap* map = GetSiteProcessMapForBrowserContext(browser_context);
 
+  GURL site_url = site_instance->GetSiteURL();
   // Only register valid, non-empty sites.  Empty or invalid sites will not
   // use process-per-site mode.  We cannot check whether the process has
   // appropriate bindings here, because the bindings have not yet been granted.
-  std::string site =
-      SiteInstance::GetSiteForURL(browser_context, url).possibly_invalid_spec();
-  if (!site.empty())
-    map->RegisterProcess(site, process);
+  if (site_url.possibly_invalid_spec().empty())
+    return;
+
+  std::string key = DetermineKeyForSiteProcessMap(browser_context, site_url,
+                                                  site_instance->lock_url());
+  map->RegisterProcess(key, process);
 }
 
 // static
 RenderProcessHost* RenderProcessHostImpl::GetProcessHostForSiteInstance(
-    BrowserContext* browser_context,
     SiteInstanceImpl* site_instance) {
   const GURL site_url = site_instance->GetSiteURL();
   SiteInstanceImpl::ProcessReusePolicy process_reuse_policy =
@@ -3754,11 +3803,13 @@
   RenderProcessHost* render_process_host = nullptr;
 
   bool is_unmatched_service_worker = site_instance->is_for_service_worker();
+  BrowserContext* browser_context = site_instance->GetBrowserContext();
 
   // First, attempt to reuse an existing RenderProcessHost if necessary.
   switch (process_reuse_policy) {
     case SiteInstanceImpl::ProcessReusePolicy::PROCESS_PER_SITE:
-      render_process_host = GetProcessHostForSite(browser_context, site_url);
+      render_process_host = GetSoleProcessHostForSite(
+          browser_context, site_url, site_instance->lock_url());
       break;
     case SiteInstanceImpl::ProcessReusePolicy::USE_DEFAULT_SUBFRAME_PROCESS:
       DCHECK(SiteIsolationPolicy::IsTopDocumentIsolationEnabled());
@@ -3768,7 +3819,7 @@
       break;
     case SiteInstanceImpl::ProcessReusePolicy::REUSE_PENDING_OR_COMMITTED_SITE:
       render_process_host =
-          FindReusableProcessHostForSite(browser_context, site_url);
+          FindReusableProcessHostForSiteInstance(site_instance);
       UMA_HISTOGRAM_BOOLEAN(
           "SiteIsolation.ReusePendingOrCommittedSite.CouldReuse",
           render_process_host != nullptr);
@@ -3786,8 +3837,8 @@
   if (!render_process_host &&
       !(process_reuse_policy == SiteInstanceImpl::ProcessReusePolicy::DEFAULT &&
         site_instance->is_for_service_worker())) {
-    render_process_host = UnmatchedServiceWorkerProcessTracker::MatchWithSite(
-        browser_context, site_url);
+    render_process_host =
+        UnmatchedServiceWorkerProcessTracker::MatchWithSite(site_instance);
   }
 
   // See if the spare RenderProcessHost can be used.
@@ -3803,16 +3854,16 @@
   // If not (or if none found), see if we should reuse an existing process.
   if (!render_process_host &&
       ShouldTryToUseExistingProcessHost(browser_context, site_url)) {
-    render_process_host = GetExistingProcessHost(browser_context, site_url);
+    render_process_host = GetExistingProcessHost(site_instance);
   }
 
   // If we found a process to reuse, sanity check that it is suitable for
   // hosting |site_url|. For example, if |site_url| requires a dedicated
   // process, we should never pick a process used by, or locked to, a different
   // site.
-  if (render_process_host &&
-      !RenderProcessHostImpl::IsSuitableHost(render_process_host,
-                                             browser_context, site_url)) {
+  if (render_process_host && !RenderProcessHostImpl::IsSuitableHost(
+                                 render_process_host, browser_context, site_url,
+                                 site_instance->lock_url())) {
     ChildProcessSecurityPolicyImpl* policy =
         ChildProcessSecurityPolicyImpl::GetInstance();
     base::debug::SetCrashKeyString(bad_message::GetRequestedSiteURLKey(),
@@ -3846,8 +3897,8 @@
     spare_process_manager.PrepareForFutureRequests(browser_context);
 
   if (is_unmatched_service_worker) {
-    UnmatchedServiceWorkerProcessTracker::Register(
-        browser_context, render_process_host, site_url);
+    UnmatchedServiceWorkerProcessTracker::Register(render_process_host,
+                                                   site_instance);
   }
 
   // Make sure the chosen process is in the correct StoragePartition for the
@@ -4334,9 +4385,11 @@
 }
 
 // static
-RenderProcessHost* RenderProcessHostImpl::FindReusableProcessHostForSite(
-    BrowserContext* browser_context,
-    const GURL& site_url) {
+RenderProcessHost*
+RenderProcessHostImpl::FindReusableProcessHostForSiteInstance(
+    SiteInstanceImpl* site_instance) {
+  BrowserContext* browser_context = site_instance->GetBrowserContext();
+  GURL site_url(site_instance->GetSiteURL());
   if (!ShouldFindReusableProcessHostForSite(browser_context, site_url))
     return nullptr;
 
@@ -4349,8 +4402,8 @@
       static_cast<SiteProcessCountTracker*>(
           browser_context->GetUserData(kPendingSiteProcessCountTrackerKey));
   if (pending_tracker) {
-    pending_tracker->FindRenderProcessesForSite(
-        site_url, &eligible_foreground_hosts, &eligible_background_hosts);
+    pending_tracker->FindRenderProcessesForSiteInstance(
+        site_instance, &eligible_foreground_hosts, &eligible_background_hosts);
   }
 
   if (eligible_foreground_hosts.empty()) {
@@ -4360,8 +4413,9 @@
         static_cast<SiteProcessCountTracker*>(
             browser_context->GetUserData(kCommittedSiteProcessCountTrackerKey));
     if (committed_tracker) {
-      committed_tracker->FindRenderProcessesForSite(
-          site_url, &eligible_foreground_hosts, &eligible_background_hosts);
+      committed_tracker->FindRenderProcessesForSiteInstance(
+          site_instance, &eligible_foreground_hosts,
+          &eligible_background_hosts);
     }
   }
 

diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 573ce19..b8b5b21 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h

@@ -266,11 +266,16 @@
   // Implementation of FilterURL below that can be shared with the mock class.
   static void FilterURL(RenderProcessHost* rph, bool empty_allowed, GURL* url);
 
-  // Returns true if |host| is suitable for launching a new view with |site_url|
-  // in the given |browser_context|.
+  // Returns true if |host| is suitable for rendering a page in the given
+  // |browser_context|, where the page would utilize |site_url| as its
+  // SiteInstance site URL, and its process would be locked to |lock_url|.
+  // |site_url| and |lock_url| may differ in cases where an effective URL is
+  // not the actual site that the process is locked to, which happens for
+  // hosted apps.
   static bool IsSuitableHost(RenderProcessHost* host,
                              BrowserContext* browser_context,
-                             const GURL& site_url);
+                             const GURL& site_url,
+                             const GURL& lock_url);
 
   // Returns an existing RenderProcessHost for |url| in |browser_context|,
   // if one exists.  Otherwise a new RenderProcessHost should be created and
@@ -278,25 +283,45 @@
   // This should only be used for process-per-site mode, which can be enabled
   // globally with a command line flag or per-site, as determined by
   // SiteInstanceImpl::ShouldUseProcessPerSite.
-  static RenderProcessHost* GetProcessHostForSite(
+  // Important: |url| should be a full URL and *not* a site URL.
+  static RenderProcessHost* GetSoleProcessHostForURL(
       BrowserContext* browser_context,
       const GURL& url);
 
-  // Registers the given |process| to be used for any instance of |url|
-  // within |browser_context|.
+  // Variant of the above that takes in a SiteInstance site URL and the
+  // process's origin lock URL, when they are known.
+  static RenderProcessHost* GetSoleProcessHostForSite(
+      BrowserContext* browser_context,
+      const GURL& site_url,
+      const GURL& lock_url);
+
+  // Registers the given |process| to be used for all sites identified by
+  // |site_instance| within |browser_context|.
   // This should only be used for process-per-site mode, which can be enabled
   // globally with a command line flag or per-site, as determined by
   // SiteInstanceImpl::ShouldUseProcessPerSite.
-  static void RegisterProcessHostForSite(
-      BrowserContext* browser_context,
-      RenderProcessHost* process,
-      const GURL& url);
+  static void RegisterSoleProcessHostForSite(BrowserContext* browser_context,
+                                             RenderProcessHost* process,
+                                             SiteInstanceImpl* site_instance);
 
   // Returns a suitable RenderProcessHost to use for |site_instance|. Depending
   // on the SiteInstance's ProcessReusePolicy and its url, this may be an
   // existing RenderProcessHost or a new one.
+  //
+  // This is the main entrypoint into the process assignment logic, which
+  // handles all cases.  These cases include:
+  // - process-per-site: see
+  //   RegisterSoleProcessHostForSite/GetSoleProcessHostForSite.
+  // - TDI: see GetDefaultSubframeProcessHost.
+  // - REUSE_PENDING_OR_COMMITTED reuse policy (for ServiceWorkers and OOPIFs):
+  //   see FindReusableProcessHostForSiteInstance.
+  // - normal process reuse when over process limit:  see
+  //   GetExistingProcessHost.
+  // - using the spare RenderProcessHost when possible: see
+  //   MaybeTakeSpareRenderProcessHost.
+  // - process creation when an existing process couldn't be found: see
+  //   CreateRenderProcessHost.
   static RenderProcessHost* GetProcessHostForSiteInstance(
-      BrowserContext* browser_context,
       SiteInstanceImpl* site_instance);
 
   // Should be called when |browser_context| is used in a navigation.
@@ -552,20 +577,19 @@
   // Get an existing RenderProcessHost associated with the given browser
   // context, if possible.  The renderer process is chosen randomly from
   // suitable renderers that share the same context and type (determined by the
-  // site url).
+  // site url of |site_instance|).
   // Returns nullptr if no suitable renderer process is available, in which case
   // the caller is free to create a new renderer.
   static RenderProcessHost* GetExistingProcessHost(
-      content::BrowserContext* browser_context,
-      const GURL& site_url);
+      SiteInstanceImpl* site_instance);
   FRIEND_TEST_ALL_PREFIXES(RenderProcessHostUnitTest,
                            GuestsAreNotSuitableHosts);
 
-  // Returns a RenderProcessHost that is rendering |site_url| in one of its
-  // frames, or that is expecting a navigation to |site_url|.
-  static RenderProcessHost* FindReusableProcessHostForSite(
-      BrowserContext* browser_context,
-      const GURL& site_url);
+  // Returns a RenderProcessHost that is rendering a URL corresponding to
+  // |site_instance| in one of its frames, or that is expecting a navigation to
+  // that SiteInstance.
+  static RenderProcessHost* FindReusableProcessHostForSiteInstance(
+      SiteInstanceImpl* site_instance);
 
   void CreateMediaStreamDispatcherHost(
       MediaStreamManager* media_stream_manager,

diff --git a/content/browser/renderer_host/render_process_host_unittest.cc b/content/browser/renderer_host/render_process_host_unittest.cc
index b036f1a..9a91cd8 100644
--- a/content/browser/renderer_host/render_process_host_unittest.cc
+++ b/content/browser/renderer_host/render_process_host_unittest.cc

@@ -42,12 +42,16 @@
   MockRenderProcessHost guest_host(browser_context());
   guest_host.set_is_for_guests_only(true);
 
+  scoped_refptr<SiteInstanceImpl> site_instance =
+      SiteInstanceImpl::CreateForURL(browser_context(), test_url);
   EXPECT_FALSE(RenderProcessHostImpl::IsSuitableHost(
-      &guest_host, browser_context(), test_url));
+      &guest_host, browser_context(), site_instance->GetSiteURL(),
+      site_instance->lock_url()));
   EXPECT_TRUE(RenderProcessHostImpl::IsSuitableHost(
-      process(), browser_context(), test_url));
-  EXPECT_EQ(process(), RenderProcessHostImpl::GetExistingProcessHost(
-                           browser_context(), test_url));
+      process(), browser_context(), site_instance->GetSiteURL(),
+      site_instance->lock_url()));
+  EXPECT_EQ(process(),
+            RenderProcessHostImpl::GetExistingProcessHost(site_instance.get()));
 }
 
 #if !defined(OS_ANDROID) && !defined(OS_CHROMEOS)

diff --git a/content/browser/service_worker/service_worker_context_core.cc b/content/browser/service_worker/service_worker_context_core.cc
index bbbd1c80..ffcd054 100644
--- a/content/browser/service_worker/service_worker_context_core.cc
+++ b/content/browser/service_worker/service_worker_context_core.cc

@@ -197,6 +197,7 @@
   scoped_refptr<ServiceWorkerRegistration> registration_;
   base::OnceClosure callback_;
 };
+
 }  // namespace
 
 const base::FilePath::CharType

diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
index b246259..1b4fadd5 100644
--- a/content/browser/service_worker/service_worker_context_wrapper.cc
+++ b/content/browser/service_worker/service_worker_context_wrapper.cc

@@ -40,10 +40,6 @@
 
 namespace {
 
-typedef std::set<std::string> HeaderNameSet;
-base::LazyInstance<HeaderNameSet>::DestructorAtExit g_excluded_header_name_set =
-    LAZY_INSTANCE_INITIALIZER;
-
 // Value used to set the timeout when starting a long running ServiceWorker. See
 // ServiceWorkerContextWrapper::StartServiceWorkerAndDispatchLongRunningMessage.
 const int kActiveWorkerTimeoutDays = 999;
@@ -167,22 +163,6 @@
 }  // namespace
 
 // static
-void ServiceWorkerContext::AddExcludedHeadersForFetchEvent(
-    const std::set<std::string>& header_names) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  g_excluded_header_name_set.Get().insert(header_names.begin(),
-                                          header_names.end());
-}
-
-// static
-bool ServiceWorkerContext::IsExcludedHeaderNameForFetchEvent(
-    const std::string& header_name) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  return g_excluded_header_name_set.Get().find(header_name) !=
-         g_excluded_header_name_set.Get().end();
-}
-
-// static
 bool ServiceWorkerContext::ScopeMatches(const GURL& scope, const GURL& url) {
   return ServiceWorkerUtils::ScopeMatches(scope, url);
 }

diff --git a/content/browser/service_worker/service_worker_url_request_job.cc b/content/browser/service_worker/service_worker_url_request_job.cc
index 543c290..033f55cb 100644
--- a/content/browser/service_worker/service_worker_url_request_job.cc
+++ b/content/browser/service_worker/service_worker_url_request_job.cc

@@ -559,8 +559,7 @@
 
   for (net::HttpRequestHeaders::Iterator it(request_->extra_request_headers());
        it.GetNext();) {
-    if (!ServiceWorkerContext::IsExcludedHeaderNameForFetchEvent(it.name()))
-      request->headers.SetHeader(it.name(), it.value());
+    request->headers.SetHeader(it.name(), it.value());
   }
 
   request->referrer = GURL(request_->referrer());

diff --git a/content/browser/site_instance_impl.cc b/content/browser/site_instance_impl.cc
index 1ae8fc8e..03cf4fa0 100644
--- a/content/browser/site_instance_impl.cc
+++ b/content/browser/site_instance_impl.cc

@@ -104,7 +104,8 @@
       browsing_instance_->browser_context();
   if (has_site_ &&
       RenderProcessHost::ShouldUseProcessPerSite(browser_context, site_) &&
-      RenderProcessHostImpl::GetProcessHostForSite(browser_context, site_)) {
+      RenderProcessHostImpl::GetSoleProcessHostForSite(browser_context, site_,
+                                                       lock_url_)) {
     return true;
   }
 
@@ -133,8 +134,7 @@
       process_reuse_policy_ = ProcessReusePolicy::DEFAULT;
     }
 
-    process_ = RenderProcessHostImpl::GetProcessHostForSiteInstance(
-        browser_context, this);
+    process_ = RenderProcessHostImpl::GetProcessHostForSiteInstance(this);
 
     CHECK(process_);
     process_->AddObserver(this);
@@ -144,8 +144,8 @@
     // at this time, we will register it in SetSite().)
     if (process_reuse_policy_ == ProcessReusePolicy::PROCESS_PER_SITE &&
         has_site_) {
-      RenderProcessHostImpl::RegisterProcessHostForSite(browser_context,
-                                                        process_, site_);
+      RenderProcessHostImpl::RegisterSoleProcessHostForSite(browser_context,
+                                                            process_, this);
     }
 
     TRACE_EVENT2("navigation", "SiteInstanceImpl::GetProcess",
@@ -182,8 +182,10 @@
   // URL is invalid.
   has_site_ = true;
   BrowserContext* browser_context = browsing_instance_->browser_context();
-  site_ = GetSiteForURL(browser_context, url);
+  site_ =
+      GetSiteForURL(browser_context, url, true /* should_use_effective_urls */);
   original_url_ = url;
+  lock_url_ = DetermineProcessLockURL(browser_context, url);
 
   // Now that we have a site, register it with the BrowsingInstance.  This
   // ensures that we won't create another SiteInstance for this site within
@@ -203,8 +205,8 @@
 
     // Ensure the process is registered for this site if necessary.
     if (should_use_process_per_site) {
-      RenderProcessHostImpl::RegisterProcessHostForSite(
-          browser_context, process_, site_);
+      RenderProcessHostImpl::RegisterSoleProcessHostForSite(browser_context,
+                                                            process_, this);
     }
   }
 }
@@ -262,9 +264,13 @@
 
   // If the site URL is an extension (e.g., for hosted apps or WebUI) but the
   // process is not (or vice versa), make sure we notice and fix it.
-  GURL site_url = GetSiteForURL(browsing_instance_->browser_context(), url);
+  GURL site_url =
+      SiteInstance::GetSiteForURL(browsing_instance_->browser_context(), url);
+  GURL origin_lock =
+      DetermineProcessLockURL(browsing_instance_->browser_context(), url);
   return !RenderProcessHostImpl::IsSuitableHost(
-      GetProcess(), browsing_instance_->browser_context(), site_url);
+      GetProcess(), browsing_instance_->browser_context(), site_url,
+      origin_lock);
 }
 
 scoped_refptr<SiteInstanceImpl>
@@ -415,12 +421,32 @@
 
 // static
 GURL SiteInstance::GetSiteForURL(BrowserContext* browser_context,
-                                 const GURL& real_url) {
+                                 const GURL& url) {
+  // By default, GetSiteForURL will resolve |real_url| to an effective URL
+  // before computing its site.
+  return SiteInstanceImpl::GetSiteForURL(browser_context, url,
+                                         true /* should_use_effective_urls */);
+}
+
+// static
+GURL SiteInstanceImpl::DetermineProcessLockURL(BrowserContext* browser_context,
+                                               const GURL& url) {
+  // For the process lock URL, convert |url| to a site without resolving |url|
+  // to an effective URL.
+  return SiteInstanceImpl::GetSiteForURL(browser_context, url,
+                                         false /* should_use_effective_urls */);
+}
+
+GURL SiteInstanceImpl::GetSiteForURL(BrowserContext* browser_context,
+                                     const GURL& real_url,
+                                     bool should_use_effective_urls) {
   // TODO(fsamuel, creis): For some reason appID is not recognized as a host.
   if (real_url.SchemeIs(kGuestScheme))
     return real_url;
 
-  GURL url = SiteInstanceImpl::GetEffectiveURL(browser_context, real_url);
+  GURL url = should_use_effective_urls
+                 ? SiteInstanceImpl::GetEffectiveURL(browser_context, real_url)
+                 : real_url;
   url::Origin origin = url::Origin::Create(url);
 
   // Isolated origins should use the full origin as their site URL. A subdomain
@@ -522,7 +548,7 @@
     return true;
 
   // Always require a dedicated process for isolated origins.
-  GURL site_url = GetSiteForURL(browser_context, url);
+  GURL site_url = SiteInstance::GetSiteForURL(browser_context, url);
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   if (policy->IsIsolatedOrigin(url::Origin::Create(site_url)))
     return true;
@@ -605,7 +631,7 @@
 
   ChildProcessSecurityPolicyImpl* policy =
       ChildProcessSecurityPolicyImpl::GetInstance();
-  auto lock_state = policy->CheckOriginLock(process_->GetID(), site_);
+  auto lock_state = policy->CheckOriginLock(process_->GetID(), lock_url());
   if (ShouldLockToOrigin(GetBrowserContext(), site_)) {
     // Sanity check that this won't try to assign an origin lock to a <webview>
     // process, which can't be locked.
@@ -617,7 +643,7 @@
         // strong protection. If only some sites are isolated, we need
         // additional logic to prevent the non-isolated sites from requesting
         // resources for isolated sites. https://crbug.com/509125
-        process_->LockToOrigin(site_);
+        process_->LockToOrigin(lock_url());
         break;
       }
       case CheckOriginLockResult::HAS_WRONG_LOCK:
@@ -628,7 +654,7 @@
         base::debug::SetCrashKeyString(
             bad_message::GetKilledProcessOriginLockKey(),
             policy->GetOriginLock(process_->GetID()).spec());
-        CHECK(false) << "Trying to lock a process to " << site_
+        CHECK(false) << "Trying to lock a process to " << lock_url()
                      << " but the process is already locked to "
                      << policy->GetOriginLock(process_->GetID());
         break;

diff --git a/content/browser/site_instance_impl.h b/content/browser/site_instance_impl.h
index f917e5ac..f79174da 100644
--- a/content/browser/site_instance_impl.h
+++ b/content/browser/site_instance_impl.h

@@ -116,11 +116,29 @@
   // May be empty if this SiteInstance does not have a |site_|.
   const GURL& original_url() { return original_url_; }
 
+  // Returns the URL which should be used in a LockToOrigin call for this
+  // SiteInstance's process.
+  const GURL& lock_url() { return lock_url_; }
+
   // True if |url| resolves to an effective URL that is different from |url|.
   // See GetEffectiveURL().  This will be true for hosted apps as well as NTP
   // URLs.
   static bool HasEffectiveURL(BrowserContext* browser_context, const GURL& url);
 
+  // Returns the site for the given URL, which includes only the scheme and
+  // registered domain.  Returns an empty GURL if the URL has no host.
+  // |use_effective_urls| specifies whether to resolve |url| to an effective
+  // URL (via ContentBrowserClient::GetEffectiveURL()) before determining the
+  // site.
+  static GURL GetSiteForURL(BrowserContext* context,
+                            const GURL& url,
+                            bool use_effective_urls);
+
+  // Returns the URL to which a process should be locked for the given URL.
+  // This is computed similarly to the site URL (see GetSiteForURL), but
+  // without resolving effective URLs.
+  static GURL DetermineProcessLockURL(BrowserContext* context, const GURL& url);
+
   // Returns the SiteInstance, related to this one, that should be used
   // for subframes when an oopif is required, but a dedicated process is not.
   // This SiteInstance will be created if it doesn't already exist. There is
@@ -275,6 +293,12 @@
   // The URL which was used to set the |site_| for this SiteInstance.
   GURL original_url_;
 
+  // The URL to use when locking a process to this SiteInstance's site via
+  // LockToOrigin().  This is the same as |site_| except for cases involving
+  // effective URLs, such as hosted apps.  In those cases, this URL is a site
+  // URL that is computed without the use of effective URLs.
+  GURL lock_url_;
+
   // The ProcessReusePolicy to use when creating a RenderProcessHost for this
   // SiteInstance.
   ProcessReusePolicy process_reuse_policy_;

diff --git a/content/browser/site_instance_impl_unittest.cc b/content/browser/site_instance_impl_unittest.cc
index 6615913..6e9a99f 100644
--- a/content/browser/site_instance_impl_unittest.cc
+++ b/content/browser/site_instance_impl_unittest.cc

@@ -258,51 +258,51 @@
 TEST_F(SiteInstanceTest, GetSiteForURL) {
   // Pages are irrelevant.
   GURL test_url = GURL("http://www.google.com/index.html");
-  GURL site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  GURL site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://google.com"), site_url);
   EXPECT_EQ("http", site_url.scheme());
   EXPECT_EQ("google.com", site_url.host());
 
   // Ports are irrelevant.
   test_url = GURL("https://www.google.com:8080");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("https://google.com"), site_url);
 
   // Punycode is canonicalized.
   test_url = GURL("http://☃snowperson☃.net:333/");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://xn--snowperson-di0gka.net"), site_url);
 
   // Username and password are stripped out.
   test_url = GURL("ftp://username:password@ftp.chromium.org/files/README");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("ftp://chromium.org"), site_url);
 
   // Literal IP addresses of any flavor are okay.
   test_url = GURL("http://127.0.0.1/a.html");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://127.0.0.1"), site_url);
   EXPECT_EQ("127.0.0.1", site_url.host());
 
   test_url = GURL("http://2130706433/a.html");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://127.0.0.1"), site_url);
   EXPECT_EQ("127.0.0.1", site_url.host());
 
   test_url = GURL("http://[::1]:2/page.html");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://[::1]"), site_url);
   EXPECT_EQ("[::1]", site_url.host());
 
   // Hostnames without TLDs are okay.
   test_url = GURL("http://foo/a.html");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://foo"), site_url);
   EXPECT_EQ("foo", site_url.host());
 
   // File URLs should include the scheme.
   test_url = GURL("file:///C:/Downloads/");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("file:"), site_url);
   EXPECT_EQ("file", site_url.scheme());
   EXPECT_FALSE(site_url.has_host());
@@ -311,7 +311,7 @@
   // maps *all* file://... URLs into "file://" origin) such file URLs still need
   // to map into "file:" site URL.  See also https://crbug.com/776160.
   test_url = GURL("file://server/path");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("file:"), site_url);
   EXPECT_EQ("file", site_url.scheme());
   EXPECT_FALSE(site_url.has_host());
@@ -319,7 +319,7 @@
   // Data URLs should include the whole URL, except for the hash, when Site
   // Isolation is enabled.  Otherwise they just include the scheme.
   test_url = GURL("data:text/html,foo");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   if (AreAllSitesIsolatedForTesting())
     EXPECT_EQ(test_url, site_url);
   else
@@ -327,7 +327,7 @@
   EXPECT_EQ("data", site_url.scheme());
   EXPECT_FALSE(site_url.has_host());
   test_url = GURL("data:text/html,foo#bar");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_FALSE(site_url.has_ref());
   if (AreAllSitesIsolatedForTesting()) {
     EXPECT_NE(test_url, site_url);
@@ -338,7 +338,7 @@
 
   // Javascript URLs should include the scheme.
   test_url = GURL("javascript:foo();");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("javascript:"), site_url);
   EXPECT_EQ("javascript", site_url.scheme());
   EXPECT_FALSE(site_url.has_host());
@@ -347,12 +347,12 @@
   test_url = GURL(
       "blob:gopher://www.ftp.chromium.org/"
       "4d4ff040-6d61-4446-86d3-13ca07ec9ab9");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("gopher://chromium.org"), site_url);
 
   // Blob URLs with file origin also extract the site from the origin.
   test_url = GURL("blob:file:///1029e5a4-2983-4b90-a585-ed217563acfeb");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("file:"), site_url);
   EXPECT_EQ("file", site_url.scheme());
   EXPECT_FALSE(site_url.has_host());
@@ -361,13 +361,13 @@
   // when Site Isolation is enabled, except for the hash.  Otherwise they just
   // include the scheme.
   test_url = GURL("blob:null/1029e5a4-2983-4b90-a585-ed217563acfeb");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   if (AreAllSitesIsolatedForTesting())
     EXPECT_EQ(test_url, site_url);
   else
     EXPECT_EQ(GURL("blob:"), site_url);
   test_url = GURL("blob:null/1029e5a4-2983-4b90-a585-ed217563acfeb#foo");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_FALSE(site_url.has_ref());
   if (AreAllSitesIsolatedForTesting()) {
     EXPECT_NE(test_url, site_url);
@@ -380,12 +380,12 @@
   test_url = GURL(
       "blob:http://www.example.appspot.com:44/"
       "4d4ff040-6d61-4446-86d3-13ca07ec9ab9");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://example.appspot.com"), site_url);
 
   // The site of filesystem URLs is determined by the inner URL.
   test_url = GURL("filesystem:http://www.google.com/foo/bar.html?foo#bar");
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(GURL("http://google.com"), site_url);
 
   // Guest URLs are special and need to have the path in the site as well,
@@ -393,12 +393,68 @@
   std::string guest_url(kGuestScheme);
   guest_url.append("://abc123/path");
   test_url = GURL(guest_url);
-  site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url);
+  site_url = SiteInstance::GetSiteForURL(nullptr, test_url);
   EXPECT_EQ(test_url, site_url);
 
   DrainMessageLoop();
 }
 
+// Test that process lock URLs are computed without using effective URLs.
+TEST_F(SiteInstanceTest, ProcessLockDoesNotUseEffectiveURL) {
+  GURL test_url("https://some.app.foo.com/");
+  GURL nonapp_site_url("https://foo.com/");
+  GURL app_url("https://app.com/");
+  EffectiveURLContentBrowserClient modified_client(test_url, app_url);
+  ContentBrowserClient* regular_client =
+      SetBrowserClientForTesting(&modified_client);
+  std::unique_ptr<TestBrowserContext> browser_context(new TestBrowserContext());
+
+  // Sanity check that GetSiteForURL's |use_effective_urls| option works
+  // properly.
+  {
+    GURL site_url = SiteInstanceImpl::GetSiteForURL(
+        nullptr, test_url, false /* use_effective_urls */);
+    EXPECT_EQ(nonapp_site_url, site_url);
+
+    site_url = SiteInstanceImpl::GetSiteForURL(nullptr, test_url,
+                                               true /* use_effective_urls */);
+    EXPECT_EQ(app_url, site_url);
+  }
+
+  // New SiteInstance in a new BrowsingInstance with a predetermined URL.
+  {
+    scoped_refptr<SiteInstanceImpl> site_instance =
+        SiteInstanceImpl::CreateForURL(browser_context.get(), test_url);
+    EXPECT_EQ(app_url, site_instance->GetSiteURL());
+    EXPECT_EQ(nonapp_site_url, site_instance->lock_url());
+  }
+
+  // New related SiteInstance from an existing SiteInstance with a
+  // predetermined URL.
+  {
+    scoped_refptr<SiteInstanceImpl> bar_site_instance =
+        SiteInstanceImpl::CreateForURL(browser_context.get(),
+                                       GURL("https://bar.com/"));
+    scoped_refptr<SiteInstance> site_instance =
+        bar_site_instance->GetRelatedSiteInstance(test_url);
+    EXPECT_EQ(app_url, site_instance->GetSiteURL());
+    EXPECT_EQ(nonapp_site_url,
+              static_cast<SiteInstanceImpl*>(site_instance.get())->lock_url());
+  }
+
+  // New SiteInstance with a lazily assigned site URL.
+  {
+    scoped_refptr<SiteInstanceImpl> site_instance =
+        SiteInstanceImpl::Create(browser_context.get());
+    EXPECT_FALSE(site_instance->HasSite());
+    site_instance->SetSite(test_url);
+    EXPECT_EQ(app_url, site_instance->GetSiteURL());
+    EXPECT_EQ(nonapp_site_url, site_instance->lock_url());
+  }
+
+  SetBrowserClientForTesting(regular_client);
+}
+
 // Test of distinguishing URLs from different sites.  Most of this logic is
 // tested in RegistryControlledDomainTest.  This test focuses on URLs with
 // different schemes or ports.
@@ -837,8 +893,10 @@
   EXPECT_TRUE(instance->GetSiteURL().is_empty());
   host.reset(instance->GetProcess());
 
-  EXPECT_FALSE(RenderProcessHostImpl::GetProcessHostForSite(
+  EXPECT_FALSE(RenderProcessHostImpl::GetSoleProcessHostForURL(
       browser_context.get(), GURL()));
+  EXPECT_FALSE(RenderProcessHostImpl::GetSoleProcessHostForSite(
+      browser_context.get(), GURL(), GURL()));
 
   DrainMessageLoop();
 }

diff --git a/content/browser/webauth/authenticator_impl_unittest.cc b/content/browser/webauth/authenticator_impl_unittest.cc
index 9fec26df..47a4124b 100644
--- a/content/browser/webauth/authenticator_impl_unittest.cc
+++ b/content/browser/webauth/authenticator_impl_unittest.cc

@@ -820,10 +820,8 @@
   }
 }
 
-TEST_F(AuthenticatorImplTest, TestCableDiscoveryEnabledWithSwitch) {
+TEST_F(AuthenticatorImplTest, TestCableDiscoveryEnabledByDefault) {
   TestServiceManagerContext service_manager_context;
-  EnableFeature(features::kWebAuthCable);
-
   SimulateNavigation(GURL(kTestOrigin1));
   PublicKeyCredentialRequestOptionsPtr options =
       GetTestPublicKeyCredentialRequestOptions();
@@ -844,19 +842,19 @@
       device::FidoTransportProtocol::kCloudAssistedBluetoothLowEnergy));
 }
 
-TEST_F(AuthenticatorImplTest, TestCableDiscoveryDisabledForMakeCredential) {
-  EnableFeature(features::kWebAuthCable);
-
+TEST_F(AuthenticatorImplTest, TestCableDiscoveryDisabledWithoutFlag) {
+  scoped_feature_list_.emplace();
+  scoped_feature_list_->InitAndDisableFeature(features::kWebAuthCable);
+  TestServiceManagerContext service_manager_context;
   SimulateNavigation(GURL(kTestOrigin1));
-  PublicKeyCredentialCreationOptionsPtr options =
-      GetTestPublicKeyCredentialCreationOptions();
-  TestMakeCredentialCallback callback_receiver;
+  PublicKeyCredentialRequestOptionsPtr options =
+      GetTestPublicKeyCredentialRequestOptions();
+  TestGetAssertionCallback callback_receiver;
 
   auto task_runner = base::MakeRefCounted<base::TestMockTimeTaskRunner>(
       base::Time::Now(), base::TimeTicks::Now());
   auto authenticator = ConstructAuthenticatorWithTimer(task_runner);
-  authenticator->MakeCredential(std::move(options),
-                                callback_receiver.callback());
+  authenticator->GetAssertion(std::move(options), callback_receiver.callback());
 
   // Trigger timer.
   base::RunLoop().RunUntilIdle();
@@ -868,16 +866,17 @@
       device::FidoTransportProtocol::kCloudAssistedBluetoothLowEnergy));
 }
 
-TEST_F(AuthenticatorImplTest, TestCableDiscoveryDisabledWithoutSwitch) {
+TEST_F(AuthenticatorImplTest, TestCableDiscoveryDisabledForMakeCredential) {
   SimulateNavigation(GURL(kTestOrigin1));
-  PublicKeyCredentialRequestOptionsPtr options =
-      GetTestPublicKeyCredentialRequestOptions();
-  TestGetAssertionCallback callback_receiver;
+  PublicKeyCredentialCreationOptionsPtr options =
+      GetTestPublicKeyCredentialCreationOptions();
+  TestMakeCredentialCallback callback_receiver;
 
   auto task_runner = base::MakeRefCounted<base::TestMockTimeTaskRunner>(
       base::Time::Now(), base::TimeTicks::Now());
   auto authenticator = ConstructAuthenticatorWithTimer(task_runner);
-  authenticator->GetAssertion(std::move(options), callback_receiver.callback());
+  authenticator->MakeCredential(std::move(options),
+                                callback_receiver.callback());
 
   // Trigger timer.
   base::RunLoop().RunUntilIdle();

diff --git a/content/public/browser/service_worker_context.h b/content/public/browser/service_worker_context.h
index 61f14836..896d4b1 100644
--- a/content/public/browser/service_worker_context.h
+++ b/content/public/browser/service_worker_context.h

@@ -66,15 +66,6 @@
   using StartWorkerCallback =
       base::OnceCallback<void(int process_id, int thread_id)>;
 
-  // Registers the header name which should not be passed to the ServiceWorker.
-  // Must be called from the IO thread.
-  CONTENT_EXPORT static void AddExcludedHeadersForFetchEvent(
-      const std::set<std::string>& header_names);
-
-  // Returns true if the header name should not be passed to the ServiceWorker.
-  // Must be called from the IO thread.
-  static bool IsExcludedHeaderNameForFetchEvent(const std::string& header_name);
-
   // Returns true if |url| is within the service worker |scope|.
   CONTENT_EXPORT static bool ScopeMatches(const GURL& scope, const GURL& url);
 

diff --git a/content/public/browser/site_instance.h b/content/public/browser/site_instance.h
index a073983..1bb3482 100644
--- a/content/public/browser/site_instance.h
+++ b/content/public/browser/site_instance.h

@@ -170,7 +170,9 @@
                             const GURL& dest_url);
 
   // Returns the site for the given URL, which includes only the scheme and
-  // registered domain.  Returns an empty GURL if the URL has no host.
+  // registered domain.  Returns an empty GURL if the URL has no host. Prior to
+  // determining the site, |url| is resolved to an effective URL via
+  // ContentBrowserClient::GetEffectiveURL().
   static GURL GetSiteForURL(BrowserContext* context, const GURL& url);
 
  protected:

diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index 8c8367e5..0a040f4 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc

@@ -524,7 +524,7 @@
 // using pairingless BLE protocol.
 // https://w3c.github.io/webauthn
 const base::Feature kWebAuthCable{"WebAuthenticationCable",
-                                  base::FEATURE_DISABLED_BY_DEFAULT};
+                                  base::FEATURE_ENABLED_BY_DEFAULT};
 
 // If WebGL Image Chromium is allowed, this feature controls whether it is
 // enabled.

diff --git a/content/public/renderer/content_renderer_client.cc b/content/public/renderer/content_renderer_client.cc
index 306dda80..84f90fa 100644
--- a/content/public/renderer/content_renderer_client.cc
+++ b/content/public/renderer/content_renderer_client.cc

@@ -235,6 +235,11 @@
   return nullptr;
 }
 
+bool ContentRendererClient::IsExcludedHeaderForServiceWorkerFetchEvent(
+    const std::string& header_name) {
+  return false;
+}
+
 bool ContentRendererClient::ShouldEnforceWebRTCRoutingPreferences() {
   return true;
 }

diff --git a/content/public/renderer/content_renderer_client.h b/content/public/renderer/content_renderer_client.h
index 351fb0f6..f1c9cc59 100644
--- a/content/public/renderer/content_renderer_client.h
+++ b/content/public/renderer/content_renderer_client.h

@@ -367,6 +367,13 @@
       const GURL& service_worker_scope,
       const GURL& script_url) {}
 
+  // Asks the embedder whether to exclude the given header from service worker
+  // fetch events. This is useful if the embedder injects headers that it wants
+  // to go to network but not to the service worker. This function is called
+  // from the worker thread.
+  virtual bool IsExcludedHeaderForServiceWorkerFetchEvent(
+      const std::string& header_name);
+
   // Whether this renderer should enforce preferences related to the WebRTC
   // routing logic, i.e. allowing multiple routes and non-proxied UDP.
   virtual bool ShouldEnforceWebRTCRoutingPreferences();

diff --git a/content/public/test/browser_test_base.cc b/content/public/test/browser_test_base.cc
index 5b84ebd..eb8f5ad5 100644
--- a/content/public/test/browser_test_base.cc
+++ b/content/public/test/browser_test_base.cc

@@ -492,20 +492,6 @@
     // For now, this covers all the rules used in content's tests.
     // TODO(jam: expand this when we try to make browser_tests and
     // components_browsertests work.
-    if (rule.resolver_type ==
-        net::RuleBasedHostResolverProc::Rule::kResolverTypeFail) {
-      // The host "wpad" is added automatically in TestHostResolver, so we don't
-      // need to send it to NetworkServiceTest.
-      if (rule.host_pattern != "wpad") {
-        network::mojom::RulePtr mojo_rule = network::mojom::Rule::New();
-        mojo_rule->resolver_type =
-            network::mojom::ResolverType::kResolverTypeFail;
-        mojo_rule->host_pattern = rule.host_pattern;
-        mojo_rules.push_back(std::move(mojo_rule));
-      }
-      continue;
-    }
-
     if ((rule.resolver_type !=
              net::RuleBasedHostResolverProc::Rule::kResolverTypeSystem &&
          rule.resolver_type !=
@@ -514,14 +500,6 @@
         !!rule.latency_ms || rule.replacement.empty())
       continue;
     network::mojom::RulePtr mojo_rule = network::mojom::Rule::New();
-    if (rule.resolver_type ==
-        net::RuleBasedHostResolverProc::Rule::kResolverTypeSystem) {
-      mojo_rule->resolver_type =
-          network::mojom::ResolverType::kResolverTypeSystem;
-    } else {
-      mojo_rule->resolver_type =
-          network::mojom::ResolverType::kResolverTypeIPLiteral;
-    }
     mojo_rule->host_pattern = rule.host_pattern;
     mojo_rule->replacement = rule.replacement;
     mojo_rules.push_back(std::move(mojo_rule));

diff --git a/content/public/test/network_service_test_helper.cc b/content/public/test/network_service_test_helper.cc
index 2d81fbb5a..812c837 100644
--- a/content/public/test/network_service_test_helper.cc
+++ b/content/public/test/network_service_test_helper.cc

@@ -40,19 +40,6 @@
 
 namespace content {
 namespace {
-
-#define STATIC_ASSERT_ENUM(a, b)                            \
-  static_assert(static_cast<int>(a) == static_cast<int>(b), \
-                "mismatching enums: " #a)
-
-STATIC_ASSERT_ENUM(network::mojom::ResolverType::kResolverTypeFail,
-                   net::RuleBasedHostResolverProc::Rule::kResolverTypeFail);
-STATIC_ASSERT_ENUM(network::mojom::ResolverType::kResolverTypeSystem,
-                   net::RuleBasedHostResolverProc::Rule::kResolverTypeSystem);
-STATIC_ASSERT_ENUM(
-    network::mojom::ResolverType::kResolverTypeIPLiteral,
-    net::RuleBasedHostResolverProc::Rule::kResolverTypeIPLiteral);
-
 void CrashResolveHost(const std::string& host_to_crash,
                       const std::string& host) {
   if (host_to_crash == host)
@@ -81,14 +68,8 @@
   void AddRules(std::vector<network::mojom::RulePtr> rules,
                 AddRulesCallback callback) override {
     for (const auto& rule : rules) {
-      if (rule->resolver_type ==
-          network::mojom::ResolverType::kResolverTypeFail) {
-        test_host_resolver_.host_resolver()->AddSimulatedFailure(
-            rule->host_pattern);
-      } else {
-        test_host_resolver_.host_resolver()->AddRule(rule->host_pattern,
-                                                     rule->replacement);
-      }
+      test_host_resolver_.host_resolver()->AddRule(rule->host_pattern,
+                                                   rule->replacement);
     }
     std::move(callback).Run();
   }

diff --git a/content/renderer/service_worker/service_worker_context_client.cc b/content/renderer/service_worker/service_worker_context_client.cc
index 1c90681..a437bebd 100644
--- a/content/renderer/service_worker/service_worker_context_client.cc
+++ b/content/renderer/service_worker/service_worker_context_client.cc

@@ -191,20 +191,31 @@
   return web_client_info;
 }
 
+// If |is_for_fetch_event| is true, some headers may be omitted according
+// to the embedder. It's always true now, but it might change with
+// more Onion Souping, and future callsites like Background Fetch probably don't
+// want to do the header filtering, since it's important for them to have the
+// exact request as sent to network.
 void ToWebServiceWorkerRequest(const network::ResourceRequest& request,
                                const std::string request_body_blob_uuid,
                                uint64_t request_body_blob_size,
                                blink::mojom::BlobPtrInfo request_body_blob,
                                const std::string& client_id,
                                std::vector<blink::mojom::BlobPtrInfo> blob_ptrs,
-                               blink::WebServiceWorkerRequest* web_request) {
+                               blink::WebServiceWorkerRequest* web_request,
+                               bool is_for_fetch_event) {
   DCHECK(web_request);
   web_request->SetURL(blink::WebURL(request.url));
   web_request->SetMethod(blink::WebString::FromUTF8(request.method));
   if (!request.headers.IsEmpty()) {
     for (net::HttpRequestHeaders::Iterator it(request.headers); it.GetNext();) {
-      web_request->SetHeader(blink::WebString::FromUTF8(it.name()),
-                             blink::WebString::FromUTF8(it.value()));
+      if (!is_for_fetch_event ||
+          !GetContentClient()
+               ->renderer()
+               ->IsExcludedHeaderForServiceWorkerFetchEvent(it.name())) {
+        web_request->SetHeader(blink::WebString::FromUTF8(it.name()),
+                               blink::WebString::FromUTF8(it.value()));
+      }
     }
   }
 
@@ -1812,7 +1823,7 @@
       std::move(params->request), params->request_body_blob_uuid,
       params->request_body_blob_size, std::move(params->request_body_blob),
       params->client_id, std::move(params->request_body_blob_ptrs),
-      &web_request);
+      &web_request, true /* is_for_fetch_event */);
   proxy_->DispatchFetchEvent(event_id, web_request, navigation_preload_sent);
 }
 

diff --git a/content/renderer/service_worker/service_worker_context_client_unittest.cc b/content/renderer/service_worker/service_worker_context_client_unittest.cc
index 70663bb..783f7f5 100644
--- a/content/renderer/service_worker/service_worker_context_client_unittest.cc
+++ b/content/renderer/service_worker/service_worker_context_client_unittest.cc

@@ -14,8 +14,12 @@
 #include "base/time/tick_clock.h"
 #include "base/time/time.h"
 #include "content/child/thread_safe_sender.h"
+#include "content/common/service_worker/service_worker_types.h"
+#include "content/public/common/content_client.h"
+#include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/service_worker/embedded_worker_instance_client_impl.h"
 #include "content/renderer/service_worker/service_worker_timeout_timer.h"
+#include "content/renderer/service_worker/service_worker_type_util.h"
 #include "content/renderer/service_worker/web_service_worker_impl.h"
 #include "content/renderer/worker_thread_registry.h"
 #include "mojo/public/cpp/bindings/associated_binding_set.h"
@@ -359,10 +363,60 @@
   task_runner()->RunUntilIdle();
 
   ASSERT_EQ(1u, mock_proxy.fetch_events().size());
-  EXPECT_EQ(request->url,
+  EXPECT_EQ(expected_url,
             static_cast<GURL>(mock_proxy.fetch_events()[0].second.Url()));
 }
 
+class HeaderContentRendererClient : public ContentRendererClient {
+  bool IsExcludedHeaderForServiceWorkerFetchEvent(
+      const std::string& header_name) override {
+    return header_name == "x-bye-bye";
+  }
+};
+
+TEST_F(ServiceWorkerContextClientTest, DispatchFetchEvent_Headers) {
+  HeaderContentRendererClient header_client;
+  auto* old_client = SetRendererClientForTesting(&header_client);
+
+  ContextClientPipes pipes;
+  MockWebServiceWorkerContextProxy mock_proxy;
+  std::unique_ptr<ServiceWorkerContextClient> context_client =
+      CreateContextClient(&pipes, &mock_proxy);
+  context_client->DidEvaluateClassicScript(true /* success */);
+  task_runner()->RunUntilIdle();
+  EXPECT_TRUE(mock_proxy.fetch_events().empty());
+
+  const GURL expected_url("https://example.com/expected");
+  auto request = std::make_unique<network::ResourceRequest>();
+  request->url = expected_url;
+  request->headers.SetHeader("x-bye-bye", "excluded");
+  request->headers.SetHeader("x-hi-hi", "present");
+  blink::mojom::ServiceWorkerFetchResponseCallbackPtr fetch_callback_ptr;
+  blink::mojom::ServiceWorkerFetchResponseCallbackRequest
+      fetch_callback_request = mojo::MakeRequest(&fetch_callback_ptr);
+  auto params = blink::mojom::DispatchFetchEventParams::New();
+  params->request = *request;
+  pipes.service_worker->DispatchFetchEvent(
+      std::move(params), std::move(fetch_callback_ptr),
+      base::BindOnce(
+          [](blink::mojom::ServiceWorkerEventStatus, base::Time) {}));
+  task_runner()->RunUntilIdle();
+
+  ASSERT_EQ(1u, mock_proxy.fetch_events().size());
+  const blink::WebServiceWorkerRequest& received_request =
+      mock_proxy.fetch_events()[0].second;
+  ServiceWorkerHeaderMap header_map;
+  GetServiceWorkerHeaderMapFromWebRequest(received_request, &header_map);
+
+  EXPECT_EQ(expected_url, static_cast<GURL>(received_request.Url()));
+  EXPECT_TRUE(header_map.find("x-bye-bye") == header_map.end());
+  auto iter = header_map.find("x-hi-hi");
+  ASSERT_TRUE(iter != header_map.end());
+  EXPECT_EQ("present", iter->second);
+
+  SetRendererClientForTesting(old_client);
+}
+
 TEST_F(ServiceWorkerContextClientTest,
        DispatchOrQueueFetchEvent_NotRequestedTermination) {
   EnableServicification();

diff --git a/content/renderer/service_worker/service_worker_type_util.h b/content/renderer/service_worker/service_worker_type_util.h
index 374a898..006aef88 100644
--- a/content/renderer/service_worker/service_worker_type_util.h
+++ b/content/renderer/service_worker/service_worker_type_util.h

@@ -15,7 +15,7 @@
 
 namespace content {
 
-void GetServiceWorkerHeaderMapFromWebRequest(
+void CONTENT_EXPORT GetServiceWorkerHeaderMapFromWebRequest(
     const blink::WebServiceWorkerRequest& web_request,
     ServiceWorkerHeaderMap* headers);
 

diff --git a/device/BUILD.gn b/device/BUILD.gn
index cc06a2d..e16eb14 100644
--- a/device/BUILD.gn
+++ b/device/BUILD.gn

@@ -64,6 +64,8 @@
     "bluetooth/test/test_bluetooth_adapter_observer.h",
     "bluetooth/test/test_bluetooth_local_gatt_service_delegate.cc",
     "bluetooth/test/test_bluetooth_local_gatt_service_delegate.h",
+    "bluetooth/test/test_pairing_delegate.cc",
+    "bluetooth/test/test_pairing_delegate.h",
     "bluetooth/uribeacon/uri_encoder_unittest.cc",
     "fido/attestation_statement_formats_unittest.cc",
     "fido/ble/fido_ble_connection_unittest.cc",
@@ -298,10 +300,16 @@
       "bluetooth/test/fake_bluetooth_le_device_winrt.h",
       "bluetooth/test/fake_bluetooth_le_manufacturer_data_winrt.cc",
       "bluetooth/test/fake_bluetooth_le_manufacturer_data_winrt.h",
+      "bluetooth/test/fake_device_information_custom_pairing_winrt.cc",
+      "bluetooth/test/fake_device_information_custom_pairing_winrt.h",
       "bluetooth/test/fake_device_information_pairing_winrt.cc",
       "bluetooth/test/fake_device_information_pairing_winrt.h",
       "bluetooth/test/fake_device_information_winrt.cc",
       "bluetooth/test/fake_device_information_winrt.h",
+      "bluetooth/test/fake_device_pairing_requested_event_args_winrt.cc",
+      "bluetooth/test/fake_device_pairing_requested_event_args_winrt.h",
+      "bluetooth/test/fake_device_pairing_result_winrt.cc",
+      "bluetooth/test/fake_device_pairing_result_winrt.h",
       "bluetooth/test/fake_gatt_characteristic_winrt.cc",
       "bluetooth/test/fake_gatt_characteristic_winrt.h",
       "bluetooth/test/fake_gatt_characteristics_result_winrt.cc",

diff --git a/device/bluetooth/bluetooth_adapter_unittest.cc b/device/bluetooth/bluetooth_adapter_unittest.cc
index fe16beb9..63f988f 100644
--- a/device/bluetooth/bluetooth_adapter_unittest.cc
+++ b/device/bluetooth/bluetooth_adapter_unittest.cc

@@ -44,6 +44,8 @@
 
 namespace device {
 
+namespace {
+
 class TestBluetoothAdapter : public BluetoothAdapter {
  public:
   TestBluetoothAdapter() = default;
@@ -176,6 +178,8 @@
   void AuthorizePairing(BluetoothDevice* device) override {}
 };
 
+}  // namespace
+
 TEST(BluetoothAdapterTest, NoDefaultPairingDelegate) {
   scoped_refptr<BluetoothAdapter> adapter = new TestBluetoothAdapter();
 

diff --git a/device/bluetooth/bluez/bluetooth_bluez_unittest.cc b/device/bluetooth/bluez/bluetooth_bluez_unittest.cc
index 0d5201a1..d5e68b15 100644
--- a/device/bluetooth/bluez/bluetooth_bluez_unittest.cc
+++ b/device/bluetooth/bluez/bluetooth_bluez_unittest.cc

@@ -30,6 +30,7 @@
 #include "device/bluetooth/dbus/fake_bluetooth_gatt_service_client.h"
 #include "device/bluetooth/dbus/fake_bluetooth_input_client.h"
 #include "device/bluetooth/test/test_bluetooth_adapter_observer.h"
+#include "device/bluetooth/test/test_pairing_delegate.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
@@ -41,6 +42,7 @@
 using device::BluetoothDiscoverySession;
 using device::BluetoothUUID;
 using device::TestBluetoothAdapterObserver;
+using device::TestPairingDelegate;
 
 namespace bluez {
 
@@ -87,88 +89,6 @@
 
 }  // namespace
 
-class TestPairingDelegate : public BluetoothDevice::PairingDelegate {
- public:
-  TestPairingDelegate()
-      : call_count_(0),
-        request_pincode_count_(0),
-        request_passkey_count_(0),
-        display_pincode_count_(0),
-        display_passkey_count_(0),
-        keys_entered_count_(0),
-        confirm_passkey_count_(0),
-        authorize_pairing_count_(0),
-        last_passkey_(9999999U),
-        last_entered_(999U) {}
-  ~TestPairingDelegate() override = default;
-
-  void RequestPinCode(BluetoothDevice* device) override {
-    ++call_count_;
-    ++request_pincode_count_;
-    QuitMessageLoop();
-  }
-
-  void RequestPasskey(BluetoothDevice* device) override {
-    ++call_count_;
-    ++request_passkey_count_;
-    QuitMessageLoop();
-  }
-
-  void DisplayPinCode(BluetoothDevice* device,
-                      const std::string& pincode) override {
-    ++call_count_;
-    ++display_pincode_count_;
-    last_pincode_ = pincode;
-    QuitMessageLoop();
-  }
-
-  void DisplayPasskey(BluetoothDevice* device, uint32_t passkey) override {
-    ++call_count_;
-    ++display_passkey_count_;
-    last_passkey_ = passkey;
-    QuitMessageLoop();
-  }
-
-  void KeysEntered(BluetoothDevice* device, uint32_t entered) override {
-    ++call_count_;
-    ++keys_entered_count_;
-    last_entered_ = entered;
-    QuitMessageLoop();
-  }
-
-  void ConfirmPasskey(BluetoothDevice* device, uint32_t passkey) override {
-    ++call_count_;
-    ++confirm_passkey_count_;
-    last_passkey_ = passkey;
-    QuitMessageLoop();
-  }
-
-  void AuthorizePairing(BluetoothDevice* device) override {
-    ++call_count_;
-    ++authorize_pairing_count_;
-    QuitMessageLoop();
-  }
-
-  int call_count_;
-  int request_pincode_count_;
-  int request_passkey_count_;
-  int display_pincode_count_;
-  int display_passkey_count_;
-  int keys_entered_count_;
-  int confirm_passkey_count_;
-  int authorize_pairing_count_;
-  uint32_t last_passkey_;
-  uint32_t last_entered_;
-  std::string last_pincode_;
-
- private:
-  // Some tests use a message loop since background processing is simulated;
-  // break out of those loops.
-  void QuitMessageLoop() {
-    if (base::RunLoop::IsRunningOnCurrentThread())
-      base::RunLoop::QuitCurrentWhenIdleDeprecated();
-  }
-};
 
 class BluetoothBlueZTest : public testing::Test {
  public:

diff --git a/device/bluetooth/test/fake_device_information_custom_pairing_winrt.cc b/device/bluetooth/test/fake_device_information_custom_pairing_winrt.cc
new file mode 100644
index 0000000..87e9f94
--- /dev/null
+++ b/device/bluetooth/test/fake_device_information_custom_pairing_winrt.cc

@@ -0,0 +1,64 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "device/bluetooth/test/fake_device_information_custom_pairing_winrt.h"
+
+#include <windows.foundation.h>
+
+namespace device {
+
+namespace {
+
+using ABI::Windows::Devices::Enumeration::DeviceInformationCustomPairing;
+using ABI::Windows::Devices::Enumeration::DevicePairingKinds;
+using ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel;
+using ABI::Windows::Devices::Enumeration::DevicePairingRequestedEventArgs;
+using ABI::Windows::Devices::Enumeration::DevicePairingResult;
+using ABI::Windows::Devices::Enumeration::IDevicePairingSettings;
+using ABI::Windows::Foundation::IAsyncOperation;
+using ABI::Windows::Foundation::ITypedEventHandler;
+
+}  // namespace
+
+FakeDeviceInformationCustomPairingWinrt::
+    FakeDeviceInformationCustomPairingWinrt() = default;
+
+FakeDeviceInformationCustomPairingWinrt::
+    ~FakeDeviceInformationCustomPairingWinrt() = default;
+
+HRESULT FakeDeviceInformationCustomPairingWinrt::PairAsync(
+    DevicePairingKinds pairing_kinds_supported,
+    IAsyncOperation<DevicePairingResult*>** result) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDeviceInformationCustomPairingWinrt::PairWithProtectionLevelAsync(
+    DevicePairingKinds pairing_kinds_supported,
+    DevicePairingProtectionLevel min_protection_level,
+    IAsyncOperation<DevicePairingResult*>** result) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDeviceInformationCustomPairingWinrt::
+    PairWithProtectionLevelAndSettingsAsync(
+        DevicePairingKinds pairing_kinds_supported,
+        DevicePairingProtectionLevel min_protection_level,
+        IDevicePairingSettings* device_pairing_settings,
+        IAsyncOperation<DevicePairingResult*>** result) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDeviceInformationCustomPairingWinrt::add_PairingRequested(
+    ITypedEventHandler<DeviceInformationCustomPairing*,
+                       DevicePairingRequestedEventArgs*>* handler,
+    EventRegistrationToken* token) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDeviceInformationCustomPairingWinrt::remove_PairingRequested(
+    EventRegistrationToken token) {
+  return E_NOTIMPL;
+}
+
+}  // namespace device

diff --git a/device/bluetooth/test/fake_device_information_custom_pairing_winrt.h b/device/bluetooth/test/fake_device_information_custom_pairing_winrt.h
new file mode 100644
index 0000000..34000d6c
--- /dev/null
+++ b/device/bluetooth/test/fake_device_information_custom_pairing_winrt.h

@@ -0,0 +1,63 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_INFORMATION_CUSTOM_PAIRING_WINRT_H_
+#define DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_INFORMATION_CUSTOM_PAIRING_WINRT_H_
+
+#include <windows.devices.enumeration.h>
+#include <wrl/implements.h>
+
+#include "base/macros.h"
+
+namespace device {
+
+class FakeDeviceInformationCustomPairingWinrt
+    : public Microsoft::WRL::RuntimeClass<
+          Microsoft::WRL::RuntimeClassFlags<
+              Microsoft::WRL::WinRt | Microsoft::WRL::InhibitRoOriginateError>,
+          ABI::Windows::Devices::Enumeration::IDeviceInformationCustomPairing> {
+ public:
+  FakeDeviceInformationCustomPairingWinrt();
+  ~FakeDeviceInformationCustomPairingWinrt() override;
+
+  // IDeviceInformationCustomPairing:
+  IFACEMETHODIMP PairAsync(
+      ABI::Windows::Devices::Enumeration::DevicePairingKinds
+          pairing_kinds_supported,
+      ABI::Windows::Foundation::IAsyncOperation<
+          ABI::Windows::Devices::Enumeration::DevicePairingResult*>** result)
+      override;
+  IFACEMETHODIMP PairWithProtectionLevelAsync(
+      ABI::Windows::Devices::Enumeration::DevicePairingKinds
+          pairing_kinds_supported,
+      ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel
+          min_protection_level,
+      ABI::Windows::Foundation::IAsyncOperation<
+          ABI::Windows::Devices::Enumeration::DevicePairingResult*>** result)
+      override;
+  IFACEMETHODIMP PairWithProtectionLevelAndSettingsAsync(
+      ABI::Windows::Devices::Enumeration::DevicePairingKinds
+          pairing_kinds_supported,
+      ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel
+          min_protection_level,
+      ABI::Windows::Devices::Enumeration::IDevicePairingSettings*
+          device_pairing_settings,
+      ABI::Windows::Foundation::IAsyncOperation<
+          ABI::Windows::Devices::Enumeration::DevicePairingResult*>** result)
+      override;
+  IFACEMETHODIMP add_PairingRequested(
+      ABI::Windows::Foundation::ITypedEventHandler<
+          ABI::Windows::Devices::Enumeration::DeviceInformationCustomPairing*,
+          ABI::Windows::Devices::Enumeration::DevicePairingRequestedEventArgs*>*
+          handler,
+      EventRegistrationToken* token) override;
+  IFACEMETHODIMP remove_PairingRequested(EventRegistrationToken token) override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FakeDeviceInformationCustomPairingWinrt);
+};
+
+}  // namespace device
+
+#endif  // DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_INFORMATION_CUSTOM_PAIRING_WINRT_H_

diff --git a/device/bluetooth/test/fake_device_information_pairing_winrt.cc b/device/bluetooth/test/fake_device_information_pairing_winrt.cc
index f41d7e6..3be2ea8 100644
--- a/device/bluetooth/test/fake_device_information_pairing_winrt.cc
+++ b/device/bluetooth/test/fake_device_information_pairing_winrt.cc

@@ -10,6 +10,9 @@
 
 using ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel;
 using ABI::Windows::Devices::Enumeration::DevicePairingResult;
+using ABI::Windows::Devices::Enumeration::DeviceUnpairingResult;
+using ABI::Windows::Devices::Enumeration::IDeviceInformationCustomPairing;
+using ABI::Windows::Devices::Enumeration::IDevicePairingSettings;
 using ABI::Windows::Foundation::IAsyncOperation;
 
 }  // namespace
@@ -41,4 +44,27 @@
   return E_NOTIMPL;
 }
 
+HRESULT FakeDeviceInformationPairingWinrt::get_ProtectionLevel(
+    DevicePairingProtectionLevel* value) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDeviceInformationPairingWinrt::get_Custom(
+    IDeviceInformationCustomPairing** value) {
+  return E_NOTIMPL;
+}
+
+HRESULT
+FakeDeviceInformationPairingWinrt::PairWithProtectionLevelAndSettingsAsync(
+    DevicePairingProtectionLevel min_protection_level,
+    IDevicePairingSettings* device_pairing_settings,
+    IAsyncOperation<DevicePairingResult*>** result) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDeviceInformationPairingWinrt::UnpairAsync(
+    IAsyncOperation<DeviceUnpairingResult*>** result) {
+  return E_NOTIMPL;
+}
+
 }  // namespace device

diff --git a/device/bluetooth/test/fake_device_information_pairing_winrt.h b/device/bluetooth/test/fake_device_information_pairing_winrt.h
index 38f2fb4..a71a92c 100644
--- a/device/bluetooth/test/fake_device_information_pairing_winrt.h
+++ b/device/bluetooth/test/fake_device_information_pairing_winrt.h

@@ -17,7 +17,8 @@
     : public Microsoft::WRL::RuntimeClass<
           Microsoft::WRL::RuntimeClassFlags<
               Microsoft::WRL::WinRt | Microsoft::WRL::InhibitRoOriginateError>,
-          ABI::Windows::Devices::Enumeration::IDeviceInformationPairing> {
+          ABI::Windows::Devices::Enumeration::IDeviceInformationPairing,
+          ABI::Windows::Devices::Enumeration::IDeviceInformationPairing2> {
  public:
   explicit FakeDeviceInformationPairingWinrt(bool is_paired);
   ~FakeDeviceInformationPairingWinrt() override;
@@ -36,6 +37,26 @@
           ABI::Windows::Devices::Enumeration::DevicePairingResult*>** result)
       override;
 
+  // IDeviceInformationPairing2:
+  IFACEMETHODIMP get_ProtectionLevel(
+      ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel* value)
+      override;
+  IFACEMETHODIMP get_Custom(
+      ABI::Windows::Devices::Enumeration::IDeviceInformationCustomPairing**
+          value) override;
+  IFACEMETHODIMP PairWithProtectionLevelAndSettingsAsync(
+      ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel
+          min_protection_level,
+      ABI::Windows::Devices::Enumeration::IDevicePairingSettings*
+          device_pairing_settings,
+      ABI::Windows::Foundation::IAsyncOperation<
+          ABI::Windows::Devices::Enumeration::DevicePairingResult*>** result)
+      override;
+  IFACEMETHODIMP UnpairAsync(
+      ABI::Windows::Foundation::IAsyncOperation<
+          ABI::Windows::Devices::Enumeration::DeviceUnpairingResult*>** result)
+      override;
+
  private:
   bool is_paired_ = false;
 

diff --git a/device/bluetooth/test/fake_device_pairing_requested_event_args_winrt.cc b/device/bluetooth/test/fake_device_pairing_requested_event_args_winrt.cc
new file mode 100644
index 0000000..fe0c6a1
--- /dev/null
+++ b/device/bluetooth/test/fake_device_pairing_requested_event_args_winrt.cc

@@ -0,0 +1,68 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "device/bluetooth/test/fake_device_pairing_requested_event_args_winrt.h"
+
+#include <windows.foundation.h>
+
+namespace device {
+
+namespace {
+
+using ABI::Windows::Devices::Enumeration::IDeviceInformation;
+using ABI::Windows::Devices::Enumeration::DevicePairingKinds;
+using ABI::Windows::Foundation::IDeferral;
+
+class FakeDeferral
+    : public Microsoft::WRL::RuntimeClass<
+          Microsoft::WRL::RuntimeClassFlags<
+              Microsoft::WRL::WinRt | Microsoft::WRL::InhibitRoOriginateError>,
+          ABI::Windows::Foundation::IDeferral> {
+ public:
+  FakeDeferral() = default;
+  ~FakeDeferral() override = default;
+
+  // IDeferral:
+  IFACEMETHODIMP Complete() override { return E_NOTIMPL; }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FakeDeferral);
+};
+
+}  // namespace
+
+FakeDevicePairingRequestedEventArgsWinrt::
+    FakeDevicePairingRequestedEventArgsWinrt() = default;
+
+FakeDevicePairingRequestedEventArgsWinrt::
+    ~FakeDevicePairingRequestedEventArgsWinrt() = default;
+
+HRESULT FakeDevicePairingRequestedEventArgsWinrt::get_DeviceInformation(
+    IDeviceInformation** value) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDevicePairingRequestedEventArgsWinrt::get_PairingKind(
+    DevicePairingKinds* value) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDevicePairingRequestedEventArgsWinrt::get_Pin(HSTRING* value) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDevicePairingRequestedEventArgsWinrt::Accept() {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDevicePairingRequestedEventArgsWinrt::AcceptWithPin(HSTRING pin) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDevicePairingRequestedEventArgsWinrt::GetDeferral(
+    IDeferral** result) {
+  return E_NOTIMPL;
+}
+
+}  // namespace device

diff --git a/device/bluetooth/test/fake_device_pairing_requested_event_args_winrt.h b/device/bluetooth/test/fake_device_pairing_requested_event_args_winrt.h
new file mode 100644
index 0000000..cd3bd0c
--- /dev/null
+++ b/device/bluetooth/test/fake_device_pairing_requested_event_args_winrt.h

@@ -0,0 +1,42 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_PAIRING_REQUESTED_EVENT_ARGS_WINRT_H_
+#define DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_PAIRING_REQUESTED_EVENT_ARGS_WINRT_H_
+
+#include <windows.devices.enumeration.h>
+#include <wrl/implements.h>
+
+#include "base/macros.h"
+
+namespace device {
+
+class FakeDevicePairingRequestedEventArgsWinrt
+    : public Microsoft::WRL::RuntimeClass<
+          Microsoft::WRL::RuntimeClassFlags<
+              Microsoft::WRL::WinRt | Microsoft::WRL::InhibitRoOriginateError>,
+          ABI::Windows::Devices::Enumeration::
+              IDevicePairingRequestedEventArgs> {
+ public:
+  FakeDevicePairingRequestedEventArgsWinrt();
+  ~FakeDevicePairingRequestedEventArgsWinrt() override;
+
+  // IDevicePairingRequestedEventArgs:
+  IFACEMETHODIMP get_DeviceInformation(
+      ABI::Windows::Devices::Enumeration::IDeviceInformation** value) override;
+  IFACEMETHODIMP get_PairingKind(
+      ABI::Windows::Devices::Enumeration::DevicePairingKinds* value) override;
+  IFACEMETHODIMP get_Pin(HSTRING* value) override;
+  IFACEMETHODIMP Accept() override;
+  IFACEMETHODIMP AcceptWithPin(HSTRING pin) override;
+  IFACEMETHODIMP GetDeferral(
+      ABI::Windows::Foundation::IDeferral** result) override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FakeDevicePairingRequestedEventArgsWinrt);
+};
+
+}  // namespace device
+
+#endif  // DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_PAIRING_REQUESTED_EVENT_ARGS_WINRT_H_

diff --git a/device/bluetooth/test/fake_device_pairing_result_winrt.cc b/device/bluetooth/test/fake_device_pairing_result_winrt.cc
new file mode 100644
index 0000000..72959e2
--- /dev/null
+++ b/device/bluetooth/test/fake_device_pairing_result_winrt.cc

@@ -0,0 +1,30 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "device/bluetooth/test/fake_device_pairing_result_winrt.h"
+
+namespace {
+
+using ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel;
+using ABI::Windows::Devices::Enumeration::DevicePairingResultStatus;
+
+}  // namespace
+
+namespace device {
+
+FakeDevicePairingResultWinrt::FakeDevicePairingResultWinrt() = default;
+
+FakeDevicePairingResultWinrt::~FakeDevicePairingResultWinrt() = default;
+
+HRESULT FakeDevicePairingResultWinrt::get_Status(
+    DevicePairingResultStatus* status) {
+  return E_NOTIMPL;
+}
+
+HRESULT FakeDevicePairingResultWinrt::get_ProtectionLevelUsed(
+    DevicePairingProtectionLevel* value) {
+  return E_NOTIMPL;
+}
+
+}  // namespace device

diff --git a/device/bluetooth/test/fake_device_pairing_result_winrt.h b/device/bluetooth/test/fake_device_pairing_result_winrt.h
new file mode 100644
index 0000000..c70883b4
--- /dev/null
+++ b/device/bluetooth/test/fake_device_pairing_result_winrt.h

@@ -0,0 +1,38 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_PAIRING_RESULT_WINRT_H_
+#define DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_PAIRING_RESULT_WINRT_H_
+
+#include <windows.devices.enumeration.h>
+#include <wrl/implements.h>
+
+#include "base/macros.h"
+
+namespace device {
+
+class FakeDevicePairingResultWinrt
+    : public Microsoft::WRL::RuntimeClass<
+          Microsoft::WRL::RuntimeClassFlags<
+              Microsoft::WRL::WinRt | Microsoft::WRL::InhibitRoOriginateError>,
+          ABI::Windows::Devices::Enumeration::IDevicePairingResult> {
+ public:
+  FakeDevicePairingResultWinrt();
+  ~FakeDevicePairingResultWinrt() override;
+
+  // IDevicePairingResult:
+  IFACEMETHODIMP get_Status(
+      ABI::Windows::Devices::Enumeration::DevicePairingResultStatus* status)
+      override;
+  IFACEMETHODIMP get_ProtectionLevelUsed(
+      ABI::Windows::Devices::Enumeration::DevicePairingProtectionLevel* value)
+      override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FakeDevicePairingResultWinrt);
+};
+
+}  // namespace device
+
+#endif  // DEVICE_BLUETOOTH_TEST_FAKE_DEVICE_PAIRING_RESULT_WINRT_H_

diff --git a/device/bluetooth/test/test_pairing_delegate.cc b/device/bluetooth/test/test_pairing_delegate.cc
new file mode 100644
index 0000000..40bf761
--- /dev/null
+++ b/device/bluetooth/test/test_pairing_delegate.cc

@@ -0,0 +1,68 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "device/bluetooth/test/test_pairing_delegate.h"
+
+namespace device {
+
+TestPairingDelegate::TestPairingDelegate() = default;
+
+TestPairingDelegate::~TestPairingDelegate() = default;
+
+void TestPairingDelegate::RequestPinCode(BluetoothDevice* device) {
+  ++call_count_;
+  ++request_pincode_count_;
+  QuitMessageLoop();
+}
+
+void TestPairingDelegate::RequestPasskey(BluetoothDevice* device) {
+  ++call_count_;
+  ++request_passkey_count_;
+  QuitMessageLoop();
+}
+
+void TestPairingDelegate::DisplayPinCode(BluetoothDevice* device,
+                                         const std::string& pincode) {
+  ++call_count_;
+  ++display_pincode_count_;
+  last_pincode_ = pincode;
+  QuitMessageLoop();
+}
+
+void TestPairingDelegate::DisplayPasskey(BluetoothDevice* device,
+                                         uint32_t passkey) {
+  ++call_count_;
+  ++display_passkey_count_;
+  last_passkey_ = passkey;
+  QuitMessageLoop();
+}
+
+void TestPairingDelegate::KeysEntered(BluetoothDevice* device,
+                                      uint32_t entered) {
+  ++call_count_;
+  ++keys_entered_count_;
+  last_entered_ = entered;
+  QuitMessageLoop();
+}
+
+void TestPairingDelegate::ConfirmPasskey(BluetoothDevice* device,
+                                         uint32_t passkey) {
+  ++call_count_;
+  ++confirm_passkey_count_;
+  last_passkey_ = passkey;
+  QuitMessageLoop();
+}
+
+void TestPairingDelegate::AuthorizePairing(BluetoothDevice* device) {
+  ++call_count_;
+  ++authorize_pairing_count_;
+  QuitMessageLoop();
+}
+
+void TestPairingDelegate::QuitMessageLoop() {
+  if (base::RunLoop::IsRunningOnCurrentThread())
+    base::RunLoop::QuitCurrentWhenIdleDeprecated();
+}
+
+}  // namespace device

diff --git a/device/bluetooth/test/test_pairing_delegate.h b/device/bluetooth/test/test_pairing_delegate.h
new file mode 100644
index 0000000..aeefc4e
--- /dev/null
+++ b/device/bluetooth/test/test_pairing_delegate.h

@@ -0,0 +1,52 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef DEVICE_BLUETOOTH_TEST_TEST_PAIRING_DELEGATE_H_
+#define DEVICE_BLUETOOTH_TEST_TEST_PAIRING_DELEGATE_H_
+
+#include <stdint.h>
+
+#include <string>
+
+#include "base/run_loop.h"
+#include "device/bluetooth/bluetooth_device.h"
+
+namespace device {
+
+class TestPairingDelegate : public BluetoothDevice::PairingDelegate {
+ public:
+  TestPairingDelegate();
+  ~TestPairingDelegate() override;
+
+  // BluetoothDevice::PairingDelegate:
+  void RequestPinCode(BluetoothDevice* device) override;
+  void RequestPasskey(BluetoothDevice* device) override;
+  void DisplayPinCode(BluetoothDevice* device,
+                      const std::string& pincode) override;
+  void DisplayPasskey(BluetoothDevice* device, uint32_t passkey) override;
+  void KeysEntered(BluetoothDevice* device, uint32_t entered) override;
+  void ConfirmPasskey(BluetoothDevice* device, uint32_t passkey) override;
+  void AuthorizePairing(BluetoothDevice* device) override;
+
+  int call_count_ = 0;
+  int request_pincode_count_ = 0;
+  int request_passkey_count_ = 0;
+  int display_pincode_count_ = 0;
+  int display_passkey_count_ = 0;
+  int keys_entered_count_ = 0;
+  int confirm_passkey_count_ = 0;
+  int authorize_pairing_count_ = 0;
+  uint32_t last_passkey_ = 999999u;
+  uint32_t last_entered_ = 999u;
+  std::string last_pincode_;
+
+ private:
+  // Some tests use a message loop since background processing is simulated;
+  // break out of those loops.
+  void QuitMessageLoop();
+};
+
+}  // namespace device
+
+#endif  // DEVICE_BLUETOOTH_TEST_TEST_PAIRING_DELEGATE_H_

diff --git a/device/usb/mojo/device_manager_impl.cc b/device/usb/mojo/device_manager_impl.cc
index f474b61..8240e53 100644
--- a/device/usb/mojo/device_manager_impl.cc
+++ b/device/usb/mojo/device_manager_impl.cc

@@ -15,7 +15,6 @@
 #include "base/memory/ptr_util.h"
 #include "device/base/device_client.h"
 #include "device/usb/mojo/device_impl.h"
-#include "device/usb/mojo/permission_provider.h"
 #include "device/usb/mojo/type_converters.h"
 #include "device/usb/public/cpp/filter_utils.h"
 #include "device/usb/public/mojom/device.mojom.h"
@@ -27,26 +26,19 @@
 
 // static
 void DeviceManagerImpl::Create(
-    base::WeakPtr<PermissionProvider> permission_provider,
     mojom::UsbDeviceManagerRequest request) {
   DCHECK(DeviceClient::Get());
   UsbService* service = DeviceClient::Get()->GetUsbService();
   if (!service)
     return;
 
-  auto* device_manager_impl =
-      new DeviceManagerImpl(std::move(permission_provider), service);
+  auto* device_manager_impl = new DeviceManagerImpl(service);
   device_manager_impl->binding_ = mojo::MakeStrongBinding(
       base::WrapUnique(device_manager_impl), std::move(request));
 }
 
-DeviceManagerImpl::DeviceManagerImpl(
-    base::WeakPtr<PermissionProvider> permission_provider,
-    UsbService* usb_service)
-    : permission_provider_(permission_provider),
-      usb_service_(usb_service),
-      observer_(this),
-      weak_factory_(this) {
+DeviceManagerImpl::DeviceManagerImpl(UsbService* usb_service)
+    : usb_service_(usb_service), observer_(this), weak_factory_(this) {
   // This object owns itself and will be destroyed if the message pipe it is
   // bound to is closed, the message loop is destructed, or the UsbService is
   // shut down.
@@ -69,11 +61,8 @@
   if (!device)
     return;
 
-  if (permission_provider_ &&
-      permission_provider_->HasDevicePermission(device)) {
-    DeviceImpl::Create(std::move(device), std::move(device_request),
-                       std::move(device_client));
-  }
+  DeviceImpl::Create(std::move(device), std::move(device_request),
+                     std::move(device_client));
 }
 
 void DeviceManagerImpl::SetClient(mojom::UsbDeviceManagerClientPtr client) {
@@ -91,10 +80,7 @@
   std::vector<mojom::UsbDeviceInfoPtr> device_infos;
   for (const auto& device : devices) {
     if (UsbDeviceFilterMatchesAny(filters, *device)) {
-      if (permission_provider_ &&
-          permission_provider_->HasDevicePermission(device)) {
-        device_infos.push_back(mojom::UsbDeviceInfo::From(*device));
-      }
+      device_infos.push_back(mojom::UsbDeviceInfo::From(*device));
     }
   }
 
@@ -102,14 +88,12 @@
 }
 
 void DeviceManagerImpl::OnDeviceAdded(scoped_refptr<UsbDevice> device) {
-  if (client_ && permission_provider_ &&
-      permission_provider_->HasDevicePermission(device))
+  if (client_)
     client_->OnDeviceAdded(mojom::UsbDeviceInfo::From(*device));
 }
 
 void DeviceManagerImpl::OnDeviceRemoved(scoped_refptr<UsbDevice> device) {
-  if (client_ && permission_provider_ &&
-      permission_provider_->HasDevicePermission(device))
+  if (client_)
     client_->OnDeviceRemoved(mojom::UsbDeviceInfo::From(*device));
 }
 

diff --git a/device/usb/mojo/device_manager_impl.h b/device/usb/mojo/device_manager_impl.h
index 55e0b9e1..43224dd 100644
--- a/device/usb/mojo/device_manager_impl.h
+++ b/device/usb/mojo/device_manager_impl.h

@@ -8,6 +8,8 @@
 #include <memory>
 #include <queue>
 #include <set>
+#include <string>
+#include <vector>
 
 #include "base/callback.h"
 #include "base/macros.h"
@@ -24,21 +26,17 @@
 
 namespace usb {
 
-class PermissionProvider;
-
 // Implements the public Mojo UsbDeviceManager interface by wrapping the
 // UsbService instance.
 class DeviceManagerImpl : public mojom::UsbDeviceManager,
                           public UsbService::Observer {
  public:
-  static void Create(base::WeakPtr<PermissionProvider> permission_provider,
-                     mojom::UsbDeviceManagerRequest request);
+  static void Create(mojom::UsbDeviceManagerRequest request);
 
   ~DeviceManagerImpl() override;
 
  private:
-  DeviceManagerImpl(base::WeakPtr<PermissionProvider> permission_provider,
-                    UsbService* usb_service);
+  explicit DeviceManagerImpl(UsbService* usb_service);
 
   // DeviceManager implementation:
   void GetDevices(mojom::UsbEnumerationOptionsPtr options,
@@ -61,7 +59,6 @@
   void MaybeRunDeviceChangesCallback();
 
   mojo::StrongBindingPtr<mojom::UsbDeviceManager> binding_;
-  base::WeakPtr<PermissionProvider> permission_provider_;
 
   UsbService* usb_service_;
   ScopedObserver<UsbService, UsbService::Observer> observer_;

diff --git a/device/usb/mojo/device_manager_impl_unittest.cc b/device/usb/mojo/device_manager_impl_unittest.cc
index d247dd7..d81db9d 100644
--- a/device/usb/mojo/device_manager_impl_unittest.cc
+++ b/device/usb/mojo/device_manager_impl_unittest.cc

@@ -22,7 +22,6 @@
 #include "device/usb/mock_usb_device_handle.h"
 #include "device/usb/mock_usb_service.h"
 #include "device/usb/mojo/device_impl.h"
-#include "device/usb/mojo/mock_permission_provider.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -56,15 +55,13 @@
  protected:
   UsbDeviceManagerPtr ConnectToDeviceManager() {
     UsbDeviceManagerPtr device_manager;
-    DeviceManagerImpl::Create(permission_provider_.GetWeakPtr(),
-                              mojo::MakeRequest(&device_manager));
+    DeviceManagerImpl::Create(mojo::MakeRequest(&device_manager));
     return device_manager;
   }
 
   MockDeviceClient device_client_;
 
  private:
-  MockPermissionProvider permission_provider_;
   std::unique_ptr<base::MessageLoop> message_loop_;
 };
 

diff --git a/device/usb/mojo/mock_permission_provider.cc b/device/usb/mojo/mock_permission_provider.cc
index 7d4d20b1..14a58e1f 100644
--- a/device/usb/mojo/mock_permission_provider.cc
+++ b/device/usb/mojo/mock_permission_provider.cc

@@ -23,8 +23,9 @@
 MockPermissionProvider::~MockPermissionProvider() = default;
 
 bool MockPermissionProvider::HasDevicePermission(
-    scoped_refptr<const UsbDevice> device) const {
-  return device->serial_number() == base::ASCIIToUTF16(kRestrictedSerialNumber)
+    const mojom::UsbDeviceInfo& device_info) const {
+  return device_info.serial_number ==
+                 base::ASCIIToUTF16(kRestrictedSerialNumber)
              ? false
              : true;
 }

diff --git a/device/usb/mojo/mock_permission_provider.h b/device/usb/mojo/mock_permission_provider.h
index dc34ac33..14a04d7 100644
--- a/device/usb/mojo/mock_permission_provider.h
+++ b/device/usb/mojo/mock_permission_provider.h

@@ -9,10 +9,14 @@
 
 #include "base/memory/weak_ptr.h"
 #include "device/usb/mojo/permission_provider.h"
-#include "device/usb/usb_device.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace device {
+
+namespace mojom {
+class UsbDeviceInfo;
+}
+
 namespace usb {
 
 class MockPermissionProvider : public PermissionProvider {
@@ -24,7 +28,7 @@
 
   base::WeakPtr<PermissionProvider> GetWeakPtr();
   bool HasDevicePermission(
-      scoped_refptr<const UsbDevice> device) const override;
+      const mojom::UsbDeviceInfo& device_info) const override;
 
   MOCK_METHOD0(IncrementConnectionCount, void());
   MOCK_METHOD0(DecrementConnectionCount, void());

diff --git a/device/usb/mojo/permission_provider.h b/device/usb/mojo/permission_provider.h
index 5bb6a71..8c365944 100644
--- a/device/usb/mojo/permission_provider.h
+++ b/device/usb/mojo/permission_provider.h

@@ -5,11 +5,11 @@
 #ifndef DEVICE_USB_MOJO_PERMISSION_PROVIDER_H_
 #define DEVICE_USB_MOJO_PERMISSION_PROVIDER_H_
 
-#include "base/memory/ref_counted.h"
-
 namespace device {
 
-class UsbDevice;
+namespace mojom {
+class UsbDeviceInfo;
+}
 
 namespace usb {
 
@@ -21,7 +21,7 @@
   virtual ~PermissionProvider();
 
   virtual bool HasDevicePermission(
-      scoped_refptr<const UsbDevice> device) const = 0;
+      const mojom::UsbDeviceInfo& device_info) const = 0;
   virtual void IncrementConnectionCount() = 0;
   virtual void DecrementConnectionCount() = 0;
 };

diff --git a/docs/android_build_instructions.md b/docs/android_build_instructions.md
index a089e9f..b08cdcc 100644
--- a/docs/android_build_instructions.md
+++ b/docs/android_build_instructions.md

@@ -115,11 +115,11 @@
 
 ## Setting up the build
 
-Chromium uses [Ninja](https://ninja-build.org) as its main build tool along
-with a tool called [GN](../tools/gn/docs/quick_start.md) to generate `.ninja`
-files. You can create any number of *build directories* with different
-configurations. To create a build directory which builds Chrome for Android,
-run:
+Chromium uses [Ninja](https://ninja-build.org) as its main build tool along with
+a tool called [GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md)
+to generate `.ninja` files. You can create any number of *build directories*
+with different configurations. To create a build directory which builds Chrome
+for Android, run:
 
 ```shell
 gn gen --args='target_os="android"' out/Default

diff --git a/docs/android_cast_build_instructions.md b/docs/android_cast_build_instructions.md
index f38f4ff..9628d04 100644
--- a/docs/android_cast_build_instructions.md
+++ b/docs/android_cast_build_instructions.md

@@ -115,11 +115,11 @@
 
 ## Setting up the build
 
-Chromium uses [Ninja](https://ninja-build.org) as its main build tool along
-with a tool called [GN](../tools/gn/docs/quick_start.md) to generate `.ninja`
-files. You can create any number of *build directories* with different
-configurations. To create a build directory which builds Chrome for Android,
-run:
+Chromium uses [Ninja](https://ninja-build.org) as its main build tool along with
+a tool called [GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md)
+to generate `.ninja` files. You can create any number of *build directories*
+with different configurations. To create a build directory which builds Chrome
+for Android, run:
 
 ```shell
 $ gn gen --args='target_os="android" is_chromecast=true' out/Default

diff --git a/docs/fuchsia_build_instructions.md b/docs/fuchsia_build_instructions.md
index a08dc86..042f42b 100644
--- a/docs/fuchsia_build_instructions.md
+++ b/docs/fuchsia_build_instructions.md

@@ -84,10 +84,10 @@
 
 ## Setting up the build
 
-Chromium uses [Ninja](https://ninja-build.org) as its main build tool along
-with a tool called [GN](../tools/gn/docs/quick_start.md) to generate `.ninja`
-files. You can create any number of *build directories* with different
-configurations. To create a build directory, run:
+Chromium uses [Ninja](https://ninja-build.org) as its main build tool along with
+a tool called [GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md)
+to generate `.ninja` files. You can create any number of *build directories*
+with different configurations. To create a build directory, run:
 
 ```shell
 $ gn gen out/fuchsia --args="is_debug=false dcheck_always_on=true is_component_build=false target_os=\"fuchsia\""

diff --git a/docs/linux_build_instructions.md b/docs/linux_build_instructions.md
index f120568..4803829 100644
--- a/docs/linux_build_instructions.md
+++ b/docs/linux_build_instructions.md

@@ -105,10 +105,10 @@
 
 ## Setting up the build
 
-Chromium uses [Ninja](https://ninja-build.org) as its main build tool along
-with a tool called [GN](../tools/gn/docs/quick_start.md) to generate `.ninja`
-files. You can create any number of *build directories* with different
-configurations. To create a build directory, run:
+Chromium uses [Ninja](https://ninja-build.org) as its main build tool along with
+a tool called [GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md)
+to generate `.ninja` files. You can create any number of *build directories*
+with different configurations. To create a build directory, run:
 
 ```shell
 $ gn gen out/Default

diff --git a/docs/linux_cast_build_instructions.md b/docs/linux_cast_build_instructions.md
index 9b38baa..7f09038 100644
--- a/docs/linux_cast_build_instructions.md
+++ b/docs/linux_cast_build_instructions.md

@@ -98,10 +98,10 @@
 
 ## Setting up the build
 
-Chromium uses [Ninja](https://ninja-build.org) as its main build tool along
-with a tool called [GN](../tools/gn/docs/quick_start.md) to generate `.ninja`
-files. You can create any number of *build directories* with different
-configurations. To create a build directory, run:
+Chromium uses [Ninja](https://ninja-build.org) as its main build tool along with
+a tool called [GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md)
+to generate `.ninja` files. You can create any number of *build directories*
+with different configurations. To create a build directory, run:
 
 ```shell
 $ gn gen out/Default --args='is_chromecast=true'

diff --git a/docs/mac_build_instructions.md b/docs/mac_build_instructions.md
index 1f612d2..718bc69f 100644
--- a/docs/mac_build_instructions.md
+++ b/docs/mac_build_instructions.md

@@ -84,10 +84,10 @@
 
 ## Setting up the build
 
-Chromium uses [Ninja](https://ninja-build.org) as its main build tool along
-with a tool called [GN](../tools/gn/docs/quick_start.md) to generate `.ninja`
-files. You can create any number of *build directories* with different
-configurations. To create a build directory:
+Chromium uses [Ninja](https://ninja-build.org) as its main build tool along with
+a tool called [GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md)
+to generate `.ninja` files. You can create any number of *build directories*
+with different configurations. To create a build directory:
 
 ```shell
 $ gn gen out/Default

diff --git a/docs/testing/using_breakpad_with_content_shell.md b/docs/testing/using_breakpad_with_content_shell.md
index 534e928..9fee466 100644
--- a/docs/testing/using_breakpad_with_content_shell.md
+++ b/docs/testing/using_breakpad_with_content_shell.md

@@ -9,14 +9,16 @@
 On all platforms, build the target `blink_tests`.
 
 *** note
-**Mac:** Add `enable_dsyms = 1` to your
-[gn build arguments](../../tools/gn/docs/quick_start.md) before building. This
-slows down linking several minutes, so don't just always set it by default.
+**Mac:** Add `enable_dsyms = 1` to your [gn build
+arguments](https://gn.googlesource.com/gn/+/master/docs/quick_start.md) before
+building. This slows down linking several minutes, so don't just always set it
+by default.
 ***
 
 *** note
-**Linux:** Add `use_debug_fission = true` to your
-[gn build arguments](../../tools/gn/docs/quick_start.md) before building.
+**Linux:** Add `use_debug_fission = true` to your [gn build
+arguments](https://gn.googlesource.com/gn/+/master/docs/quick_start.md) before
+building.
 ***
 
 Then, create a directory where the crash dumps will be stored:

diff --git a/docs/windows_build_instructions.md b/docs/windows_build_instructions.md
index b6cf310..dbf874fb 100644
--- a/docs/windows_build_instructions.md
+++ b/docs/windows_build_instructions.md

@@ -138,10 +138,10 @@
 
 ## Setting up the build
 
-Chromium uses [Ninja](https://ninja-build.org) as its main build tool along
-with a tool called [GN](../tools/gn/docs/quick_start.md) to generate `.ninja`
-files. You can create any number of *build directories* with different
-configurations. To create a build directory:
+Chromium uses [Ninja](https://ninja-build.org) as its main build tool along with
+a tool called [GN](https://gn.googlesource.com/gn/+/master/docs/quick_start.md)
+to generate `.ninja` files. You can create any number of *build directories*
+with different configurations. To create a build directory:
 
 ```shell
 $ gn gen out/Default
@@ -155,8 +155,8 @@
   configuration](https://www.chromium.org/developers/gn-build-configuration).
   The default will be a debug component build matching the current host
   operating system and CPU.
-* For more info on GN, run `gn help` on the command line or read the
-  [quick start guide](../tools/gn/docs/quick_start.md).
+* For more info on GN, run `gn help` on the command line or read the [quick
+  start guide](https://gn.googlesource.com/gn/+/master/docs/quick_start.md).
 
 ### Using the Visual Studio IDE
 

diff --git a/extensions/browser/api/dns/dns_api.cc b/extensions/browser/api/dns/dns_api.cc
index ea444b7..8fc6557e 100644
--- a/extensions/browser/api/dns/dns_api.cc
+++ b/extensions/browser/api/dns/dns_api.cc

@@ -13,6 +13,9 @@
 #include "extensions/common/api/dns.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
+#include "net/log/net_log_with_source.h"
+#include "net/url_request/url_request_context.h"
+#include "net/url_request/url_request_context_getter.h"
 
 using content::BrowserThread;
 using extensions::api::dns::ResolveCallbackResolveInfo;
@@ -21,51 +24,79 @@
 
 namespace extensions {
 
-DnsResolveFunction::DnsResolveFunction() : binding_(this) {}
+DnsResolveFunction::DnsResolveFunction()
+    : response_(false), addresses_(new net::AddressList) {}
 
 DnsResolveFunction::~DnsResolveFunction() {}
 
 ExtensionFunction::ResponseAction DnsResolveFunction::Run() {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   std::unique_ptr<Resolve::Params> params(Resolve::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params.get());
 
-  network::mojom::ResolveHostClientPtr client_ptr;
-  binding_.Bind(mojo::MakeRequest(&client_ptr));
-  binding_.set_connection_error_handler(
-      base::BindOnce(&DnsResolveFunction::OnComplete, base::Unretained(this),
-                     net::ERR_FAILED, base::nullopt));
+  hostname_ = params->hostname;
+  url_request_context_getter_ =
+      content::BrowserContext::GetDefaultStoragePartition(browser_context())
+          ->GetURLRequestContext();
+
+  bool result = BrowserThread::PostTask(
+      BrowserThread::IO,
+      FROM_HERE,
+      base::Bind(&DnsResolveFunction::WorkOnIOThread, this));
+  DCHECK(result);
+  return RespondLater();
+}
+
+void DnsResolveFunction::WorkOnIOThread() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  net::HostResolver* host_resolver =
+      HostResolverWrapper::GetInstance()->GetHostResolver(
+          url_request_context_getter_.get());
+  DCHECK(host_resolver);
+
   // Yes, we are passing zero as the port. There are some interesting but not
   // presently relevant reasons why HostResolver asks for the port of the
   // hostname you'd like to resolve, even though it doesn't use that value in
   // determining its answer.
-  net::HostPortPair host_port_pair(params->hostname, 0);
-  content::BrowserContext::GetDefaultStoragePartition(browser_context())
-      ->GetNetworkContext()
-      ->ResolveHost(host_port_pair, nullptr, std::move(client_ptr));
+  net::HostPortPair host_port_pair(hostname_, 0);
 
-  // Balanced in OnComplete().
+  net::HostResolver::RequestInfo request_info(host_port_pair);
+  int resolve_result = host_resolver->Resolve(
+      request_info, net::DEFAULT_PRIORITY, addresses_.get(),
+      base::Bind(&DnsResolveFunction::OnLookupFinished, this), &request_,
+      net::NetLogWithSource());
+
+  // Balanced in OnLookupFinished.
   AddRef();
-  return RespondLater();
+
+  if (resolve_result != net::ERR_IO_PENDING)
+    OnLookupFinished(resolve_result);
 }
 
-void DnsResolveFunction::OnComplete(
-    int result,
-    const base::Optional<net::AddressList>& resolved_addresses) {
+void DnsResolveFunction::RespondOnUIThread(
+    std::unique_ptr<base::ListValue> results) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  binding_.Close();
+  Respond(response_ ? ArgumentList(std::move(results))
+                    : Error(kUnknownErrorDoNotUse));
+}
 
-  ResolveCallbackResolveInfo resolve_info;
-  resolve_info.result_code = result;
-  if (result == net::OK) {
-    DCHECK(resolved_addresses.has_value() && !resolved_addresses->empty());
-    resolve_info.address = std::make_unique<std::string>(
-        resolved_addresses->front().ToStringWithoutPort());
+void DnsResolveFunction::OnLookupFinished(int resolve_result) {
+  auto resolve_info = std::make_unique<ResolveCallbackResolveInfo>();
+  resolve_info->result_code = resolve_result;
+  if (resolve_result == net::OK) {
+    DCHECK(!addresses_->empty());
+    resolve_info->address.reset(
+        new std::string(addresses_->front().ToStringWithoutPort()));
   }
+  response_ = true;
 
-  Respond(ArgumentList(Resolve::Results::Create(resolve_info)));
+  bool post_task_result = BrowserThread::PostTask(
+      BrowserThread::UI, FROM_HERE,
+      base::BindOnce(&DnsResolveFunction::RespondOnUIThread, this,
+                     Resolve::Results::Create(*resolve_info)));
+  DCHECK(post_task_result);
 
-  Release();  // Added in Run().
+  Release();  // Added in WorkOnIOThread().
 }
 
 }  // namespace extensions

diff --git a/extensions/browser/api/dns/dns_api.h b/extensions/browser/api/dns/dns_api.h
index 72c26740..e301fd2 100644
--- a/extensions/browser/api/dns/dns_api.h
+++ b/extensions/browser/api/dns/dns_api.h

@@ -8,16 +8,17 @@
 #include <string>
 
 #include "extensions/browser/extension_function.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "net/base/address_list.h"
 #include "net/base/completion_callback.h"
 #include "net/dns/host_resolver.h"
-#include "services/network/public/mojom/network_context.mojom.h"
+
+namespace net {
+class URLRequestContextGetter;
+}
 
 namespace extensions {
 
-class DnsResolveFunction : public UIThreadExtensionFunction,
-                           public network::mojom::ResolveHostClient {
+class DnsResolveFunction : public UIThreadExtensionFunction {
  public:
   DECLARE_EXTENSION_FUNCTION("dns.resolve", DNS_RESOLVE)
 
@@ -30,14 +31,19 @@
   ResponseAction Run() override;
 
  private:
-  // network::mojom::ResolveHostClient implementation:
-  void OnComplete(
-      int result,
-      const base::Optional<net::AddressList>& resolved_addresses) override;
+  void WorkOnIOThread();
+  void RespondOnUIThread(std::unique_ptr<base::ListValue> results);
 
-  // A reference to |this| must be taken while the request is being made on this
-  // binding so the object is alive when the request completes.
-  mojo::Binding<network::mojom::ResolveHostClient> binding_;
+  void OnLookupFinished(int result);
+
+  std::string hostname_;
+
+  scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_;
+
+  bool response_;  // The value sent in SendResponse().
+
+  std::unique_ptr<net::HostResolver::Request> request_;
+  std::unique_ptr<net::AddressList> addresses_;
 };
 
 }  // namespace extensions

diff --git a/extensions/browser/api/dns/dns_apitest.cc b/extensions/browser/api/dns/dns_apitest.cc
index 689a12bd..2080808b 100644
--- a/extensions/browser/api/dns/dns_apitest.cc
+++ b/extensions/browser/api/dns/dns_apitest.cc

@@ -9,29 +9,40 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/test/test_utils.h"
 #include "extensions/browser/api/dns/dns_api.h"
+#include "extensions/browser/api/dns/host_resolver_wrapper.h"
+#include "extensions/browser/api/dns/mock_host_resolver_creator.h"
 #include "extensions/browser/api_test_utils.h"
 #include "extensions/browser/notification_types.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_builder.h"
 #include "extensions/shell/test/shell_apitest.h"
 #include "net/base/net_errors.h"
-#include "net/dns/mock_host_resolver.h"
 
-namespace extensions {
-namespace {
 using extensions::api_test_utils::RunFunctionAndReturnSingleResult;
 
-constexpr char kHostname[] = "www.sowbug.com";
-constexpr char kAddress[] = "9.8.7.6";
-}  // namespace
+namespace extensions {
 
 class DnsApiTest : public ShellApiTest {
+ public:
+  DnsApiTest() : resolver_creator_(new MockHostResolverCreator()) {}
+
  private:
   void SetUpOnMainThread() override {
     ShellApiTest::SetUpOnMainThread();
-    host_resolver()->AddRule(kHostname, kAddress);
-    host_resolver()->AddSimulatedFailure("this.hostname.is.bogus");
+    HostResolverWrapper::GetInstance()->SetHostResolverForTesting(
+        resolver_creator_->CreateMockHostResolver());
   }
+
+  void TearDownOnMainThread() override {
+    HostResolverWrapper::GetInstance()->SetHostResolverForTesting(NULL);
+    resolver_creator_->DeleteMockHostResolver();
+    ShellApiTest::TearDownOnMainThread();
+  }
+
+  // The MockHostResolver asserts that it's used on the same thread on which
+  // it's created, which is actually a stronger rule than its real counterpart.
+  // But that's fine; it's good practice.
+  scoped_refptr<MockHostResolverCreator> resolver_creator_;
 };
 
 IN_PROC_BROWSER_TEST_F(DnsApiTest, DnsResolveIPLiteral) {
@@ -63,7 +74,7 @@
   resolve_function->set_has_callback(true);
 
   std::string function_arguments("[\"");
-  function_arguments += kHostname;
+  function_arguments += MockHostResolverCreator::kHostname;
   function_arguments += "\"]";
   std::unique_ptr<base::Value> result(RunFunctionAndReturnSingleResult(
       resolve_function.get(), function_arguments, browser_context()));
@@ -76,7 +87,7 @@
 
   std::string address;
   EXPECT_TRUE(dict->GetString("address", &address));
-  EXPECT_EQ(kAddress, address);
+  EXPECT_EQ(MockHostResolverCreator::kAddress, address);
 }
 
 IN_PROC_BROWSER_TEST_F(DnsApiTest, DnsExtension) {

diff --git a/extensions/browser/updater/update_data_provider.cc b/extensions/browser/updater/update_data_provider.cc
index 98041471..3115bcb 100644
--- a/extensions/browser/updater/update_data_provider.cc
+++ b/extensions/browser/updater/update_data_provider.cc

@@ -72,24 +72,25 @@
   browser_context_ = nullptr;
 }
 
-std::vector<std::unique_ptr<update_client::CrxComponent>>
+std::vector<base::Optional<update_client::CrxComponent>>
 UpdateDataProvider::GetData(bool install_immediately,
                             const ExtensionUpdateDataMap& update_crx_component,
                             const std::vector<std::string>& ids) {
-  std::vector<std::unique_ptr<update_client::CrxComponent>> data;
+  std::vector<base::Optional<update_client::CrxComponent>> data;
   if (!browser_context_)
     return data;
   const ExtensionRegistry* registry = ExtensionRegistry::Get(browser_context_);
   const ExtensionPrefs* extension_prefs = ExtensionPrefs::Get(browser_context_);
   for (const auto& id : ids) {
     const Extension* extension = registry->GetInstalledExtension(id);
-    data.push_back(extension ? std::make_unique<update_client::CrxComponent>()
-                             : nullptr);
+    data.push_back(extension
+                       ? base::make_optional<update_client::CrxComponent>()
+                       : base::nullopt);
     if (!extension)
       continue;
     DCHECK_NE(0u, update_crx_component.count(id));
     const ExtensionUpdateData& extension_data = update_crx_component.at(id);
-    update_client::CrxComponent* crx_component = data.back().get();
+    auto& crx_component = data.back();
     std::string pubkey_bytes;
     base::Base64Decode(extension->public_key(), &pubkey_bytes);
     crx_component->pk_hash.resize(crypto::kSHA256Length, 0);

diff --git a/extensions/browser/updater/update_data_provider.h b/extensions/browser/updater/update_data_provider.h
index 78a2268..511dad7d 100644
--- a/extensions/browser/updater/update_data_provider.h
+++ b/extensions/browser/updater/update_data_provider.h

@@ -13,6 +13,7 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/optional.h"
 #include "extensions/browser/updater/extension_installer.h"
 #include "extensions/browser/updater/extension_update_data.h"
 
@@ -47,7 +48,7 @@
   // done.
   void Shutdown();
 
-  std::vector<std::unique_ptr<update_client::CrxComponent>> GetData(
+  std::vector<base::Optional<update_client::CrxComponent>> GetData(
       bool install_immediately,
       const ExtensionUpdateDataMap& update_info,
       const std::vector<std::string>& ids);

diff --git a/extensions/browser/updater/update_data_provider_unittest.cc b/extensions/browser/updater/update_data_provider_unittest.cc
index cf7c834..e08a1c87 100644
--- a/extensions/browser/updater/update_data_provider_unittest.cc
+++ b/extensions/browser/updater/update_data_provider_unittest.cc

@@ -14,6 +14,7 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
+#include "base/optional.h"
 #include "base/run_loop.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/update_client/update_client.h"
@@ -383,13 +384,13 @@
                              {kExtensionId1, kExtensionId2});
 
   ASSERT_EQ(2UL, data.size());
-  ASSERT_NE(nullptr, data[0]);
+  ASSERT_NE(base::nullopt, data[0]);
   EXPECT_EQ(version, data[0]->version.GetString());
   EXPECT_NE(nullptr, data[0]->installer.get());
   EXPECT_EQ(0UL, data[0]->disabled_reasons.size());
   EXPECT_EQ("other", data[0]->install_location);
 
-  EXPECT_EQ(nullptr, data[1]);
+  EXPECT_EQ(base::nullopt, data[1]);
 }
 
 TEST_F(UpdateDataProviderTest, GetData_MultipleExtensions_CorruptExtension) {

diff --git a/extensions/browser/updater/update_service_unittest.cc b/extensions/browser/updater/update_service_unittest.cc
index 14a2485..6a174ec 100644
--- a/extensions/browser/updater/update_service_unittest.cc
+++ b/extensions/browser/updater/update_service_unittest.cc

@@ -10,6 +10,7 @@
 
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
+#include "base/optional.h"
 #include "base/run_loop.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
@@ -49,7 +50,7 @@
 
   // Returns the data we've gotten from the CrxDataCallback for ids passed to
   // the Update function.
-  std::vector<std::unique_ptr<update_client::CrxComponent>>* data() {
+  std::vector<base::Optional<update_client::CrxComponent>>* data() {
     return &data_;
   }
 
@@ -123,7 +124,7 @@
   friend class base::RefCounted<FakeUpdateClient>;
   ~FakeUpdateClient() override {}
 
-  std::vector<std::unique_ptr<update_client::CrxComponent>> data_;
+  std::vector<base::Optional<update_client::CrxComponent>> data_;
   std::vector<UninstallPing> uninstall_pings_;
   std::vector<Observer*> observers_;
 

diff --git a/infra/config/global/cr-buildbucket.cfg b/infra/config/global/cr-buildbucket.cfg
index dde7505..fb6726a 100644
--- a/infra/config/global/cr-buildbucket.cfg
+++ b/infra/config/global/cr-buildbucket.cfg

@@ -538,13 +538,6 @@
   }
 }
 
-builder_mixins {
-  name: "gn_upload"
-  recipe {
-    name: "chromium_gn_upload"
-  }
-}
-
 buckets {
   name: "luci.chromium.ci"
   acl_sets: "ci"
@@ -2568,11 +2561,6 @@
     builders { mixins: "linux-try" name: "linux_chromium_compile_rel_ng" }
     builders { mixins: "linux-try" name: "linux_chromium_dbg_32_ng" }
     builders { mixins: "linux-try" name: "linux_chromium_dbg_ng" }
-    builders {
-      mixins: "linux-try"
-      mixins: "gn_upload"
-      name: "linux_chromium_gn_upload"
-    }
     builders { mixins: "linux-try" name: "linux_chromium_headless_rel" }
     builders { mixins: "linux-try" name: "linux_chromium_msan_rel_ng" }
     builders { mixins: "linux-try" name: "linux_chromium_msan_variable" }
@@ -2659,7 +2647,6 @@
     }
     builders { mixins: "mac-try" name: "mac_chromium_compile_rel_ng" }
     builders { mixins: "mac-try" name: "mac_chromium_dbg_ng" dimensions:"os:Mac-10.12"}
-    builders { mixins: "mac-try" mixins: "gn_upload" name: "mac_chromium_gn_upload" }
     builders {
       mixins: "mac-try"
       mixins: "goma-j150"
@@ -2698,7 +2685,6 @@
       name: "win10_chromium_x64_rel_ng"
     }
     builders { mixins: "win-try" name: "win10_chromium_x64_rel_ng_exp" }
-    builders { mixins: "win-try" mixins: "gn_upload" name: "win8_chromium_gn_upload" }
     builders {
       mixins: "win-try"
       mixins: "goma-j150"
@@ -2822,12 +2808,6 @@
       mixins: "android-try"
     }
     builders {
-      name: "win_chromium_gn_upload"
-      dimensions: "os:Windows-10"
-      mixins: "win-try"
-      mixins: "gn_upload"
-    }
-    builders {
       name: "android_chromium_variable_cast_shell"
       dimensions: "os:Ubuntu-14.04"
       mixins: "android-try"

diff --git a/infra/config/global/luci-milo.cfg b/infra/config/global/luci-milo.cfg
index 135b1363..9283091 100644
--- a/infra/config/global/luci-milo.cfg
+++ b/infra/config/global/luci-milo.cfg

@@ -4019,10 +4019,6 @@
     name: "buildbucket/luci.chromium.try/linux_chromium_dbg_32_ng"
   }
   builders {
-    name: "buildbot/tryserver.chromium.linux/linux_chromium_gn_upload"
-    name: "buildbucket/luci.chromium.try/linux_chromium_gn_upload"
-  }
-  builders {
     name: "buildbucket/luci.chromium.try/linux_chromium_headless_rel"
   }
   builders {
@@ -4141,9 +4137,6 @@
     name: "buildbot/tryserver.chromium.mac/mac_chromium_dbg_ng"
   }
   builders {
-    name: "buildbot/tryserver.chromium.mac/mac_chromium_gn_upload"
-  }
-  builders {
     name: "buildbot/tryserver.chromium.mac/mac_chromium_rel_ng"
   }
   builders {
@@ -4278,9 +4271,6 @@
     name: "buildbot/tryserver.chromium.win/win_chromium_dbg_ng"
   }
   builders {
-    name: "buildbot/tryserver.chromium.win/win_chromium_gn_upload"
-  }
-  builders {
     name: "buildbot/tryserver.chromium.win/win_chromium_variable"
   }
   builders {
@@ -4659,9 +4649,6 @@
     name: "buildbucket/luci.chromium.try/linux_chromium_dbg_ng"
   }
   builders {
-    name: "buildbucket/luci.chromium.try/linux_chromium_gn_upload"
-  }
-  builders {
     name: "buildbucket/luci.chromium.try/linux_chromium_headless_rel"
   }
   builders {
@@ -4800,9 +4787,6 @@
     name: "buildbucket/luci.chromium.try/mac_chromium_dbg_ng"
   }
   builders {
-    name: "buildbucket/luci.chromium.try/mac_chromium_gn_upload"
-  }
-  builders {
     name: "buildbucket/luci.chromium.try/mac_chromium_rel_ng"
   }
   builders {
@@ -4857,9 +4841,6 @@
     name: "buildbucket/luci.chromium.try/win10_chromium_x64_rel_ng_exp"
   }
   builders {
-    name: "buildbucket/luci.chromium.try/win8_chromium_gn_upload"
-  }
-  builders {
     name: "buildbucket/luci.chromium.try/win7_chromium_rel_ng"
   }
   builders {

diff --git a/ios/chrome/browser/voice/BUILD.gn b/ios/chrome/browser/voice/BUILD.gn
index 22d37de..959c1c2 100644
--- a/ios/chrome/browser/voice/BUILD.gn
+++ b/ios/chrome/browser/voice/BUILD.gn

@@ -79,6 +79,7 @@
     ":tts",
     ":voice",
     "//base",
+    "//base/test:test_support",
     "//ios/web",
     "//ios/web/public/test",
     "//testing/gtest",

diff --git a/ios/chrome/browser/voice/voice_search_navigations_tab_helper_unittest.mm b/ios/chrome/browser/voice/voice_search_navigations_tab_helper_unittest.mm
index 1e4c058..82a0444 100644
--- a/ios/chrome/browser/voice/voice_search_navigations_tab_helper_unittest.mm
+++ b/ios/chrome/browser/voice/voice_search_navigations_tab_helper_unittest.mm

@@ -4,6 +4,8 @@
 
 #import "ios/chrome/browser/voice/voice_search_navigations_tab_helper.h"
 
+#include "base/test/scoped_feature_list.h"
+#include "ios/web/public/features.h"
 #import "ios/web/public/navigation_item.h"
 #import "ios/web/public/navigation_manager.h"
 #import "ios/web/public/test/web_test_with_web_state.h"
@@ -15,10 +17,26 @@
 #error "This file requires ARC support."
 #endif
 
+// VoiceSearchNavigationsTest is parameterized on this enum to test both
+// LegacyNavigationManager and WKBasedNavigationManager.
+enum class NavigationManagerChoice {
+  LEGACY,
+  WK_BASED,
+};
+
 // Test fixture for VoiceSearchNavigations.
-class VoiceSearchNavigationsTest : public web::WebTestWithWebState {
+class VoiceSearchNavigationsTest
+    : public web::WebTestWithWebState,
+      public ::testing::WithParamInterface<NavigationManagerChoice> {
  public:
   void SetUp() override {
+    if (GetParam() == NavigationManagerChoice::LEGACY) {
+      scoped_feature_list_.InitAndDisableFeature(
+          web::features::kSlimNavigationManager);
+    } else {
+      scoped_feature_list_.InitAndEnableFeature(
+          web::features::kSlimNavigationManager);
+    }
     web::WebTestWithWebState::SetUp();
     VoiceSearchNavigationTabHelper::CreateForWebState(web_state());
   }
@@ -26,11 +44,14 @@
   VoiceSearchNavigationTabHelper* navigations() {
     return VoiceSearchNavigationTabHelper::FromWebState(web_state());
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 // Tests that a NavigationItem is not marked as a voice search if
 // WillLoadVoiceSearchResult() was not called.
-TEST_F(VoiceSearchNavigationsTest, NotVoiceSearchNavigation) {
+TEST_P(VoiceSearchNavigationsTest, NotVoiceSearchNavigation) {
   LoadHtml(@"<html></html>");
   web::NavigationItem* item =
       web_state()->GetNavigationManager()->GetLastCommittedItem();
@@ -39,7 +60,7 @@
 
 // Tests that a pending NavigationItem is recorded as a voice search navigation
 // if it is added after calling WillLoadVoiceSearchResult().
-TEST_F(VoiceSearchNavigationsTest, PendingVoiceSearchNavigation) {
+TEST_P(VoiceSearchNavigationsTest, PendingVoiceSearchNavigation) {
   navigations()->WillLoadVoiceSearchResult();
   const GURL kPendingUrl("http://pending.test");
   AddPendingItem(kPendingUrl, ui::PAGE_TRANSITION_LINK);
@@ -50,7 +71,7 @@
 
 // Tests that a committed NavigationItem is recordored as a voice search
 // navigation if it occurs after calling WillLoadVoiceSearchResult().
-TEST_F(VoiceSearchNavigationsTest, CommittedVoiceSearchNavigation) {
+TEST_P(VoiceSearchNavigationsTest, CommittedVoiceSearchNavigation) {
   navigations()->WillLoadVoiceSearchResult();
   LoadHtml(@"<html></html>");
   web::NavigationItem* item =
@@ -60,7 +81,7 @@
 
 // Tests that navigations that occur after a voice search navigation are not
 // marked as voice search navigations.
-TEST_F(VoiceSearchNavigationsTest, NavigationAfterVoiceSearch) {
+TEST_P(VoiceSearchNavigationsTest, NavigationAfterVoiceSearch) {
   navigations()->WillLoadVoiceSearchResult();
   const GURL kVoiceSearchUrl("http://voice.test");
   LoadHtml(@"<html></html>", kVoiceSearchUrl);
@@ -75,7 +96,7 @@
 }
 
 // Tests that transient NavigationItems are handled the same as pending items
-TEST_F(VoiceSearchNavigationsTest, TransientNavigations) {
+TEST_P(VoiceSearchNavigationsTest, TransientNavigations) {
   LoadHtml(@"<html></html>", GURL("http://committed_url.test"));
   const GURL kTransientURL("http://transient.test");
   AddTransientItem(kTransientURL);
@@ -85,3 +106,8 @@
   navigations()->WillLoadVoiceSearchResult();
   EXPECT_TRUE(navigations()->IsNavigationFromVoiceSearch(item));
 }
+
+INSTANTIATE_TEST_CASE_P(ProgrammaticVoiceSearchNavigationsTest,
+                        VoiceSearchNavigationsTest,
+                        ::testing::Values(NavigationManagerChoice::LEGACY,
+                                          NavigationManagerChoice::WK_BASED));

diff --git a/ios/web/navigation/error_retry_state_machine.h b/ios/web/navigation/error_retry_state_machine.h
index 1dbfcd3d..79a25223 100644
--- a/ios/web/navigation/error_retry_state_machine.h
+++ b/ios/web/navigation/error_retry_state_machine.h

@@ -33,6 +33,9 @@
   kNewRequest,
   // This navigation item loaded without error.
   kNoNavigationError,
+  // This navigation item failed to load and is in the process of loading a
+  // placeholder.
+  kLoadingPlaceholder,
   // This navigation item has an entry in WKBackForwardList. Ready to present
   // error in native view.
   kReadyToDisplayErrorForFailedNavigation,

diff --git a/ios/web/navigation/error_retry_state_machine.mm b/ios/web/navigation/error_retry_state_machine.mm
index 5f2ee60f..8b7d6d3 100644
--- a/ios/web/navigation/error_retry_state_machine.mm
+++ b/ios/web/navigation/error_retry_state_machine.mm

@@ -58,6 +58,7 @@
         return ErrorRetryCommand::kLoadErrorView;
       }
       // Provisional navigation failed on a new item.
+      state_ = ErrorRetryState::kLoadingPlaceholder;
       return ErrorRetryCommand::kLoadPlaceholder;
 
     // Reload of a previously successful load fails.
@@ -71,6 +72,7 @@
     case ErrorRetryState::kDisplayingWebErrorForFailedNavigation:
       return BackForwardOrReloadFailed(web_view_url, error_url);
 
+    case ErrorRetryState::kLoadingPlaceholder:
     case ErrorRetryState::kReadyToDisplayErrorForFailedNavigation:
     case ErrorRetryState::kNavigatingToFailedNavigationItem:
       NOTREACHED() << "Unexpected error retry state: "
@@ -96,6 +98,7 @@
     case ErrorRetryState::kDisplayingWebErrorForFailedNavigation:
       return BackForwardOrReloadFailed(web_view_url, error_url);
 
+    case ErrorRetryState::kLoadingPlaceholder:
     case ErrorRetryState::kReadyToDisplayErrorForFailedNavigation:
     case ErrorRetryState::kNavigatingToFailedNavigationItem:
       NOTREACHED() << "Unexpected error retry state: "
@@ -107,21 +110,20 @@
 ErrorRetryCommand ErrorRetryStateMachine::DidFinishNavigation(
     const GURL& web_view_url) {
   switch (state_) {
-    case ErrorRetryState::kNewRequest:
+    case ErrorRetryState::kLoadingPlaceholder:
       // (1) Placeholder load for initial failure succeeded.
-      if (!web::GetWebClient()->IsAppSpecificURL(url_) &&
-          web_view_url ==
-              wk_navigation_util::CreatePlaceholderUrlForUrl(url_)) {
-        state_ = ErrorRetryState::kReadyToDisplayErrorForFailedNavigation;
-        return ErrorRetryCommand::kLoadErrorView;
-      }
+      DCHECK(!web::GetWebClient()->IsAppSpecificURL(url_));
+      DCHECK_EQ(web_view_url,
+                wk_navigation_util::CreatePlaceholderUrlForUrl(url_));
+      state_ = ErrorRetryState::kReadyToDisplayErrorForFailedNavigation;
+      return ErrorRetryCommand::kLoadErrorView;
+
+    case ErrorRetryState::kNewRequest:
       if (wk_navigation_util::IsRestoreSessionUrl(web_view_url)) {
         // (8) Initial load of restore_session.html. Don't change state or
         // issue command. Wait for the client-side redirect.
       } else {
         // (2) Initial load succeeded.
-        DCHECK(web::GetWebClient()->IsAppSpecificURL(url_) ||
-               web_view_url == url_);
         state_ = ErrorRetryState::kNoNavigationError;
       }
       break;

diff --git a/ios/web/navigation/error_retry_state_machine_unittest.mm b/ios/web/navigation/error_retry_state_machine_unittest.mm
index 15f7f68..ab698ac 100644
--- a/ios/web/navigation/error_retry_state_machine_unittest.mm
+++ b/ios/web/navigation/error_retry_state_machine_unittest.mm

@@ -33,7 +33,7 @@
   // Initial load fails.
   ASSERT_EQ(ErrorRetryCommand::kLoadPlaceholder,
             machine.DidFailProvisionalNavigation(GURL::EmptyGURL(), test_url));
-  ASSERT_EQ(ErrorRetryState::kNewRequest, machine.state());
+  ASSERT_EQ(ErrorRetryState::kLoadingPlaceholder, machine.state());
 
   // Placeholder load finishes.
   ASSERT_EQ(ErrorRetryCommand::kLoadErrorView,
@@ -96,7 +96,7 @@
   // Initial load fails.
   ASSERT_EQ(ErrorRetryCommand::kLoadPlaceholder,
             machine.DidFailProvisionalNavigation(GURL::EmptyGURL(), test_url));
-  ASSERT_EQ(ErrorRetryState::kNewRequest, machine.state());
+  ASSERT_EQ(ErrorRetryState::kLoadingPlaceholder, machine.state());
 
   // Placeholder load finishes.
   ASSERT_EQ(ErrorRetryCommand::kLoadErrorView,

diff --git a/ios/web/public/test/web_test_with_web_state.mm b/ios/web/public/test/web_test_with_web_state.mm
index 188ee41..29047a8 100644
--- a/ios/web/public/test/web_test_with_web_state.mm
+++ b/ios/web/public/test/web_test_with_web_state.mm

@@ -10,6 +10,7 @@
 #include "base/strings/sys_string_conversions.h"
 #import "base/test/ios/wait_util.h"
 #import "ios/web/navigation/navigation_manager_impl.h"
+#import "ios/web/navigation/wk_navigation_util.h"
 #import "ios/web/public/web_client.h"
 #include "ios/web/public/web_state/url_verification_constants.h"
 #include "ios/web/public/web_state/web_state_observer.h"
@@ -103,15 +104,15 @@
   CRWWebController* web_controller = GetWebController(web_state());
   ASSERT_EQ(PAGE_LOADED, web_controller.loadPhase);
 
-  // If the underlying WKWebView is empty, first load a placeholder about:blank
-  // to create a WKBackForwardListItem to store the NavigationItem associated
-  // with the |-loadHTML|.
+  // If the underlying WKWebView is empty, first load a placeholder to create a
+  // WKBackForwardListItem to store the NavigationItem associated with the
+  // |-loadHTML|.
   // TODO(crbug.com/777884): consider changing |-loadHTML| to match WKWebView's
   // |-loadHTMLString:baseURL| that doesn't create a navigation entry.
   if (web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
       !web_state()->GetNavigationManager()->GetItemCount()) {
-    GURL url(url::kAboutBlankURL);
-    NavigationManager::WebLoadParams params(url);
+    GURL placeholder_url = wk_navigation_util::CreatePlaceholderUrlForUrl(url);
+    NavigationManager::WebLoadParams params(placeholder_url);
     web_state()->GetNavigationManager()->LoadURLWithParams(params);
     base::test::ios::WaitUntilCondition(^{
       return web_controller.loadPhase == PAGE_LOADED;

diff --git a/ios/web/web_state/ui/crw_web_controller_unittest.mm b/ios/web/web_state/ui/crw_web_controller_unittest.mm
index 861a3e9..7713efa 100644
--- a/ios/web/web_state/ui/crw_web_controller_unittest.mm
+++ b/ios/web/web_state/ui/crw_web_controller_unittest.mm

@@ -1085,18 +1085,11 @@
   scoped_observer.Add(web_state());
   ASSERT_EQ(0, observer.title_change_count());
 
-  int initial_title_change_count = 0;
-  if (web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
-    // WKBasedNavigationManager produces an extra call to TitleWasSet because it
-    // loads New Tab Page in web view.
-    initial_title_change_count += 1;
-  }
-
   // Expect TitleWasSet callback after the page is loaded and due to WKWebView
   // title change KVO.
   LoadHtml(@"<title>Title1</title>");
   EXPECT_EQ("Title1", base::UTF16ToUTF8(web_state()->GetTitle()));
-  EXPECT_EQ(initial_title_change_count + 2, observer.title_change_count());
+  EXPECT_EQ(2, observer.title_change_count());
 
   // Expect at least one more TitleWasSet callback after changing title via
   // JavaScript. On iOS 10 WKWebView fires 3 callbacks after JS excucution
@@ -1105,7 +1098,7 @@
   // Fix expecteation when WKWebView stops sending extra KVO calls.
   ExecuteJavaScript(@"window.document.title = 'Title2';");
   EXPECT_EQ("Title2", base::UTF16ToUTF8(web_state()->GetTitle()));
-  EXPECT_GE(observer.title_change_count(), initial_title_change_count + 3);
+  EXPECT_GE(observer.title_change_count(), 3);
 };
 
 // Tests that fragment change navigations use title from the previous page.

diff --git a/ios/web/web_state/web_state_impl.mm b/ios/web/web_state/web_state_impl.mm
index c7c60a5..34c5dfe0 100644
--- a/ios/web/web_state/web_state_impl.mm
+++ b/ios/web/web_state/web_state_impl.mm

@@ -25,6 +25,7 @@
 #import "ios/web/public/crw_session_storage.h"
 #include "ios/web/public/favicon_url.h"
 #import "ios/web/public/java_script_dialog_presenter.h"
+#include "ios/web/public/load_committed_details.h"
 #import "ios/web/public/navigation_item.h"
 #include "ios/web/public/url_util.h"
 #import "ios/web/public/web_client.h"
@@ -852,6 +853,9 @@
 
 void WebStateImpl::OnNavigationItemCommitted(
     const LoadCommittedDetails& load_details) {
+  if (wk_navigation_util::IsWKInternalUrl(load_details.item->GetURL()))
+    return;
+
   // A committed navigation item indicates that NavigationManager has a new
   // valid session history so should invalidate the cached restored session
   // history.

diff --git a/ios/web/web_state/web_state_impl_unittest.mm b/ios/web/web_state/web_state_impl_unittest.mm
index d6acbd7..7d97e74 100644
--- a/ios/web/web_state/web_state_impl_unittest.mm
+++ b/ios/web/web_state/web_state_impl_unittest.mm

@@ -17,6 +17,7 @@
 #import "base/test/ios/wait_util.h"
 #include "base/test/scoped_feature_list.h"
 #import "ios/web/interstitials/html_web_interstitial_impl.h"
+#import "ios/web/navigation/navigation_item_impl.h"
 #import "ios/web/navigation/wk_navigation_util.h"
 #import "ios/web/public/crw_navigation_item_storage.h"
 #import "ios/web/public/crw_session_storage.h"
@@ -464,6 +465,8 @@
   // Test that NavigationItemCommitted() is called.
   ASSERT_FALSE(observer->commit_navigation_info());
   LoadCommittedDetails details;
+  auto item = std::make_unique<NavigationItemImpl>();
+  details.item = item.get();
   web_state_->OnNavigationItemCommitted(details);
   ASSERT_TRUE(observer->commit_navigation_info());
   EXPECT_EQ(web_state_.get(), observer->commit_navigation_info()->web_state);
@@ -656,6 +659,8 @@
   // Test that NavigationItemCommitted() is called.
   EXPECT_FALSE(observer->navigation_item_committed_called());
   LoadCommittedDetails details;
+  auto item = std::make_unique<NavigationItemImpl>();
+  details.item = item.get();
   web_state_->OnNavigationItemCommitted(details);
   EXPECT_TRUE(observer->navigation_item_committed_called());
 

diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
index 32c3a86..a8ce80032 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc

@@ -2467,52 +2467,10 @@
   return true;
 }
 
-// TODO(crbug.com/819930): Remove after https://crrev.com/c/1134929 and
-// https://crrev.com/c/1136336 are merged.
-//
-// This is a hack making Chrome work before/after merging
-// https://crrev.com/c/1136336 (for v3.14) and
-// https://crrev.com/c/1134929 (for v4.4), which changes IDs of controls from
-// V4L2_CID_MPEG_VIDEO_VP8_FRAME_HDR to V4L2_CID_MPEG_VIDEO_VP9_ENTROPY.
-void V4L2SliceVideoDecodeAccelerator::ReplaceChromeMpegVideoCtrlId(
-    uint32_t* ctrl_id) {
-  static_assert(
-      V4L2_CID_MPEG_VIDEO_VP9_ENTROPY - V4L2_CID_MPEG_VIDEO_VP8_FRAME_HDR == 3,
-      "The difference between V4L2_CID_MPEG_VIDEO_VP9_ENTROPY and "
-      "V4L2_CID_MPEG_VIDEO_VP8_FRAME_HDR must be 3");
-  if (*ctrl_id < V4L2_CID_MPEG_VIDEO_VP8_FRAME_HDR ||
-      *ctrl_id > V4L2_CID_MPEG_VIDEO_VP9_ENTROPY)
-    return;
-
-  // Prepare flags for each control since these controls are optional
-  // -1: uninitialized, 0: old kernel or unsupported control, 1: new kernel
-  static int flags[4] = {-1, -1, -1, -1};
-  const size_t offset = *ctrl_id - V4L2_CID_MPEG_VIDEO_VP8_FRAME_HDR;
-
-  if (flags[offset] < 0) {
-    struct v4l2_queryctrl query_ctrl = {};
-    query_ctrl.id = *ctrl_id;
-
-    flags[offset] = device_->Ioctl(VIDIOC_QUERYCTRL, &query_ctrl) == 0;
-  }
-
-  if (!flags[offset]) {
-    static uint32_t kOldBase = V4L2_CID_MPEG_BASE + 512;
-    *ctrl_id = kOldBase + offset;
-  }
-}
-
 bool V4L2SliceVideoDecodeAccelerator::SubmitExtControls(
     struct v4l2_ext_controls* ext_ctrls) {
   DCHECK(decoder_thread_task_runner_->BelongsToCurrentThread());
   DCHECK_GT(ext_ctrls->config_store, 0u);
-
-  // TODO(crbug.com/819930): Remove after https://crrev.com/c/1134929 and
-  // https://crrev.com/c/1136336 are merged.
-  for (size_t i = 0; i < ext_ctrls->count; ++i) {
-    ReplaceChromeMpegVideoCtrlId(&ext_ctrls->controls[i].id);
-  }
-
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_S_EXT_CTRLS, ext_ctrls);
   return true;
 }
@@ -2521,13 +2479,6 @@
     struct v4l2_ext_controls* ext_ctrls) {
   DCHECK(decoder_thread_task_runner_->BelongsToCurrentThread());
   DCHECK_GT(ext_ctrls->config_store, 0u);
-
-  // TODO(crbug.com/819930): Remove after https://crrev.com/c/1134929 and
-  // https://crrev.com/c/1136336 are merged.
-  for (size_t i = 0; i < ext_ctrls->count; ++i) {
-    ReplaceChromeMpegVideoCtrlId(&ext_ctrls->controls[i].id);
-  }
-
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_G_EXT_CTRLS, ext_ctrls);
   return true;
 }
@@ -2537,10 +2488,6 @@
   memset(&query_ctrl, 0, sizeof(query_ctrl));
   query_ctrl.id = ctrl_id;
 
-  // TODO(crbug.com/819930): Remove after https://crrev.com/c/1134929 and
-  // https://crrev.com/c/1136336 are merged.
-  ReplaceChromeMpegVideoCtrlId(&query_ctrl.id);
-
   return (device_->Ioctl(VIDIOC_QUERYCTRL, &query_ctrl) == 0);
 }
 

diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h
index bdab5000..0898c44 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h

@@ -113,17 +113,6 @@
   // on the next DecodeSurface(). Return true on success.
   bool SubmitSlice(int index, const uint8_t* data, size_t size);
 
-  //
-  // TODO(crbug.com/819930): Remove after https://crrev.com/c/1134929 and
-  // https://crrev.com/c/1136336 are merged.
-  //
-  // If |ctrl_id| is for a ChromeOS-specific control of MPEG video and
-  // https://crrev.com/c/1134929 and https://crrev.com/c/1136336 don't seem to
-  // be merged into the kernel, change the value of |ctrl_id| to one for the
-  // kernel.
-  // Otherwise, do nothing.
-  void ReplaceChromeMpegVideoCtrlId(uint32_t* ctrl_id);
-
   // Submit controls in |ext_ctrls| to hardware. Return true on success.
   bool SubmitExtControls(struct v4l2_ext_controls* ext_ctrls);
 

diff --git a/mojo/core/shared_buffer_unittest.cc b/mojo/core/shared_buffer_unittest.cc
index b1e873f..784355d12 100644
--- a/mojo/core/shared_buffer_unittest.cc
+++ b/mojo/core/shared_buffer_unittest.cc

@@ -249,17 +249,11 @@
   EXPECT_EQ(region.GetMode(),
             base::subtle::PlatformSharedMemoryRegion::Mode::kReadOnly);
 
-  EXPECT_EQ("quit", ReadMessage(h));
   WriteMessage(h, "ok");
+  EXPECT_EQ("quit", ReadMessage(h));
 }
 
-#if defined(OS_ANDROID)
-// Android multi-process tests are not executing the new process. This is flaky.
-#define MAYBE_CreateAndPassReadOnlyBuffer DISABLED_CreateAndPassReadOnlyBuffer
-#else
-#define MAYBE_CreateAndPassReadOnlyBuffer CreateAndPassReadOnlyBuffer
-#endif
-TEST_F(SharedBufferTest, MAYBE_CreateAndPassReadOnlyBuffer) {
+TEST_F(SharedBufferTest, CreateAndPassReadOnlyBuffer) {
   RunTestClient("ReadAndMapWriteSharedBuffer", [&](MojoHandle h) {
     // Create a new shared buffer.
     MojoHandle b = CreateBuffer(1234);
@@ -269,8 +263,8 @@
     MojoHandle dupe = DuplicateBuffer(b, true /* read_only */);
     WriteMessageWithHandles(h, "hello", &dupe, 1);
 
-    WriteMessage(h, "quit");
     EXPECT_EQ("ok", ReadMessage(h));
+    WriteMessage(h, "quit");
   });
 }
 
@@ -285,20 +279,11 @@
   MojoHandle dupe = DuplicateBuffer(b, true /* read_only */);
   WriteMessageWithHandles(h, "", &dupe, 1);
 
-  EXPECT_EQ("quit", ReadMessage(h));
   WriteMessage(h, "ok");
+  EXPECT_EQ("quit", ReadMessage(h));
 }
 
-#if defined(OS_ANDROID) || defined(OS_FUCHSIA)
-// Android multi-process tests are not executing the new process. This is flaky.
-// Flaky on Fuchsia; see http://crbug.com/874719
-#define MAYBE_CreateAndPassFromChildReadOnlyBuffer \
-  DISABLED_CreateAndPassFromChildReadOnlyBuffer
-#else
-#define MAYBE_CreateAndPassFromChildReadOnlyBuffer \
-  CreateAndPassFromChildReadOnlyBuffer
-#endif
-TEST_F(SharedBufferTest, MAYBE_CreateAndPassFromChildReadOnlyBuffer) {
+TEST_F(SharedBufferTest, CreateAndPassFromChildReadOnlyBuffer) {
   RunTestClient("CreateAndPassReadOnlyBuffer", [&](MojoHandle h) {
     MojoHandle b;
     EXPECT_EQ("", ReadMessageWithHandles(h, &b, 1));
@@ -312,8 +297,8 @@
     EXPECT_EQ(region.GetMode(),
               base::subtle::PlatformSharedMemoryRegion::Mode::kReadOnly);
 
-    WriteMessage(h, "quit");
     EXPECT_EQ("ok", ReadMessage(h));
+    WriteMessage(h, "quit");
   });
 }
 

diff --git a/net/http/transport_security_state_static.json b/net/http/transport_security_state_static.json
index afd1792..d0206cca 100644
--- a/net/http/transport_security_state_static.json
+++ b/net/http/transport_security_state_static.json

@@ -974,10 +974,7 @@
     { "name": "cert.se", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "simon.butcher.name", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "linx.net", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "ebanking.indovinabank.com.vn", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "www.moneybookers.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "app.recurly.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "api.recurly.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "luneta.nearbuysystems.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "ubertt.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "pixi.me", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
@@ -1085,7 +1082,6 @@
     { "name": "eff.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "mail.de", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "mnsure.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "www.heliosnet.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "www.opsmate.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "f-droid.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "blacklane.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
@@ -1170,30 +1166,6 @@
     { "name": "save.gov", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "saveaward.gov", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "ustr.gov", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "admin.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "id.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "kojipkgs.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "apps.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "badges.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "ask.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "admin.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "apps.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "ask.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "badges.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "darkserver.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "darkserver.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "geoip.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "geoip.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "lists.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "lists.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "qa.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "qa.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "redirect.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "redirect.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "taskotron.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "taskotron.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "translate.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
-    { "name": "translate.stg.fedoraproject.org", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "landscape.canonical.com", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "auth.mail.ru", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
     { "name": "e.mail.ru", "policy": "bulk-legacy", "mode": "force-https", "include_subdomains": true },
@@ -14419,7 +14391,6 @@
     { "name": "rehabili-shigoto.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "reikiqueen.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "reinencaressa.be", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "reliancebank.bank", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "rema.site", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "renewablefreedom.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "renrenss.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -16390,7 +16361,6 @@
     { "name": "sneedit.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "sneed.it", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "stirlingpoon.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "sorn.service.gov.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "staffjoy.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "soundhunter.xyz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "simumiehet.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -16617,12 +16587,10 @@
     { "name": "waterforlife.net.au", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "wowjs.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "vlogge.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "vehicleenquiry.service.gov.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "vitsoft.by", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "vician.cz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "warehost.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "whatwebcando.today", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "vehicletax.service.gov.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "wowjs.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "web-vision.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "webthings.com.br", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -16943,7 +16911,6 @@
     { "name": "conjugacao.com.br", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "charta-digitale-vernetzung.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "carriedin.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "caceis.bank", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "coccolebenessere.it", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "avus-automobile.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "checkpoint-tshirt.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -25671,7 +25638,6 @@
     { "name": "frontline6.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "frugalmechanic.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "frumious.fyi", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "fsbnh.bank", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "fsckd.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "fsvt.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "fudanshi.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -27425,7 +27391,6 @@
     { "name": "sawyerroofing.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "sblum.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "sbo-dresden.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "sbsavings.bank", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "scalesbiolab.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "schaafenstrasse.koeln", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "schau-rein.co.at", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -48428,7 +48393,6 @@
     { "name": "lakelandbank.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "lakeshowlife.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "lebensraum-fitness-toenisvorst.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "legacy.bank", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "levelaccordingly.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "liam-w.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "lignemax.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53127,7 +53091,6 @@
     { "name": "skytec.host", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "slotarazzi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "smartedg.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "socialmirror.app", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "somersetscr.nhs.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "soundscrate.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sparkresearch.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -55811,14 +55774,6 @@
     // special section above.
     // START OF MANUAL CUSTOM ENTRIES
     // Bulk-style
-    { "name": "bodhi.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
-    { "name": "communityblog.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
-    { "name": "keys.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
-    { "name": "meetbot.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
-    { "name": "paste.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
-    { "name": "spins.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
-    { "name": "src.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
-    { "name": "torrent.fedoraproject.org", "policy": "custom", "mode": "force-https", "include_subdomains": true },
     { "name": "rugk.dedyn.io", "policy": "custom", "mode": "force-https", "include_subdomains": true },
     { "name": "bicycle-events.com", "policy": "custom", "mode": "force-https", "include_subdomains": true },
     { "name": "aramado.com", "policy": "custom", "mode": "force-https", "include_subdomains": true },

diff --git a/net/nqe/network_quality_estimator_unittest.cc b/net/nqe/network_quality_estimator_unittest.cc
index f3a41e6..3919fbb 100644
--- a/net/nqe/network_quality_estimator_unittest.cc
+++ b/net/nqe/network_quality_estimator_unittest.cc

@@ -1905,7 +1905,8 @@
 
 // TestTCPSocketRTT requires kernel support for tcp_info struct, and so it is
 // enabled only on certain platforms.
-#if defined(TCP_INFO) || defined(OS_LINUX) || defined(OS_ANDROID)
+#if defined(TCP_INFO) || defined(OS_LINUX) || defined(OS_ANDROID) || \
+    defined(OS_CHROMEOS)
 #define MAYBE_TestTCPSocketRTT TestTCPSocketRTT
 #else
 #define MAYBE_TestTCPSocketRTT DISABLED_TestTCPSocketRTT

diff --git a/net/quic/quic_chromium_client_session.cc b/net/quic/quic_chromium_client_session.cc
index 16a107b..a5f1aa1 100644
--- a/net/quic/quic_chromium_client_session.cc
+++ b/net/quic/quic_chromium_client_session.cc

@@ -2067,6 +2067,12 @@
     net_log_.AddEvent(
         NetLogEventType::QUIC_SESSION_CLIENT_GOAWAY_ON_PATH_DEGRADING);
     NotifyFactoryOfSessionGoingAway();
+    UMA_HISTOGRAM_COUNTS_1M(
+        "Net.QuicSession.ActiveStreamsOnGoAwayAfterPathDegrading",
+        GetNumActiveStreams());
+    UMA_HISTOGRAM_COUNTS_1M(
+        "Net.QuicSession.DrainingStreamsOnGoAwayAfterPathDegrading",
+        GetNumDrainingStreams());
     return;
   }
 

diff --git a/net/socket/udp_socket_unittest.cc b/net/socket/udp_socket_unittest.cc
index 506699b..1c9cf42 100644
--- a/net/socket/udp_socket_unittest.cc
+++ b/net/socket/udp_socket_unittest.cc

@@ -297,7 +297,8 @@
 // broadcasting to 255.255.255.255 returns error -109 (Address not reachable).
 // crbug.com/139144.
 // - Fuchsia: TODO(fuchsia): broadcast support is not implemented yet.
-// - ChromeOS: https://crbug.com/873851.
+// - ChromeOS: QEMU's user-mode networking doesn't handle broadcasts.
+//   https://crbug.com/852590
 #define MAYBE_LocalBroadcast DISABLED_LocalBroadcast
 #else
 #define MAYBE_LocalBroadcast LocalBroadcast

diff --git a/remoting/host/installer/build-installer-archive.py b/remoting/host/installer/build-installer-archive.py
index 9c2d65a..4585d0a 100755
--- a/remoting/host/installer/build-installer-archive.py
+++ b/remoting/host/installer/build-installer-archive.py

@@ -21,10 +21,6 @@
 import sys
 import zipfile
 
-sys.path.append(os.path.join(
-    os.path.dirname(__file__), os.pardir, os.pardir, os.pardir,
-    "build", "android", "gyp"))
-from util import build_utils
 
 def cleanDir(dir):
   """Deletes and recreates the dir to make sure it is clean.
@@ -58,6 +54,23 @@
   return defs
 
 
+def createZip(zip_path, directory):
+  """Creates a zipfile at zip_path for the given directory.
+
+  Args:
+    zip_path: Path to zip file to create.
+    directory: Directory with contents to archive.
+  """
+  zipfile_base = os.path.splitext(os.path.basename(zip_path))[0]
+  zip = zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED)
+  for (root, dirs, files) in os.walk(directory):
+    for f in files:
+      full_path = os.path.join(root, f)
+      rel_path = os.path.relpath(full_path, directory)
+      zip.write(full_path, os.path.join(zipfile_base, rel_path))
+  zip.close()
+
+
 def remapSrcFile(dst_root, src_roots, src_file):
   """Calculates destination file path and creates directory.
 
@@ -193,9 +206,7 @@
     else:
       shutil.copy2(bs, dst_file)
 
-  build_utils.ZipDir(
-    zip_path, temp_dir,
-    zip_prefix_path=os.path.splitext(os.path.basename(zip_path))[0])
+  createZip(zip_path, temp_dir)
 
 
 def error(msg):

diff --git a/remoting/host/installer/mac/BUILD.gn b/remoting/host/installer/mac/BUILD.gn
index 1c3e5cc0..8e131a7 100644
--- a/remoting/host/installer/mac/BUILD.gn
+++ b/remoting/host/installer/mac/BUILD.gn

@@ -36,10 +36,6 @@
 
   script = "//remoting/host/installer/build-installer-archive.py"
 
-  sources = [
-    "//build/android/gyp/util/build_utils.py",
-  ]
-
   args = [
            rebase_path("$target_gen_dir/remoting_installation", root_build_dir),
            rebase_path(zip_path, root_build_dir),

diff --git a/remoting/host/installer/win/BUILD.gn b/remoting/host/installer/win/BUILD.gn
index abd7cbab..cf94652 100644
--- a/remoting/host/installer/win/BUILD.gn
+++ b/remoting/host/installer/win/BUILD.gn

@@ -8,10 +8,6 @@
 action("remoting_me2me_host_archive") {
   script = "//remoting/host/installer/build-installer-archive.py"
 
-  sources = [
-    "//build/android/gyp/util/build_utils.py",
-  ]
-
   deps = [
     "//remoting/host:remoting_native_messaging_manifests",
     "//remoting/host:remoting_start_host",

diff --git a/remoting/webapp/build-webapp.py b/remoting/webapp/build-webapp.py
index 2c64e5f3..2f02e8d3 100755
--- a/remoting/webapp/build-webapp.py
+++ b/remoting/webapp/build-webapp.py

@@ -23,11 +23,7 @@
 import subprocess
 import sys
 import time
-
-sys.path.append(os.path.join(
-    os.path.dirname(__file__), os.pardir, os.pardir,
-    "build", "android", "gyp"))
-from util import build_utils
+import zipfile
 
 # Update the module path, assuming that this script is in src/remoting/webapp,
 # and that the google_api_keys module is in src/google_apis. Note that
@@ -50,6 +46,18 @@
   os.remove(oldFilepath)
 
 
+def createZip(zip_path, directory):
+  """Creates a zipfile at zip_path for the given directory."""
+  zipfile_base = os.path.splitext(os.path.basename(zip_path))[0]
+  zip = zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED)
+  for (root, dirs, files) in os.walk(directory):
+    for f in files:
+      full_path = os.path.join(root, f)
+      rel_path = os.path.relpath(full_path, directory)
+      zip.write(full_path, os.path.join(zipfile_base, rel_path))
+  zip.close()
+
+
 def replaceString(destination, placeholder, value):
   findAndReplace(os.path.join(destination, 'plugin_settings.js'),
                  "'" + placeholder + "'", "'" + value + "'")
@@ -336,9 +344,7 @@
                          context)
 
   # Make the zipfile.
-  build_utils.ZipDir(
-    zip_path, destination,
-    zip_prefix_path=os.path.splitext(os.path.basename(zip_path))[0])
+  createZip(zip_path, destination)
 
   return 0
 

diff --git a/remoting/webapp/build_template.gni b/remoting/webapp/build_template.gni
index d5ed945..05790597 100644
--- a/remoting/webapp/build_template.gni
+++ b/remoting/webapp/build_template.gni

@@ -214,10 +214,6 @@
   action(target_name) {
     script = "//remoting/webapp/build-webapp.py"
 
-    sources = [
-      "//build/android/gyp/util/build_utils.py",
-    ]
-
     output_dir = invoker.output_dir
     zip_path = invoker.zip_path
     extra_files = invoker.extra_files

diff --git a/services/metrics/public/cpp/ukm_entry_builder_base.cc b/services/metrics/public/cpp/ukm_entry_builder_base.cc
index 6685a58..0c689ec 100644
--- a/services/metrics/public/cpp/ukm_entry_builder_base.cc
+++ b/services/metrics/public/cpp/ukm_entry_builder_base.cc

@@ -19,6 +19,13 @@
   entry_->event_hash = event_hash;
 }
 
+UkmEntryBuilderBase::UkmEntryBuilderBase(base::UkmSourceId source_id,
+                                         uint64_t event_hash)
+    : entry_(mojom::UkmEntry::New()) {
+  entry_->source_id = source_id.ToInt64();
+  entry_->event_hash = event_hash;
+}
+
 UkmEntryBuilderBase::~UkmEntryBuilderBase() = default;
 
 void UkmEntryBuilderBase::SetMetricInternal(uint64_t metric_hash,

diff --git a/services/metrics/public/cpp/ukm_entry_builder_base.h b/services/metrics/public/cpp/ukm_entry_builder_base.h
index 3da1a3a..88c3312 100644
--- a/services/metrics/public/cpp/ukm_entry_builder_base.h
+++ b/services/metrics/public/cpp/ukm_entry_builder_base.h

@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/macros.h"
+#include "base/metrics/ukm_source_id.h"
 #include "services/metrics/public/cpp/metrics_export.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "services/metrics/public/mojom/ukm_interface.mojom.h"
@@ -27,6 +28,8 @@
   void Record(UkmRecorder* recorder);
 
  protected:
+  UkmEntryBuilderBase(base::UkmSourceId source_id, uint64_t event_hash);
+  // TODO(crbug/873866): Remove this version once callers are migrated.
   UkmEntryBuilderBase(SourceId source_id, uint64_t event_hash);
 
   // Add metric to the entry. A metric contains a metric hash and value.

diff --git a/services/metrics/public/cpp/ukm_recorder.cc b/services/metrics/public/cpp/ukm_recorder.cc
index 09428b83..f81b86b 100644
--- a/services/metrics/public/cpp/ukm_recorder.cc
+++ b/services/metrics/public/cpp/ukm_recorder.cc

@@ -31,4 +31,12 @@
   return AssignNewSourceId();
 }
 
+void UkmRecorder::RecordOtherURL(base::UkmSourceId source_id, const GURL& url) {
+  UpdateSourceURL(source_id.ToInt64(), url);
+}
+
+void UkmRecorder::RecordAppURL(base::UkmSourceId source_id, const GURL& url) {
+  UpdateAppURL(source_id.ToInt64(), url);
+}
+
 }  // namespace ukm

diff --git a/services/metrics/public/cpp/ukm_recorder.h b/services/metrics/public/cpp/ukm_recorder.h
index fc850621..3aa02cf 100644
--- a/services/metrics/public/cpp/ukm_recorder.h
+++ b/services/metrics/public/cpp/ukm_recorder.h

@@ -95,6 +95,11 @@
   // Disables sampling for testing purposes.
   virtual void DisableSamplingForTesting(){};
 
+ protected:
+  // Type-safe wrappers for Update<X> functions.
+  void RecordOtherURL(base::UkmSourceId source_id, const GURL& url);
+  void RecordAppURL(base::UkmSourceId source_id, const GURL& url);
+
  private:
   friend DelegatingUkmRecorder;
   friend IOSChromePasswordManagerClient;

diff --git a/services/metrics/public/cpp/ukm_source_id.cc b/services/metrics/public/cpp/ukm_source_id.cc
index ef33a18f0..a970761 100644
--- a/services/metrics/public/cpp/ukm_source_id.cc
+++ b/services/metrics/public/cpp/ukm_source_id.cc

@@ -10,39 +10,16 @@
 
 namespace ukm {
 
-namespace {
-
-const int64_t kLowBitsMask = (INT64_C(1) << 32) - 1;
-const int64_t kNumTypeBits = 2;
-const int64_t kTypeMask = (INT64_C(1) << kNumTypeBits) - 1;
-
-}  // namespace
-
 SourceId AssignNewSourceId() {
-  // Generate some bits which are unique to this process, so we can generate
-  // IDs independently in different processes. IDs generated by this method may
-  // collide, but it should be sufficiently rare enough to not impact data
-  // quality.
-  const static int64_t process_id_bits =
-      static_cast<int64_t>(base::RandUint64()) & ~kLowBitsMask;
-  // Generate some bits which are unique within the process, using a counter.
-  static base::AtomicSequenceNumber seq;
-  SourceId local_id = ConvertToSourceId(seq.GetNext() + 1, SourceIdType::UKM);
-  // Combine the local and process bits to generate a unique ID.
-  return (local_id & kLowBitsMask) | process_id_bits;
+  return base::UkmSourceId::New().ToInt64();
 }
 
 SourceId ConvertToSourceId(int64_t other_id, SourceIdType id_type) {
-  const int64_t type_bits = static_cast<int64_t>(id_type);
-  DCHECK_EQ(type_bits, type_bits & kTypeMask);
-  // Stores the the type ID in the low bits of the source id, and shift the rest
-  // of the ID to make room.  This could cause the original ID to overflow, but
-  // that should be rare enough that it won't matter for UKM's purposes.
-  return (other_id << kNumTypeBits) | type_bits;
+  return base::UkmSourceId::FromOtherId(other_id, id_type).ToInt64();
 }
 
 SourceIdType GetSourceIdType(SourceId source_id) {
-  return static_cast<SourceIdType>(source_id & kTypeMask);
+  return base::UkmSourceId::FromInt64(source_id).GetType();
 }
 
 }  // namespace ukm

diff --git a/services/metrics/public/cpp/ukm_source_id.h b/services/metrics/public/cpp/ukm_source_id.h
index 280bd93..098b908 100644
--- a/services/metrics/public/cpp/ukm_source_id.h
+++ b/services/metrics/public/cpp/ukm_source_id.h

@@ -7,17 +7,14 @@
 
 #include <stdint.h>
 
+#include "base/metrics/ukm_source_id.h"
 #include "services/metrics/public/cpp/metrics_export.h"
 
 namespace ukm {
 
 typedef int64_t SourceId;
 
-enum class SourceIdType : int64_t {
-  UKM = 0,
-  NAVIGATION_ID = 1,
-  APP_ID = 2,
-};
+using SourceIdType = base::UkmSourceId::Type;
 
 const SourceId kInvalidSourceId = 0;
 

diff --git a/services/network/public/mojom/network_service_test.mojom b/services/network/public/mojom/network_service_test.mojom
index 9014971..000451ba 100644
--- a/services/network/public/mojom/network_service_test.mojom
+++ b/services/network/public/mojom/network_service_test.mojom

@@ -8,15 +8,7 @@
 import "services/network/public/mojom/network_param.mojom";
 import "services/network/public/mojom/network_types.mojom";
 
-// Maps to net::RuleBasedHostResolverProc::Rule::ResolverType.
-enum ResolverType {
-  kResolverTypeFail,
-  kResolverTypeSystem,
-  kResolverTypeIPLiteral,
-};
-
 struct Rule {
-  ResolverType resolver_type;
   string host_pattern;
   string replacement;
 };

diff --git a/services/service_manager/service_manager.cc b/services/service_manager/service_manager.cc
index cc243a0b..44da108 100644
--- a/services/service_manager/service_manager.cc
+++ b/services/service_manager/service_manager.cc

@@ -605,7 +605,7 @@
         return mojom::ConnectResult::INVALID_ARGUMENT;
       }
       if (service_manager_->GetExistingInstance(target)) {
-        LOG(ERROR) << "Cannot client process matching existing identity:"
+        LOG(ERROR) << "Cannot find a client process matching existing identity:"
                    << "Name: " << target.name() << " User: "
                    << target.user_id() << " Instance: " << target.instance();
         return mojom::ConnectResult::INVALID_ARGUMENT;

diff --git a/testing/buildbot/filters/mash.browser_tests.filter b/testing/buildbot/filters/mash.browser_tests.filter
index d31a67dc..fa9914c 100644
--- a/testing/buildbot/filters/mash.browser_tests.filter
+++ b/testing/buildbot/filters/mash.browser_tests.filter

@@ -309,4 +309,9 @@
 # https://crbug.com/671891
 -SiteDetailsBrowserTest.IsolateExtensions
 
+# Started flaking on MSAN Mash browser_tests bots for the Downloads case (Drive
+# tests cases are fine), https://crbug.com/874954
+-KeyboardOperations/FilesAppBrowserTest.Test/renameNewFolderDownloads
+-KeyboardOperations/FilesAppBrowserTest.Test/renameNewFolderDownloads_GuestMode
+
 # See comment at top of file regarding adding test exclusions.

diff --git a/testing/buildbot/filters/webui_polymer2_browser_tests.filter b/testing/buildbot/filters/webui_polymer2_browser_tests.filter
index 2d49544..b75d1cc 100644
--- a/testing/buildbot/filters/webui_polymer2_browser_tests.filter
+++ b/testing/buildbot/filters/webui_polymer2_browser_tests.filter

@@ -40,6 +40,9 @@
 -PrintPreviewDestinationListTest.FireDestinationSelected
 -SettingsAdvancedPageBrowserTest.Load
 
+# Mac only failure. See crbug.com/874976
+-MaterialHistoryItemTest.All
+
 # Tests that fail only on official builds.
 -CrSettingsChromeCleanupPageTest.All
 -CrSettingsIncompatibleApplicationsPageTest.All
@@ -317,6 +320,7 @@
 PrintPreviewPreviewGenerationTest.*
 PrintPreviewPrintButtonTest.*
 PrintPreviewRestoreStateTest.*
+PrintPreviewSelectBehaviorTest.*
 PrintPreviewSettingsSectionsTest.*
 PrintPreviewSettingsSelectTest.*
 PrintPreviewSystemDialogBrowserTest.*

diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index adadb92..b741a5e 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json

@@ -994,6 +994,12 @@
             ],
             "experiments": [
                 {
+                    "name": "Control",
+                    "disable_features": [
+                        "ChromeModernDesign"
+                    ]
+                },
+                {
                     "name": "Modern",
                     "enable_features": [
                         "ChromeModernDesign"

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index b05bf42f..4bb64650 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -548,7 +548,8 @@
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-basic-008.xht [ Failure ]
 crbug.com/776051 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-block-no-clip-001.xht [ Failure ]
 crbug.com/776051 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-block-no-clip-002.xht [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-br-inside-avoidcolumn-001.xht [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-break-000.xht [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-break-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-breaking-000.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-breaking-001.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-breaking-002.html [ Failure ]
@@ -557,6 +558,7 @@
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-breaking-nobackground-001.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-breaking-nobackground-002.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-breaking-nobackground-003.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-br-inside-avoidcolumn-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-clip-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-clip-002.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-collapsing-001.xht [ Failure ]
@@ -600,12 +602,16 @@
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-gap-negative-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-height-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-height-block-child-001.xht [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-inherit-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-inherit-002.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-inherit-003.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-list-item-001.xht [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-margin-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-margin-002.xht [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-margin-child-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-nested-002.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-nested-005.xht [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-nested-margin-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-nested-margin-002.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-nested-margin-003.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-nested-margin-004.xht [ Failure ]
@@ -620,7 +626,7 @@
 crbug.com/792435 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-004.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-color-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-color-inherit-001.xht [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-color-inherit-002.xht [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-color-inherit-002.xht [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-dashed-000.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-dotted-000.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-double-000.xht [ Failure ]
@@ -670,11 +676,11 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/abspos-new-width-rebalance.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-float-after-forced-break.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-float-in-inline.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-floats.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-float-with-margin-top-and-line-after-break-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-float-with-margin-top-and-line-after-break-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-float-with-margin-top-and-line-after-break.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-float-with-margin-top-and-line-before-break.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-floats.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-line-overflow.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-line-underflow-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/balance-repeating-table-headers.html [ Failure ]
@@ -683,31 +689,32 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/border-radius-clipped-layer.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/break-before-first-line-in-first-child.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/break-in-scrollable.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/caret-range-anonymous-block-rtl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/caret-range-anonymous-block.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/caret-range-outside-columns-rtl.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/caret-range-anonymous-block-rtl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/caret-range-outside-columns.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/caret-range-outside-columns-rtl.html [ Failure ]
 crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/change-height.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rect-after-spanner.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rect-nested.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rects-crossing-boundaries-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rects-crossing-boundaries.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rects-rtl.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rects.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rects-crossing-boundaries-nested.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rects.html [ Crash Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/client-rects-rtl.html [ Crash Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/column-break-with-balancing.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/column-clamping.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/column-count-with-rules.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/column-rules.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/columns-shorthand-parsing.html [ Failure ]
-crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/content-change-same-height.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-inner-multicol.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-opacity-2nd-and-3rd-column.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-relpos-clipped.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-relpos.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-relpos-in-clipped.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-relpos-overlapping-will-change.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-relpos-resize.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-relpos.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-with-child-layer-in-next-column.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/composited-with-overflow-in-next-column.html [ Failure ]
+crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/content-change-same-height.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/doubly-nested-with-top-padding-crossing-row-boundaries.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/abspos-becomes-spanner.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/abspos-multicol-with-spanner-becomes-spanner.html [ Failure ]
@@ -727,13 +734,14 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-after-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-after-spanner-before-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-before-content.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-between-out-of-flow.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-into-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-into-stf-constrained-width.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-into-stf-unconstrained-width.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-after-then-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-after.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-before-after-in-content.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-after-then-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-before-after.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-before-after-in-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-before-following-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/insert-spanner-pseudo-before.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/invalid-spanner-container-becomes-valid.html [ Failure ]
@@ -754,14 +762,17 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/spanner-before-content-becomes-regular-block.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/spanner-in-content-becomes-regular-block.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/dynamic/static-becomes-relpos-has-abspos.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/event-offset-complex-tree.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/event-offset.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/event-offset-in-nested.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/filter-in-second-column.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/first-line-in-float-below-next-column-top.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/first-line-in-float-with-margin.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/fixedpos-child-becomes-static.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/flexbox-starts-at-column-boundary-with-block.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/flexbox-starts-at-column-boundary.html [ Failure ]
-crbug.com/864156 virtual/layout_ng_experimental/fast/multicol/flexbox-with-overflow-auto-child-crash.html [ Crash ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/flexbox.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/flexbox-starts-at-column-boundary.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/flexbox-starts-at-column-boundary-with-block.html [ Failure ]
+crbug.com/864156 virtual/layout_ng_experimental/fast/multicol/flexbox-with-overflow-auto-child-crash.html [ Crash ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/flipped-blocks-border-after.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/flipped-blocks-hit-test.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/float-after-break-after.html [ Failure ]
@@ -787,9 +798,10 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/forced-break-after-last-block-before-spanner.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/forced-break-in-nested-columns.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/forced-break-too-short-column.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/foreignObject.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/hit-test-above-or-below.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/hit-test-end-of-column-with-line-height.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/hit-test-end-of-column.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/hit-test-end-of-column-with-line-height.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/hit-test-gap-between-pages-flipped.html [ Failure ]
 crbug.com/812457 virtual/layout_ng_experimental/fast/multicol/huge-column-count.html [ Failure ]
 crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/huge-column-gap-crash.html [ Failure ]
@@ -813,8 +825,8 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/multicol-with-child-renderLayer-for-input.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-3-multicols-fixed-height.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-auto-height-extra-block-inbetween.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-auto-height-short-first-row.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-auto-height.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-auto-height-short-first-row.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-balanced-inner-column-count-1-with-forced-break.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-balanced-inner-with-many-breaks-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-balanced-inner-with-many-breaks.html [ Failure ]
@@ -834,32 +846,35 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-with-single-empty-block.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-with-single-tall-line.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/nested-with-tall-block.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/nested-writing-mode-root-crash.html [ Crash ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/avoid-column-break-inside.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance-images.html [ Failure ]
-crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance-maxheight1.html [ Failure ]
-crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance1.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance10.html [ Failure ]
+crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance1.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance4.html [ Failure ]
 crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance5.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance-images.html [ Failure ]
+crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/newmulticol/balance-maxheight1.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/break-before.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/newmulticol/breaks-2-columns-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/breaks-2-columns-3-no-balancing.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/breaks-3-columns-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/fixed-height-fill-balance-2.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/newmulticol/fixed-height-fill-balance.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/hide-box-vertical-lr.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/hide-box-vertical-rl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/list-item.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/orphans-and-widows-balance.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/newmulticol/table-cell.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/orphans-relayout.html [ Crash ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-on-line-at-boundary.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-on-line-rtl.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-on-line.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-small-on-line-at-boundary.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/nested-multicol.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/outlines-at-column-boundaries.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-on-line-at-boundary.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-on-line.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-on-line-rtl.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/abspos-auto-position-small-on-line-at-boundary.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/out-of-flow/nested-multicol.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/overflow-across-columns.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/overflow-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/overflow-unsplittable.html [ Failure ]
@@ -874,13 +889,14 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/renderer-positioned-assert-crash.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/rule-in-nested-with-too-tall-line.html [ Failure ]
 crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/scale-transform-text.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/scrollable-basic.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/scrolling-overflow.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/shadow-breaking.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/shrink-to-column-height-for-pagination.html [ Crash ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/single-line.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/abspos-containing-block-outside-spanner.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/adjacent-spanners-with-margin.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/adjacent-spanners.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/adjacent-spanners-with-margin.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/after-row-with-uneven-height-nested-multicol.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/as-inner-multicol.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/autofill-after-spanner.html [ Failure ]
@@ -920,18 +936,18 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/overflow-on-viewport.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/percent-margins.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/preferred-widths-with-column-content.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-after-then-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-after.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-before-after-in-content.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-after-then-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-before-after.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-before-after-in-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-before-following-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/pseudo-before.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/relpos-in-block.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/relpos-spanner-with-abspos-child.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/remaining-space-in-last-column.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/simple-margins.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/sole-spanner-inside-div.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/sole-spanner.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/sole-spanner-inside-div.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/span-between-text.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/spanner-first.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/span/spanner-img.html [ Failure ]
@@ -953,20 +969,21 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/table-caption-and-cells-fixed-width.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/table-caption-and-cells.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/table-caption-with-block.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/table-cell-content-change-with-decorations.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/table-cell-content-change.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/table-cell-content-change-with-decorations.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/table-margin-collapse.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/tall-content-in-inner-with-fixed-height.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/tall-float2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/three-inner-rows.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/unbreakable-block-too-tall-to-fit.html [ Failure ]
 crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/unbreakable-content-taller-than-height-crash.html [ Failure ]
+crbug.com/874506 virtual/layout_ng_experimental/fast/multicol/unsplittable-inline-block.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/abspos-auto-position-on-line.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/break-properties.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/caret-range-anonymous-block-rtl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/caret-range-anonymous-block.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/caret-range-outside-columns-rtl.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/caret-range-anonymous-block-rtl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/caret-range-outside-columns.html [ Timeout Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/caret-range-outside-columns-rtl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/client-rect-after-spanner.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/client-rects-crossing-boundaries-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/column-break-with-balancing.html [ Failure ]
@@ -982,47 +999,47 @@
 crbug.com/714962 virtual/layout_ng_experimental/fast/multicol/vertical-lr/float-truncation.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/image-inside-nested-blocks-with-border.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/nested-columns.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/offset-top-and-left-at-boundaries-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/offset-top-and-left-at-boundaries.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/offset-top-and-left-at-boundaries-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/offset-top-and-left-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-lr/unsplittable-inline-block.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/abspos-auto-position-on-line.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/abspos-auto-position-on-line.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/break-properties.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/caret-range-anonymous-block-rtl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/caret-range-anonymous-block.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/caret-range-outside-columns-rtl.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/caret-range-outside-columns.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/caret-range-anonymous-block-rtl.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/caret-range-outside-columns.html [ Crash Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/caret-range-outside-columns-rtl.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/client-rect-after-spanner.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/client-rects-crossing-boundaries-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/column-break-with-balancing.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/column-count-with-rules.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/column-rules.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/column-count-with-rules.html [ Crash Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/column-rules.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/composited-relpos-overlapping-will-change.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-avoidance.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-avoidance.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-big-line.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-break.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-content-break.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-edge.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-paginate.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-break.html [ Crash Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-content-break.html [ Crash Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-edge.html [ Crash Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-paginate.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/float-truncation.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/image-inside-nested-blocks-with-border.html [ Failure ]
-crbug.com/467477 virtual/layout_ng_experimental/fast/multicol/vertical-rl/nested-columns.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/offset-top-and-left-at-boundaries-nested.html [ Failure ]
+crbug.com/467477 virtual/layout_ng_experimental/fast/multicol/vertical-rl/nested-columns.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/offset-top-and-left-at-boundaries.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/offset-top-and-left-at-boundaries-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/offset-top-and-left-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/vertical-rl/unsplittable-inline-block.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/widows-and-orphans.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/multicol/widows.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/auto-height-with-break.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/auto-height.html [ Crash Pass ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/auto-height-with-break.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/break-in-paged-overflow.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-x-rtl-vertical-rl.html [ Failure Crash ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-x-rtl.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-x-vertical-rl.html [ Failure Crash ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-x.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-y-rtl-vertical-rl.html [ Failure ]
-crbug.com/714962 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-y-rtl.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-x-rtl.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-x-rtl-vertical-rl.html [ Failure Crash ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-x-vertical-rl.html [ Failure Crash ]
 crbug.com/714962 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-y.html [ Failure ]
+crbug.com/714962 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-y-rtl.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/caret-range-outside-paged-y-rtl-vertical-rl.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/div-x-horizontal-tb-rtl.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/div-x-vertical-lr-ltr.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/div-x-vertical-lr-rtl.html [ Failure ]
@@ -1043,14 +1060,14 @@
 crbug.com/591099 virtual/layout_ng_experimental/fast/pagination/short-pages-tall-content.html [ Timeout ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/abspos-after-forced-break.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/auto-scrollbar-shrink-to-fit.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/avoid-break-inside-first-child-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/avoid-break-inside-first-child.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/avoid-break-inside-first-child-nested.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/block-after-float-first-child.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/border-spacing-break-before-unbreakable-row.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/break-in-first-table-row-only.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/break-in-second-table-section.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/break-in-tbody-after-caption.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/break-inside-avoid-with-forced-break.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/break-in-tbody-after-caption.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/cells-dont-fit-on-page-paginated.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/change-fragmentainer-height-block-float-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/change-fragmentainer-height-block-float.html [ Failure ]
@@ -1061,14 +1078,14 @@
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/float-margin-top.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/float-pushed-to-next-fragmentainer-by-floats.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/forced-break-clearance-unsplittable-content.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/foreignobject-no-pagination.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/fragmented-rowspan-alignment.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/fragmented-rowspan.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/fragmented-table-cell.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/fragmented-table-with-fixed-height.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/foreignobject-no-pagination.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/image-block-as-first-child.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/multi-line-cells-paginated.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/multi-line-cells.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/multi-line-cells-paginated.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/nested-repeating-thead-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/nested-repeating-thead-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/nested-repeating-thead-4.html [ Failure ]
@@ -1078,8 +1095,8 @@
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/relayout-abspos.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/remove-unbreakable-block-in-line-float.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/repeating-thead-exceeds-page-size.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/repeating-thead-multiple-tables-page-border.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/repeating-thead-multiple-tables.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/repeating-thead-multiple-tables-page-border.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/repeating-thead-no-room-for-content-row-on-first-page.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/repeating-thead-tfoot-different-fragment-height.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/repeating-thead-under-repeating-thead.html [ Failure ]
@@ -1088,6 +1105,7 @@
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-cell-repeating-thead-break-inside-content.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-cells-multiple-tables-no-repeating-thead.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-large-cell-with-header.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-in-multiple-table-sections.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-multiple-tables-caption-repeating-thead-tfoot-with-border-spacing-at-top-of-row-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-multiple-tables-caption-repeating-thead-tfoot-with-border-spacing-at-top-of-row-3.html [ Failure ]
@@ -1097,21 +1115,23 @@
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-4.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-nested-repeating-tfoot.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-tfoot-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-tfoot-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-tfoot-4.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead-tfoot.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-nested-repeating-thead.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-paginated-with-text.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-paginated.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-paginated-with-text.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-tfoot-rows-allowing-break.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-cell-straddles-page-unsplittable-div.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-cell-straddles-page.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-cell-straddles-page-unsplittable-div.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-starts-middle-of-page-break-after-avoid-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-starts-middle-of-page-break-after-avoid-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-starts-middle-of-page-break-after-avoid.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-starts-middle-of-page.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot-starts-middle-of-page-break-after-avoid-2.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot-starts-middle-of-page-break-after-avoid-3.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot-starts-middle-of-page-break-after-avoid.html [ Failure ]
@@ -1119,23 +1139,20 @@
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot-with-border-spacing-at-top-of-row.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot-with-caption.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot-with-two-captions.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-tfoot.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-with-border-spacing-at-top-of-row.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-with-caption.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead-with-two-captions.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells-repeating-thead.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/single-line-cells.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/table-in-subpixel-fragmentainer.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/table-overlapping-rowspan.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/table-row-dimensions-break-freely.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/fragmentation/table-row-dimensions-with-thead.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/table-row-dimensions.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/fragmentation/table-row-dimensions-with-thead.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/table-row-page-break-collapsed-border.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/thead-under-repeating-thead.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/unbreakable-tall-float-before-block.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/fragmentation/unbreakable-tall-float-before-line.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/printing/absolute-position-headers-and-footers.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/absolute-positioned.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/printing/absolute-position-headers-and-footers.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/allowed-page-breaks.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/css2.1/page-break-after-000.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/css2.1/page-break-after-002.html [ Failure ]
@@ -1146,10 +1163,10 @@
 crbug.com/591099 virtual/layout_ng_experimental/printing/fixed-positioned-child-repeats-even-when-html-and-body-are-zero-height.html [ Crash Pass ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/fixed-positioned-child-shouldnt-print.html [ Crash Pass ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/fixed-positioned-headers-and-footers-clipped.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/printing/fixed-positioned-headers-and-footers.html [ Failure ]
 crbug.com/824918 virtual/layout_ng_experimental/printing/fixed-positioned-headers-and-footers-inside-transform.html [ Crash Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/fixed-positioned-headers-and-footers-larger-than-page.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/fixed-positioned-headers-and-footers-transformed.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/printing/fixed-positioned-headers-and-footers.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/forced-break-tree-dump-only.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/iframe-print.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/list-item-with-empty-first-line.html [ Failure ]
@@ -1170,10 +1187,10 @@
 crbug.com/591099 virtual/layout_ng_experimental/printing/respect-layout-overflow-from-pagination.html [ Failure ]
 crbug.com/824918 virtual/layout_ng_experimental/printing/setPrinting.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/single-line-must-not-be-split-into-two-pages.html [ Failure Timeout ]
-crbug.com/591099 virtual/layout_ng_experimental/printing/thead-repeat-in-nested-table.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/tfoot-repeats-at-bottom-of-each-page-multiple-tables.html [ Failure ]
-crbug.com/591099 virtual/layout_ng_experimental/printing/thead-repeats-at-top-of-each-page-multiple-tables.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/printing/thead-repeat-in-nested-table.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/thead-repeats-at-top-of-each-page.html [ Failure ]
+crbug.com/591099 virtual/layout_ng_experimental/printing/thead-repeats-at-top-of-each-page-multiple-tables.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/thead-repeats-with-translucent-text-and-borders.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/printing/thead-under-multicol.html [ Failure ]
 crbug.com/829804 virtual/layout_ng_experimental/printing/webgl-oversized-printing.html [ Skip ]

diff --git a/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger-ui/script-formatter-breakpoints-3-expected.txt b/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger-ui/script-formatter-breakpoints-3-expected.txt
index 4cc54b60..a3f6f63 100644
--- a/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger-ui/script-formatter-breakpoints-3-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger-ui/script-formatter-breakpoints-3-expected.txt

@@ -8,6 +8,6 @@
 Breakpoint sidebar pane while paused in pretty printed
 unformatted3.js:formatted:4    var c = 3;
 Breakpoint sidebar pane while paused in raw
-No breakpoints
+unformatted3.js:3    var a=0;var b=1;var c=3;var d=4;var e=5;
 Script execution resumed.
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger/live-edit-breakpoints.js b/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger/live-edit-breakpoints.js
index 476a979c..97c6ad15 100644
--- a/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger/live-edit-breakpoints.js
+++ b/third_party/WebKit/LayoutTests/http/tests/devtools/sources/debugger/live-edit-breakpoints.js

@@ -38,7 +38,7 @@
     TestRunner.addResult('    Dumping breakpoints');
     for (var i = 0; i < breakpoints.length; ++i) {
       var breakpoint = breakpoints[i];
-      var uiSourceCode = breakpoint._primaryUISourceCode;
+      var uiSourceCode = breakpoint._defaultUILocation.uiSourceCode;
       var lineNumber = breakpoint.lineNumber();
       var url = uiSourceCode.url();
       var project = uiSourceCode.project();

diff --git a/third_party/blink/public/platform/OWNERS b/third_party/blink/public/platform/OWNERS
index 1c3eff2..65e1bbf 100644
--- a/third_party/blink/public/platform/OWNERS
+++ b/third_party/blink/public/platform/OWNERS

@@ -13,4 +13,4 @@
 per-file *.typemap=file://ipc/SECURITY_OWNERS
 
 per-file web_rtc_*=hbos@chromium.org
-per-file web_media_player_*=mlamouri@chromium.org
+per-file web_media_player*=mlamouri@chromium.org

diff --git a/third_party/blink/public/platform/web_scoped_virtual_time_pauser.h b/third_party/blink/public/platform/web_scoped_virtual_time_pauser.h
index 9649ff8f..13ba101 100644
--- a/third_party/blink/public/platform/web_scoped_virtual_time_pauser.h
+++ b/third_party/blink/public/platform/web_scoped_virtual_time_pauser.h

@@ -14,8 +14,13 @@
 class MainThreadSchedulerImpl;
 }  // namespace scheduler
 
-// A move only RAII style helper which makes it easier for subsystems to pause
-// virtual time while performing an asynchronous operation.
+// VirtualTime is a headless feature which is intended to make renders (more)
+// deterministic by pausing task execution in the Blink main thread (and pausing
+// the clock) while certain asynchronous operations are pending, e.g. fetching
+// resources. Generally new instances of WebScopedVirtualTimePauser should only
+// be added if there are determinism problems with renders on certain pages.
+// The WebScopedVirtualTimePauser itself is a move only RAII style helper which
+// makes it easier for subsystems to robustly pause and unpause virtual time.
 class BLINK_PLATFORM_EXPORT WebScopedVirtualTimePauser {
  public:
   enum class VirtualTaskDuration {
@@ -25,6 +30,11 @@
 
   // Note simply creating a WebScopedVirtualTimePauser doesn't cause VirtualTime
   // to pause, instead you need to call PauseVirtualTime.
+  // By default VirtualTaskDuration::kInstant should be used unless there is a
+  // risk of virtual time getting stalled (e.g. if a page requests a
+  // non-existent resource and it has an error handler which always fetches
+  // another non-existent resource, then there is a risk that virtual time will
+  // be blocked forever unless we use VirtualTaskDuration::kNonInstant).
   WebScopedVirtualTimePauser(scheduler::MainThreadSchedulerImpl*,
                              VirtualTaskDuration,
                              const WebString& debug_name);

diff --git a/third_party/blink/renderer/core/dom/container_node.cc b/third_party/blink/renderer/core/dom/container_node.cc
index 31d76e8..ed1c608 100644
--- a/third_party/blink/renderer/core/dom/container_node.cc
+++ b/third_party/blink/renderer/core/dom/container_node.cc

@@ -927,7 +927,7 @@
     if (!isConnected() && !IsInShadowTree() && !node.IsContainerNode())
       continue;
     if (Node::kInsertionShouldCallDidNotifySubtreeInsertions ==
-        node.InsertedInto(this))
+        node.InsertedInto(*this))
       post_insertion_notification_targets.push_back(&node);
     if (ShadowRoot* shadow_root = node.GetShadowRoot())
       NotifyNodeInsertedInternal(*shadow_root,
@@ -945,7 +945,7 @@
     // since the virtual call to removedFrom is not needed.
     if (!node.IsContainerNode() && !node.IsInTreeScope())
       continue;
-    node.RemovedFrom(this);
+    node.RemovedFrom(*this);
     if (ShadowRoot* shadow_root = node.GetShadowRoot())
       NotifyNodeRemoved(*shadow_root);
   }

diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index 3a0745f..926ee03 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc

@@ -3509,7 +3509,7 @@
   beforeunload_histogram.CountMicroseconds(beforeunload_event_end -
                                            beforeunload_event_start);
   if (!before_unload_event.defaultPrevented())
-    DefaultEventHandler(&before_unload_event);
+    DefaultEventHandler(before_unload_event);
 
   enum BeforeUnloadDialogHistogramEnum {
     kNoDialogNoText,

diff --git a/third_party/blink/renderer/core/dom/document_type.cc b/third_party/blink/renderer/core/dom/document_type.cc
index 8055096..e28838c6 100644
--- a/third_party/blink/renderer/core/dom/document_type.cc
+++ b/third_party/blink/renderer/core/dom/document_type.cc

@@ -49,7 +49,7 @@
 }
 
 Node::InsertionNotificationRequest DocumentType::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   Node::InsertedInto(insertion_point);
 
   // DocumentType can only be inserted into a Document.
@@ -60,7 +60,7 @@
   return kInsertionDone;
 }
 
-void DocumentType::RemovedFrom(ContainerNode* insertion_point) {
+void DocumentType::RemovedFrom(ContainerNode& insertion_point) {
   GetDocument().SetDoctype(nullptr);
   Node::RemovedFrom(insertion_point);
 }

diff --git a/third_party/blink/renderer/core/dom/document_type.h b/third_party/blink/renderer/core/dom/document_type.h
index 229d945..4c8a073 100644
--- a/third_party/blink/renderer/core/dom/document_type.h
+++ b/third_party/blink/renderer/core/dom/document_type.h

@@ -53,8 +53,8 @@
   NodeType getNodeType() const override;
   Node* Clone(Document&, CloneChildrenFlag) const override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   String name_;
   String public_id_;

diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index fd342e4..7738e64 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc

@@ -1475,12 +1475,12 @@
       StyleChangeReasonForTracing::Create(StyleChangeReason::kInvisibleChange));
 }
 
-void Element::DefaultEventHandler(Event* event) {
+void Element::DefaultEventHandler(Event& event) {
   if (RuntimeEnabledFeatures::InvisibleDOMEnabled() &&
-      event->type() == EventTypeNames::activateinvisible &&
-      event->target() == this) {
+      event.type() == EventTypeNames::activateinvisible &&
+      event.target() == this) {
     removeAttribute(invisibleAttr);
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
     return;
   }
   ContainerNode::DefaultEventHandler(event);
@@ -2009,14 +2009,14 @@
 }
 
 Node::InsertionNotificationRequest Element::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   // need to do superclass processing first so isConnected() is true
   // by the time we reach updateId
   ContainerNode::InsertedInto(insertion_point);
 
   DCHECK(!HasRareData() || !GetElementRareData()->HasPseudoElements());
 
-  if (!insertion_point->IsInTreeScope())
+  if (!insertion_point.IsInTreeScope())
     return kInsertionDone;
 
   if (HasRareData()) {
@@ -2035,7 +2035,7 @@
       CustomElement::TryToUpgrade(this);
   }
 
-  TreeScope& scope = insertion_point->GetTreeScope();
+  TreeScope& scope = insertion_point.GetTreeScope();
   if (scope != GetTreeScope())
     return kInsertionDone;
 
@@ -2053,8 +2053,8 @@
   return kInsertionDone;
 }
 
-void Element::RemovedFrom(ContainerNode* insertion_point) {
-  bool was_in_document = insertion_point->isConnected();
+void Element::RemovedFrom(ContainerNode& insertion_point) {
+  bool was_in_document = insertion_point.isConnected();
   if (HasRareData()) {
     // If we detached the layout tree with LazyReattachIfAttached, we might not
     // have cleared the pseudo elements if we remove the element before calling
@@ -2066,10 +2066,10 @@
 
   if (Fullscreen::IsFullscreenElement(*this)) {
     SetContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(false);
-    if (insertion_point->IsElementNode()) {
-      ToElement(insertion_point)->SetContainsFullScreenElement(false);
+    if (insertion_point.IsElementNode()) {
+      ToElement(insertion_point).SetContainsFullScreenElement(false);
       ToElement(insertion_point)
-          ->SetContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(
+          .SetContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(
               false);
     }
   }
@@ -2079,10 +2079,10 @@
 
   SetSavedLayerScrollOffset(ScrollOffset());
 
-  if (insertion_point->IsInTreeScope() && GetTreeScope() == GetDocument()) {
+  if (insertion_point.IsInTreeScope() && GetTreeScope() == GetDocument()) {
     const AtomicString& id_value = GetIdAttribute();
     if (!id_value.IsNull())
-      UpdateId(insertion_point->GetTreeScope(), id_value, g_null_atom);
+      UpdateId(insertion_point.GetTreeScope(), id_value, g_null_atom);
 
     const AtomicString& name_value = GetNameAttribute();
     if (!name_value.IsNull())
@@ -2097,7 +2097,7 @@
     if (GetCustomElementState() == CustomElementState::kCustom)
       CustomElement::EnqueueDisconnectedCallback(this);
     else if (IsUpgradedV0CustomElement())
-      V0CustomElement::DidDetach(this, insertion_point->GetDocument());
+      V0CustomElement::DidDetach(this, insertion_point.GetDocument());
 
     if (NeedsStyleInvalidation()) {
       GetDocument()
@@ -2672,7 +2672,7 @@
     shadow_root->SetNeedsDistributionRecalc();
   }
 
-  shadow_root->InsertedInto(this);
+  shadow_root->InsertedInto(*this);
   SetChildNeedsStyleRecalc();
   SetNeedsStyleRecalc(kSubtreeStyleChange, StyleChangeReasonForTracing::Create(
                                                StyleChangeReason::kShadow));
@@ -4105,7 +4105,7 @@
 
   PseudoElement* pseudo_element = PseudoElement::Create(this, pseudo_id);
   EnsureElementRareData().SetPseudoElement(pseudo_id, pseudo_element);
-  pseudo_element->InsertedInto(this);
+  pseudo_element->InsertedInto(*this);
 
   scoped_refptr<ComputedStyle> pseudo_style =
       pseudo_element->StyleForLayoutObject();
@@ -4732,37 +4732,37 @@
 }
 
 Node::InsertionNotificationRequest Node::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   DCHECK(!ChildNeedsStyleInvalidation());
   DCHECK(!NeedsStyleInvalidation());
-  DCHECK(insertion_point->isConnected() || insertion_point->IsInShadowTree() ||
+  DCHECK(insertion_point.isConnected() || insertion_point.IsInShadowTree() ||
          IsContainerNode());
-  if (insertion_point->isConnected()) {
+  if (insertion_point.isConnected()) {
     SetFlag(kIsConnectedFlag);
-    insertion_point->GetDocument().IncrementNodeCount();
+    insertion_point.GetDocument().IncrementNodeCount();
   }
   if (ParentOrShadowHostNode()->IsInShadowTree())
     SetFlag(kIsInShadowTreeFlag);
   if (ChildNeedsDistributionRecalc() &&
-      !insertion_point->ChildNeedsDistributionRecalc())
-    insertion_point->MarkAncestorsWithChildNeedsDistributionRecalc();
+      !insertion_point.ChildNeedsDistributionRecalc())
+    insertion_point.MarkAncestorsWithChildNeedsDistributionRecalc();
   if (AXObjectCache* cache = GetDocument().ExistingAXObjectCache())
-    cache->ChildrenChanged(insertion_point);
+    cache->ChildrenChanged(&insertion_point);
   return kInsertionDone;
 }
 
-void Node::RemovedFrom(ContainerNode* insertion_point) {
-  DCHECK(insertion_point->isConnected() || IsContainerNode() ||
+void Node::RemovedFrom(ContainerNode& insertion_point) {
+  DCHECK(insertion_point.isConnected() || IsContainerNode() ||
          IsInShadowTree());
-  if (insertion_point->isConnected()) {
+  if (insertion_point.isConnected()) {
     ClearFlag(kIsConnectedFlag);
-    insertion_point->GetDocument().DecrementNodeCount();
+    insertion_point.GetDocument().DecrementNodeCount();
   }
   if (IsInShadowTree() && !ContainingTreeScope().RootNode().IsShadowRoot())
     ClearFlag(kIsInShadowTreeFlag);
   if (AXObjectCache* cache = GetDocument().ExistingAXObjectCache()) {
     cache->Remove(this);
-    cache->ChildrenChanged(insertion_point);
+    cache->ChildrenChanged(&insertion_point);
   }
 }
 

diff --git a/third_party/blink/renderer/core/dom/element.h b/third_party/blink/renderer/core/dom/element.h
index 04a6b0b..049099e 100644
--- a/third_party/blink/renderer/core/dom/element.h
+++ b/third_party/blink/renderer/core/dom/element.h

@@ -320,7 +320,7 @@
   void setInvisible(const AtomicString&);
   void DispatchActivateInvisibleEventIfNeeded();
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   void DidMoveToNewDocument(Document&) override;
 
@@ -906,8 +906,8 @@
                                                CSSPropertyID,
                                                const CSSValue&);
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
   virtual void WillRecalcStyle(StyleRecalcChange);

diff --git a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
index 83fe71a8..637f3ee 100644
--- a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
+++ b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc

@@ -324,7 +324,7 @@
     // Non-bubbling events call only one default event handler, the one for the
     // target.
     node_->WillCallDefaultEventHandler(*event_);
-    node_->DefaultEventHandler(event_.Get());
+    node_->DefaultEventHandler(*event_);
     DCHECK(!event_->defaultPrevented());
     // For bubbling events, call default event handlers on the same targets in
     // the same order as the bubbling phase.
@@ -333,7 +333,7 @@
       for (size_t i = 1; i < size; ++i) {
         event_->GetEventPath()[i].GetNode()->WillCallDefaultEventHandler(
             *event_);
-        event_->GetEventPath()[i].GetNode()->DefaultEventHandler(event_.Get());
+        event_->GetEventPath()[i].GetNode()->DefaultEventHandler(*event_);
         DCHECK(!event_->defaultPrevented());
         if (event_->DefaultHandled())
           break;

diff --git a/third_party/blink/renderer/core/dom/node.cc b/third_party/blink/renderer/core/dom/node.cc
index f8d37659..3d02e7f 100644
--- a/third_party/blink/renderer/core/dom/node.cc
+++ b/third_party/blink/renderer/core/dom/node.cc

@@ -2398,39 +2398,40 @@
   DispatchScopedEvent(*Event::CreateBubble(EventTypeNames::input));
 }
 
-void Node::DefaultEventHandler(Event* event) {
-  if (event->target() != this)
+void Node::DefaultEventHandler(Event& event) {
+  if (event.target() != this)
     return;
-  const AtomicString& event_type = event->type();
+  const AtomicString& event_type = event.type();
   if (event_type == EventTypeNames::keydown ||
       event_type == EventTypeNames::keypress) {
-    if (event->IsKeyboardEvent()) {
-      if (LocalFrame* frame = GetDocument().GetFrame())
+    if (event.IsKeyboardEvent()) {
+      if (LocalFrame* frame = GetDocument().GetFrame()) {
         frame->GetEventHandler().DefaultKeyboardEventHandler(
-            ToKeyboardEvent(event));
+            ToKeyboardEvent(&event));
+      }
     }
   } else if (event_type == EventTypeNames::click) {
-    int detail =
-        event->IsUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
-    if (DispatchDOMActivateEvent(detail, *event) !=
+    int detail = event.IsUIEvent() ? ToUIEvent(event).detail() : 0;
+    if (DispatchDOMActivateEvent(detail, event) !=
         DispatchEventResult::kNotCanceled)
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
   } else if (event_type == EventTypeNames::contextmenu &&
-             event->IsMouseEvent()) {
+             event.IsMouseEvent()) {
     if (Page* page = GetDocument().GetPage()) {
       page->GetContextMenuController().HandleContextMenuEvent(
-          ToMouseEvent(event));
+          ToMouseEvent(&event));
     }
   } else if (event_type == EventTypeNames::textInput) {
-    if (event->HasInterface(EventNames::TextEvent)) {
-      if (LocalFrame* frame = GetDocument().GetFrame())
+    if (event.HasInterface(EventNames::TextEvent)) {
+      if (LocalFrame* frame = GetDocument().GetFrame()) {
         frame->GetEventHandler().DefaultTextInputEventHandler(
-            ToTextEvent(event));
+            ToTextEvent(&event));
+      }
     }
   } else if (RuntimeEnabledFeatures::MiddleClickAutoscrollEnabled() &&
-             event_type == EventTypeNames::mousedown && event->IsMouseEvent()) {
-    MouseEvent* mouse_event = ToMouseEvent(event);
-    if (mouse_event->button() ==
+             event_type == EventTypeNames::mousedown && event.IsMouseEvent()) {
+    auto& mouse_event = ToMouseEvent(event);
+    if (mouse_event.button() ==
         static_cast<short>(WebPointerProperties::Button::kMiddle)) {
       if (EnclosingLinkEventParentOrSelf())
         return;
@@ -2459,19 +2460,19 @@
           frame->GetEventHandler().StartMiddleClickAutoscroll(layout_object);
       }
     }
-  } else if (event_type == EventTypeNames::mouseup && event->IsMouseEvent()) {
-    MouseEvent* mouse_event = ToMouseEvent(event);
-    if (mouse_event->button() ==
+  } else if (event_type == EventTypeNames::mouseup && event.IsMouseEvent()) {
+    auto& mouse_event = ToMouseEvent(event);
+    if (mouse_event.button() ==
         static_cast<short>(WebPointerProperties::Button::kBack)) {
       if (LocalFrame* frame = GetDocument().GetFrame()) {
         if (frame->Client()->NavigateBackForward(-1))
-          event->SetDefaultHandled();
+          event.SetDefaultHandled();
       }
-    } else if (mouse_event->button() ==
+    } else if (mouse_event.button() ==
                static_cast<short>(WebPointerProperties::Button::kForward)) {
       if (LocalFrame* frame = GetDocument().GetFrame()) {
         if (frame->Client()->NavigateBackForward(1))
-          event->SetDefaultHandled();
+          event.SetDefaultHandled();
       }
     }
   }

diff --git a/third_party/blink/renderer/core/dom/node.h b/third_party/blink/renderer/core/dom/node.h
index 1e2b4d7..65dbad0 100644
--- a/third_party/blink/renderer/core/dom/node.h
+++ b/third_party/blink/renderer/core/dom/node.h

@@ -712,7 +712,7 @@
   };
 
   virtual InsertionNotificationRequest InsertedInto(
-      ContainerNode* insertion_point);
+      ContainerNode& insertion_point);
   virtual void DidNotifySubtreeInsertionsToDocument() {}
 
   // Notifies the node that it is no longer part of the tree.
@@ -721,7 +721,7 @@
   // DOMNodeRemovedFromDocument DOM event, but does not require the overhead of
   // event dispatching, and is called _after_ the node is removed from the tree.
   //
-  virtual void RemovedFrom(ContainerNode* insertion_point);
+  virtual void RemovedFrom(ContainerNode& insertion_point);
 
   // FIXME(dominicc): This method is not debug-only--it is used by
   // Tracing--rename it to something indicative.
@@ -798,7 +798,7 @@
   void DispatchInputEvent();
 
   // Perform the default action for an event.
-  virtual void DefaultEventHandler(Event*);
+  virtual void DefaultEventHandler(Event&);
   virtual void WillCallDefaultEventHandler(const Event&);
   // Should return true if this Node has activation behavior.
   // https://dom.spec.whatwg.org/#eventtarget-activation-behavior

diff --git a/third_party/blink/renderer/core/dom/processing_instruction.cc b/third_party/blink/renderer/core/dom/processing_instruction.cc
index 2886f7b9..c20295e 100644
--- a/third_party/blink/renderer/core/dom/processing_instruction.cc
+++ b/third_party/blink/renderer/core/dom/processing_instruction.cc

@@ -236,9 +236,9 @@
 }
 
 Node::InsertionNotificationRequest ProcessingInstruction::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   CharacterData::InsertedInto(insertion_point);
-  if (!insertion_point->isConnected())
+  if (!insertion_point.isConnected())
     return kInsertionDone;
 
   String href;
@@ -252,16 +252,16 @@
   return kInsertionDone;
 }
 
-void ProcessingInstruction::RemovedFrom(ContainerNode* insertion_point) {
+void ProcessingInstruction::RemovedFrom(ContainerNode& insertion_point) {
   CharacterData::RemovedFrom(insertion_point);
-  if (!insertion_point->isConnected())
+  if (!insertion_point.isConnected())
     return;
 
   // No need to remove XSLStyleSheet from StyleEngine.
   if (!DocumentXSLT::ProcessingInstructionRemovedFromDocument(GetDocument(),
                                                               this)) {
     GetDocument().GetStyleEngine().RemoveStyleSheetCandidateNode(
-        *this, *insertion_point);
+        *this, insertion_point);
   }
 
   if (sheet_) {

diff --git a/third_party/blink/renderer/core/dom/processing_instruction.h b/third_party/blink/renderer/core/dom/processing_instruction.h
index 04f6a63..32b9bf7 100644
--- a/third_party/blink/renderer/core/dom/processing_instruction.h
+++ b/third_party/blink/renderer/core/dom/processing_instruction.h

@@ -78,8 +78,8 @@
   NodeType getNodeType() const override;
   Node* Clone(Document&, CloneChildrenFlag) const override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   bool CheckStyleSheet(String& href, String& charset);
   void Process(const String& href, const String& charset);

diff --git a/third_party/blink/renderer/core/dom/pseudo_element.cc b/third_party/blink/renderer/core/dom/pseudo_element.cc
index ac5aae97..c4b5eae 100644
--- a/third_party/blink/renderer/core/dom/pseudo_element.cc
+++ b/third_party/blink/renderer/core/dom/pseudo_element.cc

@@ -142,7 +142,7 @@
   Element* parent = ParentOrShadowHostElement();
   GetDocument().AdoptIfNeeded(*this);
   SetParentOrShadowHostNode(nullptr);
-  RemovedFrom(parent);
+  RemovedFrom(*parent);
 }
 
 void PseudoElement::AttachLayoutTree(AttachContext& context) {

diff --git a/third_party/blink/renderer/core/dom/shadow_root.cc b/third_party/blink/renderer/core/dom/shadow_root.cc
index 29030e5b..d2e0450 100644
--- a/third_party/blink/renderer/core/dom/shadow_root.cc
+++ b/third_party/blink/renderer/core/dom/shadow_root.cc

@@ -182,10 +182,10 @@
 }
 
 Node::InsertionNotificationRequest ShadowRoot::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   DocumentFragment::InsertedInto(insertion_point);
 
-  if (!insertion_point->isConnected())
+  if (!insertion_point.isConnected())
     return kInsertionDone;
 
   if (RuntimeEnabledFeatures::IncrementalShadowDOMEnabled())
@@ -207,15 +207,15 @@
   return kInsertionDone;
 }
 
-void ShadowRoot::RemovedFrom(ContainerNode* insertion_point) {
-  if (insertion_point->isConnected()) {
+void ShadowRoot::RemovedFrom(ContainerNode& insertion_point) {
+  if (insertion_point.isConnected()) {
     if (NeedsSlotAssignmentRecalc())
       GetDocument().GetSlotAssignmentEngine().Disconnected(*this);
     GetDocument().GetStyleEngine().ShadowRootRemovedFromDocument(this);
     if (registered_with_parent_shadow_root_) {
       ShadowRoot* root = host().ContainingShadowRoot();
       if (!root)
-        root = insertion_point->ContainingShadowRoot();
+        root = insertion_point.ContainingShadowRoot();
       if (root)
         root->RemoveChildShadowRoot();
       registered_with_parent_shadow_root_ = false;

diff --git a/third_party/blink/renderer/core/dom/shadow_root.h b/third_party/blink/renderer/core/dom/shadow_root.h
index 705e9e1..df9d201 100644
--- a/third_party/blink/renderer/core/dom/shadow_root.h
+++ b/third_party/blink/renderer/core/dom/shadow_root.h

@@ -108,8 +108,8 @@
   void AttachLayoutTree(AttachContext&) override;
   void DetachLayoutTree(const AttachContext& = AttachContext()) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void SetNeedsAssignmentRecalc();
   bool NeedsSlotAssignmentRecalc() const;

diff --git a/third_party/blink/renderer/core/dom/v0_insertion_point.cc b/third_party/blink/renderer/core/dom/v0_insertion_point.cc
index 60823c6..aef3967 100644
--- a/third_party/blink/renderer/core/dom/v0_insertion_point.cc
+++ b/third_party/blink/renderer/core/dom/v0_insertion_point.cc

@@ -219,7 +219,7 @@
 }
 
 Node::InsertionNotificationRequest V0InsertionPoint::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   if (ShadowRoot* root = ContainingShadowRoot()) {
     if (!root->IsV1()) {
@@ -227,7 +227,7 @@
             root->IsV1()))
         root->SetNeedsDistributionRecalc();
       if (CanBeActive() && !registered_with_shadow_root_ &&
-          insertion_point->GetTreeScope().RootNode() == root) {
+          insertion_point.GetTreeScope().RootNode() == root) {
         registered_with_shadow_root_ = true;
         root->V0().DidAddInsertionPoint(this);
         if (CanAffectSelector())
@@ -243,10 +243,10 @@
   return kInsertionDone;
 }
 
-void V0InsertionPoint::RemovedFrom(ContainerNode* insertion_point) {
+void V0InsertionPoint::RemovedFrom(ContainerNode& insertion_point) {
   ShadowRoot* root = ContainingShadowRoot();
   if (!root)
-    root = insertion_point->ContainingShadowRoot();
+    root = insertion_point.ContainingShadowRoot();
 
   if (root &&
       !(RuntimeEnabledFeatures::IncrementalShadowDOMEnabled() && root->IsV1()))
@@ -257,7 +257,7 @@
   ClearDistribution();
 
   if (registered_with_shadow_root_ &&
-      insertion_point->GetTreeScope().RootNode() == root) {
+      insertion_point.GetTreeScope().RootNode() == root) {
     DCHECK(root);
     registered_with_shadow_root_ = false;
     root->V0().DidRemoveInsertionPoint(this);

diff --git a/third_party/blink/renderer/core/dom/v0_insertion_point.h b/third_party/blink/renderer/core/dom/v0_insertion_point.h
index 2238936..fde33dc5 100644
--- a/third_party/blink/renderer/core/dom/v0_insertion_point.h
+++ b/third_party/blink/renderer/core/dom/v0_insertion_point.h

@@ -81,8 +81,8 @@
   V0InsertionPoint(const QualifiedName&, Document&);
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
   void ChildrenChanged(const ChildrenChange&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void DidRecalcStyle(StyleRecalcChange) override;
 
  private:

diff --git a/third_party/blink/renderer/core/events/ui_event.h b/third_party/blink/renderer/core/events/ui_event.h
index 798939f..e8dd2c9 100644
--- a/third_party/blink/renderer/core/events/ui_event.h
+++ b/third_party/blink/renderer/core/events/ui_event.h

@@ -95,6 +95,8 @@
   Member<InputDeviceCapabilities> source_capabilities_;
 };
 
+DEFINE_EVENT_TYPE_CASTS(UIEvent);
+
 }  // namespace blink
 
 #endif  // THIRD_PARTY_BLINK_RENDERER_CORE_EVENTS_UI_EVENT_H_

diff --git a/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc b/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc
index adfa7f62..7fae5e4 100644
--- a/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc

@@ -268,7 +268,7 @@
   // true/false and HTMLPluginElement called SetDefaultHandled or
   // DefaultEventHandler.
   if (!event->DefaultHandled())
-    element_->Node::DefaultEventHandler(event);
+    element_->Node::DefaultEventHandler(*event);
 }
 
 void WebPluginContainerImpl::FrameRectsChanged() {

diff --git a/third_party/blink/renderer/core/frame/deprecation.cc b/third_party/blink/renderer/core/frame/deprecation.cc
index 0b8d442..1f6c44de9 100644
--- a/third_party/blink/renderer/core/frame/deprecation.cc
+++ b/third_party/blink/renderer/core/frame/deprecation.cc

@@ -585,6 +585,12 @@
               "The Native Client Pepper WebSocket API is deprecated and will "
               "be disabled in M74, mid-2019"};
 
+    case WebFeature::kServiceWorkerImportScriptNotInstalled:
+      return {"ServiceWorkerImportScriptNotInstalled", kM71,
+              WillBeRemoved("importScripts() of new scripts after service "
+                            "worker installation",
+                            kM71, "5748516353736704")};
+
     // Features that aren't deprecated don't have a deprecation message.
     default:
       return {"NotDeprecated", kUnknown, ""};

diff --git a/third_party/blink/renderer/core/frame/local_frame_view.cc b/third_party/blink/renderer/core/frame/local_frame_view.cc
index 38215ec..84e006f9 100644
--- a/third_party/blink/renderer/core/frame/local_frame_view.cc
+++ b/third_party/blink/renderer/core/frame/local_frame_view.cc

@@ -2774,17 +2774,7 @@
   layer->PaintRecursively();
 
 #if DCHECK_IS_ON()
-  if (VLOG_IS_ON(2)) {
-    DEFINE_STATIC_LOCAL(String, s_previous_tree, ());
-    LayerTreeFlags flags = VLOG_IS_ON(3) ? 0xffffffff : kOutputAsLayerTree;
-    String new_tree = GraphicsLayerTreeAsTextForTesting(layer, flags);
-    if (new_tree != s_previous_tree) {
-      VLOG(2) << "After GraphicsLayer::PaintRecursively()\n"
-              << "GraphicsLayer tree:\n"
-              << new_tree.Utf8().data();
-      s_previous_tree = new_tree;
-    }
-  }
+  VerboseLogGraphicsLayerTree(layer);
 #endif
 }
 

diff --git a/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc b/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
index 3e8eb51..9a43096 100644
--- a/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
+++ b/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc

@@ -187,7 +187,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLCanvasElement::InsertedInto(
-    ContainerNode* node) {
+    ContainerNode& node) {
   SetIsInCanvasSubtree(true);
   return HTMLElement::InsertedInto(node);
 }

diff --git a/third_party/blink/renderer/core/html/canvas/html_canvas_element.h b/third_party/blink/renderer/core/html/canvas/html_canvas_element.h
index 83ea0e45..064d390 100644
--- a/third_party/blink/renderer/core/html/canvas/html_canvas_element.h
+++ b/third_party/blink/renderer/core/html/canvas/html_canvas_element.h

@@ -172,7 +172,7 @@
 
   const AtomicString ImageSourceURL() const override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
 
   bool IsDirty() { return !dirty_rect_.IsEmpty(); }
 

diff --git a/third_party/blink/renderer/core/html/forms/clear_button_element.cc b/third_party/blink/renderer/core/html/forms/clear_button_element.cc
index 7e92b7e..6321006 100644
--- a/third_party/blink/renderer/core/html/forms/clear_button_element.cc
+++ b/third_party/blink/renderer/core/html/forms/clear_button_element.cc

@@ -54,28 +54,28 @@
   HTMLDivElement::DetachLayoutTree(context);
 }
 
-void ClearButtonElement::DefaultEventHandler(Event* event) {
+void ClearButtonElement::DefaultEventHandler(Event& event) {
   if (!clear_button_owner_) {
-    if (!event->DefaultHandled())
+    if (!event.DefaultHandled())
       HTMLDivElement::DefaultEventHandler(event);
     return;
   }
 
   if (!clear_button_owner_->ShouldClearButtonRespondToMouseEvents()) {
-    if (!event->DefaultHandled())
+    if (!event.DefaultHandled())
       HTMLDivElement::DefaultEventHandler(event);
     return;
   }
 
-  if (event->type() == EventTypeNames::click) {
+  if (event.type() == EventTypeNames::click) {
     if (GetLayoutObject() && GetLayoutObject()->VisibleToHitTesting()) {
       clear_button_owner_->FocusAndSelectClearButtonOwner();
       clear_button_owner_->ClearValue();
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
     }
   }
 
-  if (!event->DefaultHandled())
+  if (!event.DefaultHandled())
     HTMLDivElement::DefaultEventHandler(event);
 }
 

diff --git a/third_party/blink/renderer/core/html/forms/clear_button_element.h b/third_party/blink/renderer/core/html/forms/clear_button_element.h
index 4698422..6666122 100644
--- a/third_party/blink/renderer/core/html/forms/clear_button_element.h
+++ b/third_party/blink/renderer/core/html/forms/clear_button_element.h

@@ -50,7 +50,7 @@
   ClearButtonElement(Document&, ClearButtonOwner&);
   void DetachLayoutTree(const AttachContext& = AttachContext()) override;
   bool IsMouseFocusable() const override { return false; }
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool IsClearButtonElement() const override;
 
   Member<ClearButtonOwner> clear_button_owner_;

diff --git a/third_party/blink/renderer/core/html/forms/date_time_edit_element.cc b/third_party/blink/renderer/core/html/forms/date_time_edit_element.cc
index 584e53b..6499045e 100644
--- a/third_party/blink/renderer/core/html/forms/date_time_edit_element.cc
+++ b/third_party/blink/renderer/core/html/forms/date_time_edit_element.cc

@@ -785,12 +785,12 @@
   fields_.Shrink(0);
 }
 
-void DateTimeEditElement::DefaultEventHandler(Event* event) {
+void DateTimeEditElement::DefaultEventHandler(Event& event) {
   // In case of control owner forward event to control, e.g. DOM
   // dispatchEvent method.
   if (DateTimeFieldElement* field = FocusedField()) {
     field->DefaultEventHandler(event);
-    if (event->DefaultHandled())
+    if (event.DefaultHandled())
       return;
   }
 

diff --git a/third_party/blink/renderer/core/html/forms/date_time_edit_element.h b/third_party/blink/renderer/core/html/forms/date_time_edit_element.h
index 25f9175..c3e22542 100644
--- a/third_party/blink/renderer/core/html/forms/date_time_edit_element.h
+++ b/third_party/blink/renderer/core/html/forms/date_time_edit_element.h

@@ -90,7 +90,7 @@
   void AddField(DateTimeFieldElement*);
   bool AnyEditableFieldsHaveValues() const;
   void BlurByOwner();
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   void DisabledStateChanged();
   Element* FieldsWrapperElement() const;
   void FocusIfNoFocus();

diff --git a/third_party/blink/renderer/core/html/forms/date_time_field_element.cc b/third_party/blink/renderer/core/html/forms/date_time_field_element.cc
index 2e46e60..95b41d56 100644
--- a/third_party/blink/renderer/core/html/forms/date_time_field_element.cc
+++ b/third_party/blink/renderer/core/html/forms/date_time_field_element.cc

@@ -55,21 +55,21 @@
   return style.GetFont().Width(ConstructTextRun(style.GetFont(), text, style));
 }
 
-void DateTimeFieldElement::DefaultEventHandler(Event* event) {
-  if (event->IsKeyboardEvent()) {
-    KeyboardEvent* keyboard_event = ToKeyboardEvent(event);
+void DateTimeFieldElement::DefaultEventHandler(Event& event) {
+  if (event.IsKeyboardEvent()) {
+    auto& keyboard_event = ToKeyboardEvent(event);
     if (!IsDisabled() && !IsFieldOwnerDisabled() && !IsFieldOwnerReadOnly()) {
-      HandleKeyboardEvent(keyboard_event);
-      if (keyboard_event->DefaultHandled()) {
+      HandleKeyboardEvent(&keyboard_event);
+      if (keyboard_event.DefaultHandled()) {
         if (field_owner_)
           field_owner_->FieldDidChangeValueByKeyboard();
         return;
       }
     }
-    DefaultKeyboardEventHandler(keyboard_event);
+    DefaultKeyboardEventHandler(&keyboard_event);
     if (field_owner_)
       field_owner_->FieldDidChangeValueByKeyboard();
-    if (keyboard_event->DefaultHandled())
+    if (keyboard_event.DefaultHandled())
       return;
   }
 

diff --git a/third_party/blink/renderer/core/html/forms/date_time_field_element.h b/third_party/blink/renderer/core/html/forms/date_time_field_element.h
index f6cd41e..047c367 100644
--- a/third_party/blink/renderer/core/html/forms/date_time_field_element.h
+++ b/third_party/blink/renderer/core/html/forms/date_time_field_element.h

@@ -60,7 +60,7 @@
     virtual void FieldDidChangeValueByKeyboard() = 0;
   };
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   virtual bool HasValue() const = 0;
   bool IsDisabled() const;
   virtual float MaximumWidth(const ComputedStyle&);

diff --git a/third_party/blink/renderer/core/html/forms/html_button_element.cc b/third_party/blink/renderer/core/html/forms/html_button_element.cc
index 13ad5295..52fb02d 100644
--- a/third_party/blink/renderer/core/html/forms/html_button_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_button_element.cc

@@ -104,43 +104,42 @@
   }
 }
 
-void HTMLButtonElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::DOMActivate &&
-      !IsDisabledFormControl()) {
+void HTMLButtonElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::DOMActivate && !IsDisabledFormControl()) {
     if (Form() && type_ == SUBMIT) {
-      Form()->PrepareForSubmission(event, this);
-      event->SetDefaultHandled();
+      Form()->PrepareForSubmission(&event, this);
+      event.SetDefaultHandled();
     }
     if (Form() && type_ == RESET) {
       Form()->reset();
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
     }
   }
 
-  if (event->IsKeyboardEvent()) {
-    if (event->type() == EventTypeNames::keydown &&
-        ToKeyboardEvent(event)->key() == " ") {
+  if (event.IsKeyboardEvent()) {
+    if (event.type() == EventTypeNames::keydown &&
+        ToKeyboardEvent(event).key() == " ") {
       SetActive(true);
       // No setDefaultHandled() - IE dispatches a keypress in this case.
       return;
     }
-    if (event->type() == EventTypeNames::keypress) {
-      switch (ToKeyboardEvent(event)->charCode()) {
+    if (event.type() == EventTypeNames::keypress) {
+      switch (ToKeyboardEvent(event).charCode()) {
         case '\r':
-          DispatchSimulatedClick(event);
-          event->SetDefaultHandled();
+          DispatchSimulatedClick(&event);
+          event.SetDefaultHandled();
           return;
         case ' ':
           // Prevent scrolling down the page.
-          event->SetDefaultHandled();
+          event.SetDefaultHandled();
           return;
       }
     }
-    if (event->type() == EventTypeNames::keyup &&
-        ToKeyboardEvent(event)->key() == " ") {
+    if (event.type() == EventTypeNames::keyup &&
+        ToKeyboardEvent(event).key() == " ") {
       if (IsActive())
-        DispatchSimulatedClick(event);
-      event->SetDefaultHandled();
+        DispatchSimulatedClick(&event);
+      event.SetDefaultHandled();
       return;
     }
   }
@@ -211,7 +210,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLButtonElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   InsertionNotificationRequest request =
       HTMLFormControlElement::InsertedInto(insertion_point);
   LogAddElementIfIsolatedWorldAndInDocument("button", typeAttr, formmethodAttr,

diff --git a/third_party/blink/renderer/core/html/forms/html_button_element.h b/third_party/blink/renderer/core/html/forms/html_button_element.h
index 23da1df..240049a 100644
--- a/third_party/blink/renderer/core/html/forms/html_button_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_button_element.h

@@ -52,10 +52,10 @@
   // HTMLFormControlElement always creates one, but buttons don't need it.
   bool AlwaysCreateUserAgentShadowRoot() const override { return false; }
 
-  Node::InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  Node::InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void ParseAttribute(const AttributeModificationParams&) override;
   bool IsPresentationAttribute(const QualifiedName&) const override;
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool HasActivationBehavior() const override;
 
   void AppendToFormData(FormData&) override;

diff --git a/third_party/blink/renderer/core/html/forms/html_form_control_element.cc b/third_party/blink/renderer/core/html/forms/html_form_control_element.cc
index 5c641aa1..ff5255a7 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_control_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_form_control_element.cc

@@ -296,7 +296,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLFormControlElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   ancestor_disabled_state_ = kAncestorDisabledStateUnknown;
   // Force traversal to find ancestor
   may_have_field_set_ancestor_ = true;
@@ -304,17 +304,17 @@
   SetNeedsWillValidateCheck();
   HTMLElement::InsertedInto(insertion_point);
   ListedElement::InsertedInto(insertion_point);
-  FieldSetAncestorsSetNeedsValidityCheck(insertion_point);
+  FieldSetAncestorsSetNeedsValidityCheck(&insertion_point);
 
   // Trigger for elements outside of forms.
-  if (!formOwner() && insertion_point->isConnected())
+  if (!formOwner() && insertion_point.isConnected())
     GetDocument().DidAssociateFormControl(this);
 
   return kInsertionDone;
 }
 
-void HTMLFormControlElement::RemovedFrom(ContainerNode* insertion_point) {
-  FieldSetAncestorsSetNeedsValidityCheck(insertion_point);
+void HTMLFormControlElement::RemovedFrom(ContainerNode& insertion_point) {
+  FieldSetAncestorsSetNeedsValidityCheck(&insertion_point);
   HideVisibleValidationMessage();
   has_validation_message_ = false;
   ancestor_disabled_state_ = kAncestorDisabledStateUnknown;

diff --git a/third_party/blink/renderer/core/html/forms/html_form_control_element.h b/third_party/blink/renderer/core/html/forms/html_form_control_element.h
index a04b6f74..7245757ad 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_control_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_form_control_element.h

@@ -164,8 +164,8 @@
   virtual void RequiredAttributeChanged();
   virtual void DisabledAttributeChanged();
   void AttachLayoutTree(AttachContext&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void WillChangeForm() override;
   void DidChangeForm() override;
   void DidMoveToNewDocument(Document& old_document) override;

diff --git a/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.cc b/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.cc
index 430f7bc..0cae0aab 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.cc
+++ b/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.cc

@@ -40,16 +40,16 @@
 HTMLFormControlElementWithState::~HTMLFormControlElementWithState() = default;
 
 Node::InsertionNotificationRequest
-HTMLFormControlElementWithState::InsertedInto(ContainerNode* insertion_point) {
-  if (insertion_point->isConnected() && !ContainingShadowRoot())
+HTMLFormControlElementWithState::InsertedInto(ContainerNode& insertion_point) {
+  if (insertion_point.isConnected() && !ContainingShadowRoot())
     GetDocument().GetFormController().RegisterStatefulFormControl(*this);
   return HTMLFormControlElement::InsertedInto(insertion_point);
 }
 
 void HTMLFormControlElementWithState::RemovedFrom(
-    ContainerNode* insertion_point) {
-  if (insertion_point->isConnected() && !ContainingShadowRoot() &&
-      !insertion_point->ContainingShadowRoot())
+    ContainerNode& insertion_point) {
+  if (insertion_point.isConnected() && !ContainingShadowRoot() &&
+      !insertion_point.ContainingShadowRoot())
     GetDocument().GetFormController().UnregisterStatefulFormControl(*this);
   HTMLFormControlElement::RemovedFrom(insertion_point);
 }

diff --git a/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h b/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h
index 6ab06be5..c993384 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h
+++ b/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h

@@ -64,8 +64,8 @@
   HTMLFormControlElementWithState(const QualifiedName& tag_name, Document&);
 
   void FinishParsingChildren() override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   bool IsFormControlElementWithState() const final;
 
  private:

diff --git a/third_party/blink/renderer/core/html/forms/html_form_element.cc b/third_party/blink/renderer/core/html/forms/html_form_element.cc
index a8a475c..f3ccd38a 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_form_element.cc

@@ -105,10 +105,10 @@
 }
 
 Node::InsertionNotificationRequest HTMLFormElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   LogAddElementIfIsolatedWorldAndInDocument("form", methodAttr, actionAttr);
-  if (insertion_point->isConnected())
+  if (insertion_point.isConnected())
     GetDocument().DidAssociateFormControl(this);
   return kInsertionDone;
 }
@@ -119,7 +119,7 @@
     element->FormRemovedFromTree(root);
 }
 
-void HTMLFormElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLFormElement::RemovedFrom(ContainerNode& insertion_point) {
   // We don't need to take care of form association by 'form' content
   // attribute becuse IdTargetObserver handles it.
   if (has_elements_associated_by_parser_) {
@@ -130,7 +130,7 @@
     } else {
       ListedElement::List elements;
       CollectListedElements(
-          NodeTraversal::HighestAncestorOrSelf(*insertion_point), elements);
+          NodeTraversal::HighestAncestorOrSelf(insertion_point), elements);
       NotifyFormRemovedFromTree(elements, root);
       CollectListedElements(root, elements);
       NotifyFormRemovedFromTree(elements, root);
@@ -142,7 +142,7 @@
     } else {
       HeapVector<Member<HTMLImageElement>> images;
       CollectImageElements(
-          NodeTraversal::HighestAncestorOrSelf(*insertion_point), images);
+          NodeTraversal::HighestAncestorOrSelf(insertion_point), images);
       NotifyFormRemovedFromTree(images, root);
       CollectImageElements(root, images);
       NotifyFormRemovedFromTree(images, root);

diff --git a/third_party/blink/renderer/core/html/forms/html_form_element.h b/third_party/blink/renderer/core/html/forms/html_form_element.h
index 3b79057..1ba86c3 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_form_element.h

@@ -115,8 +115,8 @@
  private:
   explicit HTMLFormElement(Document&);
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void FinishParsingChildren() override;
 
   void HandleLocalEvents(Event&) override;

diff --git a/third_party/blink/renderer/core/html/forms/html_input_element.cc b/third_party/blink/renderer/core/html/forms/html_input_element.cc
index da1847a..deacd521 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_input_element.cc

@@ -1254,18 +1254,18 @@
                                      *static_cast<ClickHandlingState*>(state));
 }
 
-void HTMLInputElement::DefaultEventHandler(Event* evt) {
-  if (evt->IsMouseEvent() && evt->type() == EventTypeNames::click &&
-      ToMouseEvent(evt)->button() ==
+void HTMLInputElement::DefaultEventHandler(Event& evt) {
+  if (evt.IsMouseEvent() && evt.type() == EventTypeNames::click &&
+      ToMouseEvent(evt).button() ==
           static_cast<short>(WebPointerProperties::Button::kLeft)) {
-    input_type_view_->HandleClickEvent(ToMouseEvent(evt));
-    if (evt->DefaultHandled())
+    input_type_view_->HandleClickEvent(ToMouseEvent(&evt));
+    if (evt.DefaultHandled())
       return;
   }
 
-  if (evt->IsKeyboardEvent() && evt->type() == EventTypeNames::keydown) {
-    input_type_view_->HandleKeydownEvent(ToKeyboardEvent(evt));
-    if (evt->DefaultHandled())
+  if (evt.IsKeyboardEvent() && evt.type() == EventTypeNames::keydown) {
+    input_type_view_->HandleKeydownEvent(ToKeyboardEvent(&evt));
+    if (evt.DefaultHandled())
       return;
   }
 
@@ -1273,11 +1273,11 @@
   // all events in text fields.  Makes editing keyboard handling take precedence
   // over the keydown and keypress handling in this function.
   bool call_base_class_early =
-      IsTextField() && (evt->type() == EventTypeNames::keydown ||
-                        evt->type() == EventTypeNames::keypress);
+      IsTextField() && (evt.type() == EventTypeNames::keydown ||
+                        evt.type() == EventTypeNames::keypress);
   if (call_base_class_early) {
     TextControlElement::DefaultEventHandler(evt);
-    if (evt->DefaultHandled())
+    if (evt.DefaultHandled())
       return;
   }
 
@@ -1287,27 +1287,27 @@
   // the element, or presses enter while it is the active element. JavaScript
   // code wishing to activate the element must dispatch a DOMActivate event - a
   // click event will not do the job.
-  if (evt->type() == EventTypeNames::DOMActivate) {
-    input_type_view_->HandleDOMActivateEvent(evt);
-    if (evt->DefaultHandled())
+  if (evt.type() == EventTypeNames::DOMActivate) {
+    input_type_view_->HandleDOMActivateEvent(&evt);
+    if (evt.DefaultHandled())
       return;
   }
 
   // Use key press event here since sending simulated mouse events
   // on key down blocks the proper sending of the key press event.
-  if (evt->IsKeyboardEvent() && evt->type() == EventTypeNames::keypress) {
-    input_type_view_->HandleKeypressEvent(ToKeyboardEvent(evt));
-    if (evt->DefaultHandled())
+  if (evt.IsKeyboardEvent() && evt.type() == EventTypeNames::keypress) {
+    input_type_view_->HandleKeypressEvent(ToKeyboardEvent(&evt));
+    if (evt.DefaultHandled())
       return;
   }
 
-  if (evt->IsKeyboardEvent() && evt->type() == EventTypeNames::keyup) {
-    input_type_view_->HandleKeyupEvent(ToKeyboardEvent(evt));
-    if (evt->DefaultHandled())
+  if (evt.IsKeyboardEvent() && evt.type() == EventTypeNames::keyup) {
+    input_type_view_->HandleKeyupEvent(ToKeyboardEvent(&evt));
+    if (evt.DefaultHandled())
       return;
   }
 
-  if (input_type_view_->ShouldSubmitImplicitly(evt)) {
+  if (input_type_view_->ShouldSubmitImplicitly(&evt)) {
     // FIXME: Remove type check.
     if (type() == InputTypeNames::search) {
       GetDocument()
@@ -1324,27 +1324,27 @@
     // Form may never have been present, or may have been destroyed by code
     // responding to the change event.
     if (form_for_submission) {
-      form_for_submission->SubmitImplicitly(evt,
+      form_for_submission->SubmitImplicitly(&evt,
                                             CanTriggerImplicitSubmission());
     }
-    evt->SetDefaultHandled();
+    evt.SetDefaultHandled();
     return;
   }
 
-  if (evt->IsBeforeTextInsertedEvent()) {
+  if (evt.IsBeforeTextInsertedEvent()) {
     input_type_view_->HandleBeforeTextInsertedEvent(
-        static_cast<BeforeTextInsertedEvent*>(evt));
+        static_cast<BeforeTextInsertedEvent*>(&evt));
   }
 
-  if (evt->IsMouseEvent() && evt->type() == EventTypeNames::mousedown) {
-    input_type_view_->HandleMouseDownEvent(ToMouseEvent(evt));
-    if (evt->DefaultHandled())
+  if (evt.IsMouseEvent() && evt.type() == EventTypeNames::mousedown) {
+    input_type_view_->HandleMouseDownEvent(ToMouseEvent(&evt));
+    if (evt.DefaultHandled())
       return;
   }
 
-  input_type_view_->ForwardEvent(evt);
+  input_type_view_->ForwardEvent(&evt);
 
-  if (!call_base_class_early && !evt->DefaultHandled())
+  if (!call_base_class_early && !evt.DefaultHandled())
     TextControlElement::DefaultEventHandler(evt);
 }
 
@@ -1540,18 +1540,18 @@
 }
 
 Node::InsertionNotificationRequest HTMLInputElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   TextControlElement::InsertedInto(insertion_point);
-  if (insertion_point->isConnected() && !Form())
+  if (insertion_point.isConnected() && !Form())
     AddToRadioButtonGroup();
   ResetListAttributeTargetObserver();
   LogAddElementIfIsolatedWorldAndInDocument("input", typeAttr, formactionAttr);
   return kInsertionShouldCallDidNotifySubtreeInsertions;
 }
 
-void HTMLInputElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLInputElement::RemovedFrom(ContainerNode& insertion_point) {
   input_type_view_->ClosePopupView();
-  if (insertion_point->isConnected() && !Form())
+  if (insertion_point.isConnected() && !Form())
     RemoveFromRadioButtonGroup();
   TextControlElement::RemovedFrom(insertion_point);
   DCHECK(!isConnected());

diff --git a/third_party/blink/renderer/core/html/forms/html_input_element.h b/third_party/blink/renderer/core/html/forms/html_input_element.h
index d87939d..aedee8b 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_input_element.h

@@ -306,7 +306,7 @@
  protected:
   HTMLInputElement(Document&, const CreateElementFlags);
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   void CreateShadowSubtree();
 
  private:
@@ -314,8 +314,8 @@
 
   void WillChangeForm() final;
   void DidChangeForm() final;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) final;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) final;
   void DidMoveToNewDocument(Document& old_document) final;
   bool HasActivationBehavior() const override;
 

diff --git a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
index 83cdd18..ba604cf 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element_test.cc
+++ b/third_party/blink/renderer/core/html/forms/html_input_element_test.cc

@@ -160,7 +160,7 @@
   radio2.setAttribute(HTMLNames::styleAttr, "position:fixed");
   KeyboardEventInit init;
   init.setKey("ArrowRight");
-  radio1.DefaultEventHandler(new KeyboardEvent("keydown", init));
+  radio1.DefaultEventHandler(*new KeyboardEvent("keydown", init));
   EXPECT_EQ(GetDocument().ActiveElement(), &radio2);
 }
 

diff --git a/third_party/blink/renderer/core/html/forms/html_label_element.cc b/third_party/blink/renderer/core/html/forms/html_label_element.cc
index ea36f0b..8dcffb2b7 100644
--- a/third_party/blink/renderer/core/html/forms/html_label_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_label_element.cc

@@ -137,18 +137,18 @@
   return false;
 }
 
-void HTMLLabelElement::DefaultEventHandler(Event* evt) {
-  if (evt->type() == EventTypeNames::click && !processing_click_) {
+void HTMLLabelElement::DefaultEventHandler(Event& evt) {
+  if (evt.type() == EventTypeNames::click && !processing_click_) {
     HTMLElement* element = control();
 
     // If we can't find a control or if the control received the click
     // event, then there's no need for us to do anything.
     if (!element ||
-        (evt->target() && element->IsShadowIncludingInclusiveAncestorOf(
-                              evt->target()->ToNode())))
+        (evt.target() &&
+         element->IsShadowIncludingInclusiveAncestorOf(evt.target()->ToNode())))
       return;
 
-    if (evt->target() && IsInInteractiveContent(evt->target()->ToNode()))
+    if (evt.target() && IsInInteractiveContent(evt.target()->ToNode()))
       return;
 
     //   Behaviour of label element is as follows:
@@ -167,7 +167,7 @@
     // click event to control element.
     // Note: check if it is a MouseEvent because a click event may
     // not be an instance of a MouseEvent if created by document.createEvent().
-    if (evt->IsMouseEvent() && ToMouseEvent(evt)->HasPosition()) {
+    if (evt.IsMouseEvent() && ToMouseEvent(evt).HasPosition()) {
       if (LocalFrame* frame = GetDocument().GetFrame()) {
         // Check if there is a selection and click is not on the
         // selection.
@@ -178,7 +178,7 @@
             !frame->GetEventHandler()
                  .GetSelectionController()
                  .MouseDownWasSingleClickInSelection() &&
-            evt->target()->ToNode()->CanStartSelection())
+            evt.target()->ToNode()->CanStartSelection())
           is_label_text_selected = true;
         // If selection is there and is single click i.e. text is
         // selected by dragging over label text, then return.
@@ -186,7 +186,7 @@
         // should pass click event to control element.
         // Only in case of drag, *neither* we pass the click event,
         // *nor* we focus the control element.
-        if (is_label_text_selected && ToMouseEvent(evt)->ClickCount() == 1)
+        if (is_label_text_selected && ToMouseEvent(evt).ClickCount() == 1)
           return;
       }
     }
@@ -206,11 +206,11 @@
     }
 
     // Click the corresponding control.
-    element->DispatchSimulatedClick(evt);
+    element->DispatchSimulatedClick(&evt);
 
     processing_click_ = false;
 
-    evt->SetDefaultHandled();
+    evt.SetDefaultHandled();
   }
 
   HTMLElement::DefaultEventHandler(evt);

diff --git a/third_party/blink/renderer/core/html/forms/html_label_element.h b/third_party/blink/renderer/core/html/forms/html_label_element.h
index 9bfb7024..884851e 100644
--- a/third_party/blink/renderer/core/html/forms/html_label_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_label_element.h

@@ -53,7 +53,7 @@
   void SetHovered(bool = true) override;
 
   // Overridden to either click() or focus() the corresponding control.
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool HasActivationBehavior() const override;
 
   void focus(const FocusParams&) override;

diff --git a/third_party/blink/renderer/core/html/forms/html_opt_group_element.cc b/third_party/blink/renderer/core/html/forms/html_opt_group_element.cc
index 37bebed..873fe56 100644
--- a/third_party/blink/renderer/core/html/forms/html_opt_group_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_opt_group_element.cc

@@ -88,17 +88,17 @@
 }
 
 Node::InsertionNotificationRequest HTMLOptGroupElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   if (HTMLSelectElement* select = OwnerSelectElement()) {
-    if (insertion_point == select)
+    if (&insertion_point == select)
       select->OptGroupInsertedOrRemoved(*this);
   }
   return kInsertionDone;
 }
 
-void HTMLOptGroupElement::RemovedFrom(ContainerNode* insertion_point) {
-  if (auto* select = ToHTMLSelectElementOrNull(*insertion_point)) {
+void HTMLOptGroupElement::RemovedFrom(ContainerNode& insertion_point) {
+  if (auto* select = ToHTMLSelectElementOrNull(insertion_point)) {
     if (!parentNode())
       select->OptGroupInsertedOrRemoved(*this);
   }

diff --git a/third_party/blink/renderer/core/html/forms/html_opt_group_element.h b/third_party/blink/renderer/core/html/forms/html_opt_group_element.h
index 52cb07a..759d835 100644
--- a/third_party/blink/renderer/core/html/forms/html_opt_group_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_opt_group_element.h

@@ -57,8 +57,8 @@
   void AccessKeyAction(bool send_mouse_events) override;
   void DidAddUserAgentShadowRoot(ShadowRoot&) override;
   bool MatchesEnabledPseudoClass() const override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void UpdateGroupLabel();
 };

diff --git a/third_party/blink/renderer/core/html/forms/html_option_element.cc b/third_party/blink/renderer/core/html/forms/html_option_element.cc
index 09cc2e2..7ccac04 100644
--- a/third_party/blink/renderer/core/html/forms/html_option_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_option_element.cc

@@ -329,22 +329,22 @@
 }
 
 Node::InsertionNotificationRequest HTMLOptionElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   if (HTMLSelectElement* select = OwnerSelectElement()) {
-    if (insertion_point == select || (IsHTMLOptGroupElement(*insertion_point) &&
-                                      insertion_point->parentNode() == select))
+    if (&insertion_point == select || (IsHTMLOptGroupElement(insertion_point) &&
+                                       insertion_point.parentNode() == select))
       select->OptionInserted(*this, is_selected_);
   }
   return kInsertionDone;
 }
 
-void HTMLOptionElement::RemovedFrom(ContainerNode* insertion_point) {
-  if (auto* select = ToHTMLSelectElementOrNull(*insertion_point)) {
+void HTMLOptionElement::RemovedFrom(ContainerNode& insertion_point) {
+  if (auto* select = ToHTMLSelectElementOrNull(insertion_point)) {
     if (!parentNode() || IsHTMLOptGroupElement(*parentNode()))
       select->OptionRemoved(*this);
-  } else if (IsHTMLOptGroupElement(*insertion_point)) {
-    if (auto* select = ToHTMLSelectElementOrNull(insertion_point->parentNode()))
+  } else if (IsHTMLOptGroupElement(insertion_point)) {
+    if (auto* select = ToHTMLSelectElementOrNull(insertion_point.parentNode()))
       select->OptionRemoved(*this);
   }
   HTMLElement::RemovedFrom(insertion_point);

diff --git a/third_party/blink/renderer/core/html/forms/html_option_element.h b/third_party/blink/renderer/core/html/forms/html_option_element.h
index 22a3448..1232e25 100644
--- a/third_party/blink/renderer/core/html/forms/html_option_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_option_element.h

@@ -98,8 +98,8 @@
   bool MatchesDefaultPseudoClass() const override;
   bool MatchesEnabledPseudoClass() const override;
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void AccessKeyAction(bool) override;
   void ChildrenChanged(const ChildrenChange&) override;
   String innerText() override;

diff --git a/third_party/blink/renderer/core/html/forms/html_select_element.cc b/third_party/blink/renderer/core/html/forms/html_select_element.cc
index cda962b..fba7270 100644
--- a/third_party/blink/renderer/core/html/forms/html_select_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_select_element.cc

@@ -1701,12 +1701,12 @@
   }
 }
 
-void HTMLSelectElement::DefaultEventHandler(Event* event) {
+void HTMLSelectElement::DefaultEventHandler(Event& event) {
   if (!GetLayoutObject())
     return;
 
-  if (event->type() == EventTypeNames::click ||
-      event->type() == EventTypeNames::change) {
+  if (event.type() == EventTypeNames::click ||
+      event.type() == EventTypeNames::change) {
     user_has_edited_the_field_ = true;
   }
 
@@ -1716,19 +1716,19 @@
   }
 
   if (UsesMenuList())
-    MenuListDefaultEventHandler(event);
+    MenuListDefaultEventHandler(&event);
   else
-    ListBoxDefaultEventHandler(event);
-  if (event->DefaultHandled())
+    ListBoxDefaultEventHandler(&event);
+  if (event.DefaultHandled())
     return;
 
-  if (event->type() == EventTypeNames::keypress && event->IsKeyboardEvent()) {
-    KeyboardEvent* keyboard_event = ToKeyboardEvent(event);
-    if (!keyboard_event->ctrlKey() && !keyboard_event->altKey() &&
-        !keyboard_event->metaKey() &&
-        WTF::Unicode::IsPrintableChar(keyboard_event->charCode())) {
-      TypeAheadFind(keyboard_event);
-      event->SetDefaultHandled();
+  if (event.type() == EventTypeNames::keypress && event.IsKeyboardEvent()) {
+    auto& keyboard_event = ToKeyboardEvent(event);
+    if (!keyboard_event.ctrlKey() && !keyboard_event.altKey() &&
+        !keyboard_event.metaKey() &&
+        WTF::Unicode::IsPrintableChar(keyboard_event.charCode())) {
+      TypeAheadFind(&keyboard_event);
+      event.SetDefaultHandled();
       return;
     }
   }

diff --git a/third_party/blink/renderer/core/html/forms/html_select_element.h b/third_party/blink/renderer/core/html/forms/html_select_element.h
index 97dc043b..741c146c 100644
--- a/third_party/blink/renderer/core/html/forms/html_select_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_select_element.h

@@ -211,7 +211,7 @@
   void AppendToFormData(FormData&) override;
   void DidAddUserAgentShadowRoot(ShadowRoot&) override;
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   void DispatchInputAndChangeEventForMenuList();
 

diff --git a/third_party/blink/renderer/core/html/forms/html_text_area_element.cc b/third_party/blink/renderer/core/html/forms/html_text_area_element.cc
index 9dff47c..83ba11e 100644
--- a/third_party/blink/renderer/core/html/forms/html_text_area_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_text_area_element.cc

@@ -262,13 +262,15 @@
   }
 }
 
-void HTMLTextAreaElement::DefaultEventHandler(Event* event) {
-  if (GetLayoutObject() && (event->IsMouseEvent() || event->IsDragEvent() ||
-                            event->HasInterface(EventNames::WheelEvent) ||
-                            event->type() == EventTypeNames::blur))
-    ForwardEvent(event);
-  else if (GetLayoutObject() && event->IsBeforeTextInsertedEvent())
-    HandleBeforeTextInsertedEvent(static_cast<BeforeTextInsertedEvent*>(event));
+void HTMLTextAreaElement::DefaultEventHandler(Event& event) {
+  if (GetLayoutObject() && (event.IsMouseEvent() || event.IsDragEvent() ||
+                            event.HasInterface(EventNames::WheelEvent) ||
+                            event.type() == EventTypeNames::blur)) {
+    ForwardEvent(&event);
+  } else if (GetLayoutObject() && event.IsBeforeTextInsertedEvent()) {
+    HandleBeforeTextInsertedEvent(
+        static_cast<BeforeTextInsertedEvent*>(&event));
+  }
 
   TextControlElement::DefaultEventHandler(event);
 }

diff --git a/third_party/blink/renderer/core/html/forms/html_text_area_element.h b/third_party/blink/renderer/core/html/forms/html_text_area_element.h
index 20fc30c3..90d2379e 100644
--- a/third_party/blink/renderer/core/html/forms/html_text_area_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_text_area_element.h

@@ -95,7 +95,7 @@
   }
   bool IsRequiredFormControl() const override { return IsRequired(); }
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   void SubtreeHasChanged() override;
 

diff --git a/third_party/blink/renderer/core/html/forms/listed_element.cc b/third_party/blink/renderer/core/html/forms/listed_element.cc
index dee6e10f..ff7a94f 100644
--- a/third_party/blink/renderer/core/html/forms/listed_element.cc
+++ b/third_party/blink/renderer/core/html/forms/listed_element.cc

@@ -74,13 +74,13 @@
     SetFormAttributeTargetObserver(nullptr);
 }
 
-void ListedElement::InsertedInto(ContainerNode* insertion_point) {
+void ListedElement::InsertedInto(ContainerNode& insertion_point) {
   if (!form_was_set_by_parser_ || !form_ ||
-      NodeTraversal::HighestAncestorOrSelf(*insertion_point) !=
+      NodeTraversal::HighestAncestorOrSelf(insertion_point) !=
           NodeTraversal::HighestAncestorOrSelf(*form_.Get()))
     ResetFormOwner();
 
-  if (!insertion_point->isConnected())
+  if (!insertion_point.isConnected())
     return;
 
   HTMLElement* element = ToHTMLElement(this);
@@ -88,9 +88,9 @@
     ResetFormAttributeTargetObserver();
 }
 
-void ListedElement::RemovedFrom(ContainerNode* insertion_point) {
+void ListedElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLElement* element = ToHTMLElement(this);
-  if (insertion_point->isConnected() && element->FastHasAttribute(formAttr)) {
+  if (insertion_point.isConnected() && element->FastHasAttribute(formAttr)) {
     SetFormAttributeTargetObserver(nullptr);
     ResetFormOwner();
     return;

diff --git a/third_party/blink/renderer/core/html/forms/listed_element.h b/third_party/blink/renderer/core/html/forms/listed_element.h
index 891cb56..d7ba4cd 100644
--- a/third_party/blink/renderer/core/html/forms/listed_element.h
+++ b/third_party/blink/renderer/core/html/forms/listed_element.h

@@ -97,8 +97,8 @@
  protected:
   ListedElement();
 
-  void InsertedInto(ContainerNode*);
-  void RemovedFrom(ContainerNode*);
+  void InsertedInto(ContainerNode&);
+  void RemovedFrom(ContainerNode&);
   void DidMoveToNewDocument(Document& old_document);
 
   // FIXME: Remove usage of setForm. resetFormOwner should be enough, and

diff --git a/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc b/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc
index 2263a99..3a52d04 100644
--- a/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc
+++ b/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc

@@ -434,7 +434,7 @@
   }
 
   if (DateTimeEditElement* edit = GetDateTimeEditElement())
-    edit->DefaultEventHandler(event);
+    edit->DefaultEventHandler(*event);
 }
 
 void MultipleFieldsTemporalInputTypeView::DisabledAttributeChanged() {

diff --git a/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc b/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc
index 643ec24d..9aa9d54 100644
--- a/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc
+++ b/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc

@@ -68,26 +68,26 @@
   return new LayoutDetailsMarker(this);
 }
 
-void PickerIndicatorElement::DefaultEventHandler(Event* event) {
+void PickerIndicatorElement::DefaultEventHandler(Event& event) {
   if (!GetLayoutObject())
     return;
   if (!picker_indicator_owner_ ||
       picker_indicator_owner_->IsPickerIndicatorOwnerDisabledOrReadOnly())
     return;
 
-  if (event->type() == EventTypeNames::click) {
+  if (event.type() == EventTypeNames::click) {
     OpenPopup();
-    event->SetDefaultHandled();
-  } else if (event->type() == EventTypeNames::keypress &&
-             event->IsKeyboardEvent()) {
-    int char_code = ToKeyboardEvent(event)->charCode();
+    event.SetDefaultHandled();
+  } else if (event.type() == EventTypeNames::keypress &&
+             event.IsKeyboardEvent()) {
+    int char_code = ToKeyboardEvent(event).charCode();
     if (char_code == ' ' || char_code == '\r') {
       OpenPopup();
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
     }
   }
 
-  if (!event->DefaultHandled())
+  if (!event.DefaultHandled())
     HTMLDivElement::DefaultEventHandler(event);
 }
 
@@ -153,7 +153,7 @@
 }
 
 Node::InsertionNotificationRequest PickerIndicatorElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLDivElement::InsertedInto(insertion_point);
   return kInsertionShouldCallDidNotifySubtreeInsertions;
 }

diff --git a/third_party/blink/renderer/core/html/forms/picker_indicator_element.h b/third_party/blink/renderer/core/html/forms/picker_indicator_element.h
index c0c6fe3..9f675b2 100644
--- a/third_party/blink/renderer/core/html/forms/picker_indicator_element.h
+++ b/third_party/blink/renderer/core/html/forms/picker_indicator_element.h

@@ -76,10 +76,10 @@
  private:
   PickerIndicatorElement(Document&, PickerIndicatorOwner&);
   LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   void DetachLayoutTree(const AttachContext& = AttachContext()) override;
   bool IsPickerIndicatorElement() const override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void DidNotifySubtreeInsertionsToDocument() override;
 
   HTMLInputElement* HostInput();

diff --git a/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc b/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc
index 4e1399f..bcaf25d 100644
--- a/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc
+++ b/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc

@@ -211,14 +211,14 @@
     HostInput()->DispatchFormControlChangeEvent();
 }
 
-void SliderThumbElement::DefaultEventHandler(Event* event) {
-  if (event->IsPointerEvent() &&
-      event->type() == EventTypeNames::lostpointercapture) {
+void SliderThumbElement::DefaultEventHandler(Event& event) {
+  if (event.IsPointerEvent() &&
+      event.type() == EventTypeNames::lostpointercapture) {
     StopDragging();
     return;
   }
 
-  if (!event->IsMouseEvent()) {
+  if (!event.IsMouseEvent()) {
     HTMLDivElement::DefaultEventHandler(event);
     return;
   }
@@ -233,10 +233,10 @@
     return;
   }
 
-  MouseEvent* mouse_event = ToMouseEvent(event);
-  bool is_left_button = mouse_event->button() ==
+  auto& mouse_event = ToMouseEvent(event);
+  bool is_left_button = mouse_event.button() ==
                         static_cast<short>(WebPointerProperties::Button::kLeft);
-  const AtomicString& event_type = event->type();
+  const AtomicString& event_type = event.type();
 
   // We intentionally do not call event->setDefaultHandled() here because
   // MediaControlTimelineElement::defaultEventHandler() wants to handle these
@@ -251,7 +251,7 @@
   }
   if (event_type == EventTypeNames::mousemove) {
     if (in_drag_mode_)
-      SetPositionFromPoint(LayoutPoint(mouse_event->AbsoluteLocation()));
+      SetPositionFromPoint(LayoutPoint(mouse_event.AbsoluteLocation()));
     return;
   }
 
@@ -358,9 +358,9 @@
   return new LayoutSliderContainer(this);
 }
 
-void SliderContainerElement::DefaultEventHandler(Event* event) {
-  if (event->IsTouchEvent()) {
-    HandleTouchEvent(ToTouchEvent(event));
+void SliderContainerElement::DefaultEventHandler(Event& event) {
+  if (event.IsTouchEvent()) {
+    HandleTouchEvent(ToTouchEvent(&event));
     return;
   }
 }

diff --git a/third_party/blink/renderer/core/html/forms/slider_thumb_element.h b/third_party/blink/renderer/core/html/forms/slider_thumb_element.h
index dab6251d..cda4953 100644
--- a/third_party/blink/renderer/core/html/forms/slider_thumb_element.h
+++ b/third_party/blink/renderer/core/html/forms/slider_thumb_element.h

@@ -48,7 +48,7 @@
   void SetPositionFromValue();
 
   void DragFrom(const LayoutPoint&);
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool WillRespondToMouseMoveEvents() override;
   bool WillRespondToMouseClickEvents() override;
   void DetachLayoutTree(const AttachContext& = AttachContext()) override;
@@ -90,7 +90,7 @@
 
   DECLARE_NODE_FACTORY(SliderContainerElement);
   HTMLInputElement* HostInput() const;
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   void HandleTouchEvent(TouchEvent*);
   void UpdateTouchEventHandlerRegistry();
   void DidMoveToNewDocument(Document&) override;

diff --git a/third_party/blink/renderer/core/html/forms/spin_button_element.cc b/third_party/blink/renderer/core/html/forms/spin_button_element.cc
index 5700a6b..0ffecc16 100644
--- a/third_party/blink/renderer/core/html/forms/spin_button_element.cc
+++ b/third_party/blink/renderer/core/html/forms/spin_button_element.cc

@@ -69,31 +69,31 @@
   HTMLDivElement::DetachLayoutTree(context);
 }
 
-void SpinButtonElement::DefaultEventHandler(Event* event) {
-  if (!event->IsMouseEvent()) {
-    if (!event->DefaultHandled())
+void SpinButtonElement::DefaultEventHandler(Event& event) {
+  if (!event.IsMouseEvent()) {
+    if (!event.DefaultHandled())
       HTMLDivElement::DefaultEventHandler(event);
     return;
   }
 
   LayoutBox* box = GetLayoutBox();
   if (!box) {
-    if (!event->DefaultHandled())
+    if (!event.DefaultHandled())
       HTMLDivElement::DefaultEventHandler(event);
     return;
   }
 
   if (!ShouldRespondToMouseEvents()) {
-    if (!event->DefaultHandled())
+    if (!event.DefaultHandled())
       HTMLDivElement::DefaultEventHandler(event);
     return;
   }
 
-  MouseEvent* mouse_event = ToMouseEvent(event);
+  auto& mouse_event = ToMouseEvent(event);
   IntPoint local = RoundedIntPoint(box->AbsoluteToLocal(
-      FloatPoint(mouse_event->AbsoluteLocation()), kUseTransforms));
-  if (mouse_event->type() == EventTypeNames::mousedown &&
-      mouse_event->button() ==
+      FloatPoint(mouse_event.AbsoluteLocation()), kUseTransforms));
+  if (mouse_event.type() == EventTypeNames::mousedown &&
+      mouse_event.button() ==
           static_cast<short>(WebPointerProperties::Button::kLeft)) {
     if (box->PixelSnappedBorderBoxRect().Contains(local)) {
       if (spin_button_owner_)
@@ -109,13 +109,13 @@
           DoStepAction(up_down_state_ == kUp ? 1 : -1);
         }
       }
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
     }
-  } else if (mouse_event->type() == EventTypeNames::mouseup &&
-             mouse_event->button() ==
+  } else if (mouse_event.type() == EventTypeNames::mouseup &&
+             mouse_event.button() ==
                  static_cast<short>(WebPointerProperties::Button::kLeft)) {
     ReleaseCapture();
-  } else if (event->type() == EventTypeNames::mousemove) {
+  } else if (event.type() == EventTypeNames::mousemove) {
     if (box->PixelSnappedBorderBoxRect().Contains(local)) {
       if (!capturing_) {
         if (LocalFrame* frame = GetDocument().GetFrame()) {
@@ -135,7 +135,7 @@
     }
   }
 
-  if (!event->DefaultHandled())
+  if (!event.DefaultHandled())
     HTMLDivElement::DefaultEventHandler(event);
 }
 

diff --git a/third_party/blink/renderer/core/html/forms/spin_button_element.h b/third_party/blink/renderer/core/html/forms/spin_button_element.h
index 3f0f619..39259cec 100644
--- a/third_party/blink/renderer/core/html/forms/spin_button_element.h
+++ b/third_party/blink/renderer/core/html/forms/spin_button_element.h

@@ -86,7 +86,7 @@
   }
   bool MatchesReadOnlyPseudoClass() const override;
   bool MatchesReadWritePseudoClass() const override;
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   void WillOpenPopup() override;
   void DoStepAction(int);
   void StartRepeatingTimer();

diff --git a/third_party/blink/renderer/core/html/forms/text_control_element.cc b/third_party/blink/renderer/core/html/forms/text_control_element.cc
index e9af8fc5..e21ed0b 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_element.cc
+++ b/third_party/blink/renderer/core/html/forms/text_control_element.cc

@@ -103,8 +103,8 @@
                                                      source_capabilities);
 }
 
-void TextControlElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::webkitEditableContentChanged &&
+void TextControlElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::webkitEditableContentChanged &&
       GetLayoutObject() && GetLayoutObject()->IsTextControl()) {
     last_change_was_user_edit_ = !GetDocument().IsRunningExecCommand();
     user_has_edited_the_field_ |= last_change_was_user_edit_;
@@ -131,7 +131,7 @@
   if (event->type() == EventTypeNames::blur ||
       event->type() == EventTypeNames::focus)
     return;
-  InnerEditorElement()->DefaultEventHandler(event);
+  InnerEditorElement()->DefaultEventHandler(*event);
 }
 
 String TextControlElement::StrippedPlaceholder() const {

diff --git a/third_party/blink/renderer/core/html/forms/text_control_element.h b/third_party/blink/renderer/core/html/forms/text_control_element.h
index 4a9c145..95144336 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_element.h
+++ b/third_party/blink/renderer/core/html/forms/text_control_element.h

@@ -163,7 +163,7 @@
 
   void RestoreCachedSelection();
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   virtual void SubtreeHasChanged() = 0;
 
   void SetLastChangeWasNotUserEdit() { last_change_was_user_edit_ = false; }

diff --git a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
index 5c59d09..0bbcdc9 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
+++ b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc

@@ -106,13 +106,13 @@
   return new TextControlInnerEditorElement(document);
 }
 
-void TextControlInnerEditorElement::DefaultEventHandler(Event* event) {
+void TextControlInnerEditorElement::DefaultEventHandler(Event& event) {
   // FIXME: In the future, we should add a way to have default event listeners.
   // Then we would add one to the text field's inner div, and we wouldn't need
   // this subclass.
   // Or possibly we could just use a normal event listener.
-  if (event->IsBeforeTextInsertedEvent() ||
-      event->type() == EventTypeNames::webkitEditableContentChanged) {
+  if (event.IsBeforeTextInsertedEvent() ||
+      event.type() == EventTypeNames::webkitEditableContentChanged) {
     Element* shadow_ancestor = OwnerShadowHost();
     // A TextControlInnerTextElement can have no host if its been detached,
     // but kept alive by an EditCommand. In this case, an undo/redo can
@@ -122,7 +122,7 @@
     if (shadow_ancestor)
       shadow_ancestor->DefaultEventHandler(event);
   }
-  if (!event->DefaultHandled())
+  if (!event.DefaultHandled())
     HTMLDivElement::DefaultEventHandler(event);
 }
 
@@ -239,25 +239,25 @@
   HTMLDivElement::DetachLayoutTree(context);
 }
 
-void SearchFieldCancelButtonElement::DefaultEventHandler(Event* event) {
+void SearchFieldCancelButtonElement::DefaultEventHandler(Event& event) {
   // If the element is visible, on mouseup, clear the value, and set selection
   HTMLInputElement* input(ToHTMLInputElement(OwnerShadowHost()));
   if (!input || input->IsDisabledOrReadOnly()) {
-    if (!event->DefaultHandled())
+    if (!event.DefaultHandled())
       HTMLDivElement::DefaultEventHandler(event);
     return;
   }
 
-  if (event->type() == EventTypeNames::click && event->IsMouseEvent() &&
-      ToMouseEvent(event)->button() ==
+  if (event.type() == EventTypeNames::click && event.IsMouseEvent() &&
+      ToMouseEvent(event).button() ==
           static_cast<short>(WebPointerProperties::Button::kLeft)) {
     input->SetValueForUser("");
     input->SetAutofillState(WebAutofillState::kNotFilled);
     input->OnSearch();
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
   }
 
-  if (!event->DefaultHandled())
+  if (!event.DefaultHandled())
     HTMLDivElement::DefaultEventHandler(event);
 }
 

diff --git a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
index 283af2b..8ae0bcf 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
+++ b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h

@@ -57,7 +57,7 @@
  public:
   static TextControlInnerEditorElement* Create(Document&);
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   void SetVisibility(bool is_visible);
   scoped_refptr<ComputedStyle> CreateInnerEditorStyle() const;
@@ -74,7 +74,7 @@
  public:
   static SearchFieldCancelButtonElement* Create(Document&);
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool WillRespondToMouseClickEvents() override;
 
  private:

diff --git a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
index 430db9f5..c3952c5 100644
--- a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc

@@ -80,14 +80,14 @@
     return nullptr;
   }
 
-  void DefaultEventHandler(Event* event) override {
+  void DefaultEventHandler(Event& event) override {
     DCHECK(GetDocument().IsActive());
-    if (event->type() != EventTypeNames::click)
+    if (event.type() != EventTypeNames::click)
       return;
     HTMLInputElement* host = HostInput();
     if (host && !host->IsDisabledOrReadOnly()) {
       GetDocument().GetPage()->GetChromeClient().OpenTextDataListChooser(*host);
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
     }
   }
 

diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third_party/blink/renderer/core/html/html_anchor_element.cc
index e2e5fba..b46d17b1 100644
--- a/third_party/blink/renderer/core/html/html_anchor_element.cc
+++ b/third_party/blink/renderer/core/html/html_anchor_element.cc

@@ -143,16 +143,16 @@
   url.AppendNumber(clamped_point.Y());
 }
 
-void HTMLAnchorElement::DefaultEventHandler(Event* event) {
+void HTMLAnchorElement::DefaultEventHandler(Event& event) {
   if (IsLink()) {
-    if (IsFocused() && IsEnterKeyKeydownEvent(event) && IsLiveLink()) {
-      event->SetDefaultHandled();
-      DispatchSimulatedClick(event);
+    if (IsFocused() && IsEnterKeyKeydownEvent(&event) && IsLiveLink()) {
+      event.SetDefaultHandled();
+      DispatchSimulatedClick(&event);
       return;
     }
 
-    if (IsLinkClick(event) && IsLiveLink()) {
-      HandleClick(event);
+    if (IsLinkClick(&event) && IsLiveLink()) {
+      HandleClick(&event);
       return;
     }
   }
@@ -433,7 +433,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLAnchorElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   InsertionNotificationRequest request =
       HTMLElement::InsertedInto(insertion_point);
   LogAddElementIfIsolatedWorldAndInDocument("a", hrefAttr);

diff --git a/third_party/blink/renderer/core/html/html_anchor_element.h b/third_party/blink/renderer/core/html/html_anchor_element.h
index eff69542..7e086ea 100644
--- a/third_party/blink/renderer/core/html/html_anchor_element.h
+++ b/third_party/blink/renderer/core/html/html_anchor_element.h

@@ -110,7 +110,7 @@
   bool ShouldHaveFocusAppearance() const final;
   bool IsMouseFocusable() const override;
   bool IsKeyboardFocusable() const override;
-  void DefaultEventHandler(Event*) final;
+  void DefaultEventHandler(Event&) final;
   bool HasActivationBehavior() const override;
   void SetActive(bool = true) final;
   void AccessKeyAction(bool send_mouse_events) final;
@@ -120,7 +120,7 @@
   int tabIndex() const final;
   bool draggable() const final;
   bool IsInteractiveContent() const final;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void HandleClick(Event*);
 
   unsigned link_relations_ : 31;

diff --git a/third_party/blink/renderer/core/html/html_base_element.cc b/third_party/blink/renderer/core/html/html_base_element.cc
index 095fa51..e36e2d3 100644
--- a/third_party/blink/renderer/core/html/html_base_element.cc
+++ b/third_party/blink/renderer/core/html/html_base_element.cc

@@ -48,16 +48,16 @@
 }
 
 Node::InsertionNotificationRequest HTMLBaseElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
-  if (insertion_point->isConnected())
+  if (insertion_point.isConnected())
     GetDocument().ProcessBaseElement();
   return kInsertionDone;
 }
 
-void HTMLBaseElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLBaseElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLElement::RemovedFrom(insertion_point);
-  if (insertion_point->isConnected())
+  if (insertion_point.isConnected())
     GetDocument().ProcessBaseElement();
 }
 

diff --git a/third_party/blink/renderer/core/html/html_base_element.h b/third_party/blink/renderer/core/html/html_base_element.h
index e05135d..132fb47e 100644
--- a/third_party/blink/renderer/core/html/html_base_element.h
+++ b/third_party/blink/renderer/core/html/html_base_element.h

@@ -45,8 +45,8 @@
 
   bool IsURLAttribute(const Attribute&) const override;
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/html/html_body_element.cc b/third_party/blink/renderer/core/html/html_body_element.cc
index 9ba00c4..4d4c3b9 100644
--- a/third_party/blink/renderer/core/html/html_body_element.cc
+++ b/third_party/blink/renderer/core/html/html_body_element.cc

@@ -235,7 +235,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLBodyElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   return kInsertionShouldCallDidNotifySubtreeInsertions;
 }

diff --git a/third_party/blink/renderer/core/html/html_body_element.h b/third_party/blink/renderer/core/html/html_body_element.h
index 98305e1..16bc9315 100644
--- a/third_party/blink/renderer/core/html/html_body_element.h
+++ b/third_party/blink/renderer/core/html/html_body_element.h

@@ -57,7 +57,7 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void DidNotifySubtreeInsertionsToDocument() override;
 
   bool IsURLAttribute(const Attribute&) const override;

diff --git a/third_party/blink/renderer/core/html/html_dialog_element.cc b/third_party/blink/renderer/core/html/html_dialog_element.cc
index a4edfea..9e3b438 100644
--- a/third_party/blink/renderer/core/html/html_dialog_element.cc
+++ b/third_party/blink/renderer/core/html/html_dialog_element.cc

@@ -180,7 +180,7 @@
   SetFocusForDialog(this);
 }
 
-void HTMLDialogElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLDialogElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLElement::RemovedFrom(insertion_point);
   SetNotCentered();
   InertSubtreesChanged(GetDocument());
@@ -207,10 +207,10 @@
   return HTMLElement::IsPresentationAttribute(name);
 }
 
-void HTMLDialogElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::cancel) {
+void HTMLDialogElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::cancel) {
     close();
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
     return;
   }
   HTMLElement::DefaultEventHandler(event);

diff --git a/third_party/blink/renderer/core/html/html_dialog_element.h b/third_party/blink/renderer/core/html/html_dialog_element.h
index 9b5691b..1562436 100644
--- a/third_party/blink/renderer/core/html/html_dialog_element.h
+++ b/third_party/blink/renderer/core/html/html_dialog_element.h

@@ -43,7 +43,7 @@
   void close(const String& return_value = String());
   void show();
   void showModal(ExceptionState&);
-  void RemovedFrom(ContainerNode*) override;
+  void RemovedFrom(ContainerNode&) override;
 
   // NotCentered means do not center the dialog. Centered means the dialog has
   // been centered and centeredPosition() is set. NeedsCentering means attempt
@@ -66,7 +66,7 @@
   explicit HTMLDialogElement(Document&);
 
   bool IsPresentationAttribute(const QualifiedName&) const override;
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   void ForceLayoutForCentering();
 

diff --git a/third_party/blink/renderer/core/html/html_element.cc b/third_party/blink/renderer/core/html/html_element.cc
index 9d22490e..8a70d28 100644
--- a/third_party/blink/renderer/core/html/html_element.cc
+++ b/third_party/blink/renderer/core/html/html_element.cc

@@ -1060,7 +1060,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   // Process the superclass first to ensure that `InActiveDocument()` is
   // updated.
   Element::InsertedInto(insertion_point);
@@ -1209,10 +1209,10 @@
   return false;
 }
 
-void HTMLElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::keypress && event->IsKeyboardEvent()) {
-    HandleKeypressEvent(ToKeyboardEvent(event));
-    if (event->DefaultHandled())
+void HTMLElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::keypress && event.IsKeyboardEvent()) {
+    HandleKeypressEvent(ToKeyboardEvent(&event));
+    if (event.DefaultHandled())
       return;
   }
 

diff --git a/third_party/blink/renderer/core/html/html_element.h b/third_party/blink/renderer/core/html/html_element.h
index 241c4c8f..3dcce10 100644
--- a/third_party/blink/renderer/core/html/html_element.h
+++ b/third_party/blink/renderer/core/html/html_element.h

@@ -102,7 +102,7 @@
   virtual bool IsLabelable() const { return false; }
   // http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#interactive-content
   virtual bool IsInteractiveContent() const;
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   static const AtomicString& EventNameForAttributeName(
       const QualifiedName& attr_name);
@@ -154,7 +154,7 @@
   void ChildrenChanged(const ChildrenChange&) override;
   void CalculateAndAdjustDirectionality();
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
 
  private:
   String DebugNodeName() const final;

diff --git a/third_party/blink/renderer/core/html/html_frame_element_base.cc b/third_party/blink/renderer/core/html/html_frame_element_base.cc
index e770805..3d9304a 100644
--- a/third_party/blink/renderer/core/html/html_frame_element_base.cc
+++ b/third_party/blink/renderer/core/html/html_frame_element_base.cc

@@ -187,7 +187,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLFrameElementBase::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLFrameOwnerElement::InsertedInto(insertion_point);
   // We should never have a content frame at the point where we got inserted
   // into a tree.

diff --git a/third_party/blink/renderer/core/html/html_frame_element_base.h b/third_party/blink/renderer/core/html/html_frame_element_base.h
index 5eae80d..cfe6e81 100644
--- a/third_party/blink/renderer/core/html/html_frame_element_base.h
+++ b/third_party/blink/renderer/core/html/html_frame_element_base.h

@@ -47,7 +47,7 @@
 
   void ParseAttribute(const AttributeModificationParams&) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void DidNotifySubtreeInsertionsToDocument() final;
   void AttachLayoutTree(AttachContext&) override;
 

diff --git a/third_party/blink/renderer/core/html/html_frame_set_element.cc b/third_party/blink/renderer/core/html/html_frame_set_element.cc
index 5b97378f..46e6bbe 100644
--- a/third_party/blink/renderer/core/html/html_frame_set_element.cc
+++ b/third_party/blink/renderer/core/html/html_frame_set_element.cc

@@ -262,11 +262,11 @@
   HTMLElement::AttachLayoutTree(context);
 }
 
-void HTMLFrameSetElement::DefaultEventHandler(Event* evt) {
-  if (evt->IsMouseEvent() && !noresize_ && GetLayoutObject() &&
+void HTMLFrameSetElement::DefaultEventHandler(Event& evt) {
+  if (evt.IsMouseEvent() && !noresize_ && GetLayoutObject() &&
       GetLayoutObject()->IsFrameSet()) {
-    if (ToLayoutFrameSet(GetLayoutObject())->UserResize(ToMouseEvent(evt))) {
-      evt->SetDefaultHandled();
+    if (ToLayoutFrameSet(GetLayoutObject())->UserResize(ToMouseEvent(&evt))) {
+      evt.SetDefaultHandled();
       return;
     }
   }
@@ -274,8 +274,8 @@
 }
 
 Node::InsertionNotificationRequest HTMLFrameSetElement::InsertedInto(
-    ContainerNode* insertion_point) {
-  if (insertion_point->isConnected() && GetDocument().GetFrame()) {
+    ContainerNode& insertion_point) {
+  if (insertion_point.isConnected() && GetDocument().GetFrame()) {
     // A document using <frameset> likely won't literally have a body, but as
     // far as the client is concerned, the frameset is effectively the body.
     GetDocument().WillInsertBody();

diff --git a/third_party/blink/renderer/core/html/html_frame_set_element.h b/third_party/blink/renderer/core/html/html_frame_set_element.h
index b526b381..19614936 100644
--- a/third_party/blink/renderer/core/html/html_frame_set_element.h
+++ b/third_party/blink/renderer/core/html/html_frame_set_element.h

@@ -73,9 +73,9 @@
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
   LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void WillRecalcStyle(StyleRecalcChange) override;
 
   Vector<HTMLDimension> row_lengths_;

diff --git a/third_party/blink/renderer/core/html/html_hr_element.cc b/third_party/blink/renderer/core/html/html_hr_element.cc
index 594570fc..a1835bf 100644
--- a/third_party/blink/renderer/core/html/html_hr_element.cc
+++ b/third_party/blink/renderer/core/html/html_hr_element.cc

@@ -119,22 +119,22 @@
 }
 
 Node::InsertionNotificationRequest HTMLHRElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   if (HTMLSelectElement* select = OwnerSelectElement()) {
-    if (insertion_point == select || (IsHTMLOptGroupElement(*insertion_point) &&
-                                      insertion_point->parentNode() == select))
+    if (&insertion_point == select || (IsHTMLOptGroupElement(insertion_point) &&
+                                       insertion_point.parentNode() == select))
       select->HrInsertedOrRemoved(*this);
   }
   return kInsertionDone;
 }
 
-void HTMLHRElement::RemovedFrom(ContainerNode* insertion_point) {
-  if (auto* select = ToHTMLSelectElementOrNull(*insertion_point)) {
+void HTMLHRElement::RemovedFrom(ContainerNode& insertion_point) {
+  if (auto* select = ToHTMLSelectElementOrNull(insertion_point)) {
     if (!parentNode() || IsHTMLOptGroupElement(*parentNode()))
       select->HrInsertedOrRemoved(*this);
-  } else if (IsHTMLOptGroupElement(*insertion_point)) {
-    Node* parent = insertion_point->parentNode();
+  } else if (IsHTMLOptGroupElement(insertion_point)) {
+    Node* parent = insertion_point.parentNode();
     if (auto* select = ToHTMLSelectElementOrNull(parent))
       select->HrInsertedOrRemoved(*this);
   }

diff --git a/third_party/blink/renderer/core/html/html_hr_element.h b/third_party/blink/renderer/core/html/html_hr_element.h
index a595db9..09087f53 100644
--- a/third_party/blink/renderer/core/html/html_hr_element.h
+++ b/third_party/blink/renderer/core/html/html_hr_element.h

@@ -46,8 +46,8 @@
       const QualifiedName&,
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/html/html_iframe_element.cc b/third_party/blink/renderer/core/html/html_iframe_element.cc
index 1c39480..7dcd351 100644
--- a/third_party/blink/renderer/core/html/html_iframe_element.cc
+++ b/third_party/blink/renderer/core/html/html_iframe_element.cc

@@ -273,11 +273,11 @@
 }
 
 Node::InsertionNotificationRequest HTMLIFrameElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   InsertionNotificationRequest result =
       HTMLFrameElementBase::InsertedInto(insertion_point);
 
-  if (insertion_point->IsInDocumentTree() && GetDocument().IsHTMLDocument()) {
+  if (insertion_point.IsInDocumentTree() && GetDocument().IsHTMLDocument()) {
     ToHTMLDocument(GetDocument()).AddNamedItem(name_);
 
     if (!ContentSecurityPolicy::IsValidCSPAttr(
@@ -297,9 +297,9 @@
   return result;
 }
 
-void HTMLIFrameElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLIFrameElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLFrameElementBase::RemovedFrom(insertion_point);
-  if (insertion_point->IsInDocumentTree() && GetDocument().IsHTMLDocument())
+  if (insertion_point.IsInDocumentTree() && GetDocument().IsHTMLDocument())
     ToHTMLDocument(GetDocument()).RemoveNamedItem(name_);
 }
 

diff --git a/third_party/blink/renderer/core/html/html_iframe_element.h b/third_party/blink/renderer/core/html/html_iframe_element.h
index 4b898d38..eabe699 100644
--- a/third_party/blink/renderer/core/html/html_iframe_element.h
+++ b/third_party/blink/renderer/core/html/html_iframe_element.h

@@ -62,8 +62,8 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
   LayoutObject* CreateLayoutObject(const ComputedStyle&) override;

diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_party/blink/renderer/core/html/html_image_element.cc
index 5ec2f4c..3cf8f05b 100644
--- a/third_party/blink/renderer/core/html/html_image_element.cc
+++ b/third_party/blink/renderer/core/html/html_image_element.cc

@@ -389,9 +389,9 @@
 }
 
 Node::InsertionNotificationRequest HTMLImageElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   if (!form_was_set_by_parser_ ||
-      NodeTraversal::HighestAncestorOrSelf(*insertion_point) !=
+      NodeTraversal::HighestAncestorOrSelf(insertion_point) !=
           NodeTraversal::HighestAncestorOrSelf(*form_.Get()))
     ResetFormOwner();
   if (listener_)
@@ -411,7 +411,7 @@
 
   // If we have been inserted from a layoutObject-less document,
   // our loader may have not fetched the image, so do it now.
-  if ((insertion_point->isConnected() && !GetImageLoader().GetContent() &&
+  if ((insertion_point.isConnected() && !GetImageLoader().GetContent() &&
        !GetImageLoader().HasPendingActivity()) ||
       image_was_modified) {
     GetImageLoader().UpdateFromElement(ImageLoader::kUpdateNormal,
@@ -421,7 +421,7 @@
   return HTMLElement::InsertedInto(insertion_point);
 }
 
-void HTMLImageElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLImageElement::RemovedFrom(ContainerNode& insertion_point) {
   if (!form_ || NodeTraversal::HighestAncestorOrSelf(*form_.Get()) !=
                     NodeTraversal::HighestAncestorOrSelf(*this))
     ResetFormOwner();

diff --git a/third_party/blink/renderer/core/html/html_image_element.h b/third_party/blink/renderer/core/html/html_image_element.h
index 08400ac..2e499bf 100644
--- a/third_party/blink/renderer/core/html/html_image_element.h
+++ b/third_party/blink/renderer/core/html/html_image_element.h

@@ -190,8 +190,8 @@
 
   bool draggable() const override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   NamedItemType GetNamedItemType() const override {
     return NamedItemType::kNameOrIdWithName;
   }

diff --git a/third_party/blink/renderer/core/html/html_link_element.cc b/third_party/blink/renderer/core/html/html_link_element.cc
index f666bc92..19bc01d 100644
--- a/third_party/blink/renderer/core/html/html_link_element.cc
+++ b/third_party/blink/renderer/core/html/html_link_element.cc

@@ -203,10 +203,10 @@
 }
 
 Node::InsertionNotificationRequest HTMLLinkElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   LogAddElementIfIsolatedWorldAndInDocument("link", relAttr, hrefAttr);
-  if (!insertion_point->isConnected())
+  if (!insertion_point.isConnected())
     return kInsertionDone;
   DCHECK(isConnected());
   if (!ShouldLoadLink() && IsInShadowTree()) {
@@ -226,12 +226,12 @@
   return kInsertionDone;
 }
 
-void HTMLLinkElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLLinkElement::RemovedFrom(ContainerNode& insertion_point) {
   // Store the result of isConnected() here before Node::removedFrom(..) clears
   // the flags.
   bool was_connected = isConnected();
   HTMLElement::RemovedFrom(insertion_point);
-  if (!insertion_point->isConnected())
+  if (!insertion_point.isConnected())
     return;
 
   link_loader_->Abort();
@@ -240,8 +240,8 @@
     DCHECK(!GetLinkStyle() || !GetLinkStyle()->HasSheet());
     return;
   }
-  GetDocument().GetStyleEngine().RemoveStyleSheetCandidateNode(
-      *this, *insertion_point);
+  GetDocument().GetStyleEngine().RemoveStyleSheetCandidateNode(*this,
+                                                               insertion_point);
   if (link_)
     link_->OwnerRemoved();
 }

diff --git a/third_party/blink/renderer/core/html/html_link_element.h b/third_party/blink/renderer/core/html/html_link_element.h
index 56774e1a..4efebf4 100644
--- a/third_party/blink/renderer/core/html/html_link_element.h
+++ b/third_party/blink/renderer/core/html/html_link_element.h

@@ -133,8 +133,8 @@
 
   // From Node and subclassses
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   bool IsURLAttribute(const Attribute&) const override;
   bool HasLegalLinkAttribute(const QualifiedName&) const override;
   const QualifiedName& SubResourceAttributeName() const override;

diff --git a/third_party/blink/renderer/core/html/html_map_element.cc b/third_party/blink/renderer/core/html/html_map_element.cc
index 92a5b6da..d7eb120 100644
--- a/third_party/blink/renderer/core/html/html_map_element.cc
+++ b/third_party/blink/renderer/core/html/html_map_element.cc

@@ -106,14 +106,14 @@
 }
 
 Node::InsertionNotificationRequest HTMLMapElement::InsertedInto(
-    ContainerNode* insertion_point) {
-  if (insertion_point->isConnected())
+    ContainerNode& insertion_point) {
+  if (insertion_point.isConnected())
     GetTreeScope().AddImageMap(*this);
   return HTMLElement::InsertedInto(insertion_point);
 }
 
-void HTMLMapElement::RemovedFrom(ContainerNode* insertion_point) {
-  if (insertion_point->isConnected())
+void HTMLMapElement::RemovedFrom(ContainerNode& insertion_point) {
+  if (insertion_point.isConnected())
     GetTreeScope().RemoveImageMap(*this);
   HTMLElement::RemovedFrom(insertion_point);
 }

diff --git a/third_party/blink/renderer/core/html/html_map_element.h b/third_party/blink/renderer/core/html/html_map_element.h
index bf40b8fa..c5bce07 100644
--- a/third_party/blink/renderer/core/html/html_map_element.h
+++ b/third_party/blink/renderer/core/html/html_map_element.h

@@ -50,8 +50,8 @@
 
   void ParseAttribute(const AttributeModificationParams&) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   AtomicString name_;
 };

diff --git a/third_party/blink/renderer/core/html/html_marquee_element.cc b/third_party/blink/renderer/core/html/html_marquee_element.cc
index 166a916a..1dd9fdc 100644
--- a/third_party/blink/renderer/core/html/html_marquee_element.cc
+++ b/third_party/blink/renderer/core/html/html_marquee_element.cc

@@ -128,7 +128,7 @@
 };
 
 Node::InsertionNotificationRequest HTMLMarqueeElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
 
   if (isConnected())
@@ -137,9 +137,9 @@
   return kInsertionDone;
 }
 
-void HTMLMarqueeElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLMarqueeElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLElement::RemovedFrom(insertion_point);
-  if (insertion_point->isConnected()) {
+  if (insertion_point.isConnected()) {
     stop();
   }
 }

diff --git a/third_party/blink/renderer/core/html/html_marquee_element.h b/third_party/blink/renderer/core/html/html_marquee_element.h
index a366b09b..a2b0d56e 100644
--- a/third_party/blink/renderer/core/html/html_marquee_element.h
+++ b/third_party/blink/renderer/core/html/html_marquee_element.h

@@ -37,8 +37,8 @@
 
   static HTMLMarqueeElement* Create(Document&);
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) final;
-  void RemovedFrom(ContainerNode*) final;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) final;
+  void RemovedFrom(ContainerNode&) final;
 
   bool IsHorizontal() const;
 

diff --git a/third_party/blink/renderer/core/html/html_meta_element.cc b/third_party/blink/renderer/core/html/html_meta_element.cc
index dbd3151..36c0bff 100644
--- a/third_party/blink/renderer/core/html/html_meta_element.cc
+++ b/third_party/blink/renderer/core/html/html_meta_element.cc

@@ -486,7 +486,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLMetaElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   return kInsertionShouldCallDidNotifySubtreeInsertions;
 }

diff --git a/third_party/blink/renderer/core/html/html_meta_element.h b/third_party/blink/renderer/core/html/html_meta_element.h
index 2074091..0f7ecb5 100644
--- a/third_party/blink/renderer/core/html/html_meta_element.h
+++ b/third_party/blink/renderer/core/html/html_meta_element.h

@@ -74,7 +74,7 @@
                                     bool viewport_meta_zero_values_quirk);
 
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void DidNotifySubtreeInsertionsToDocument() override;
 
   static float ParsePositiveNumber(Document*,

diff --git a/third_party/blink/renderer/core/html/html_object_element.cc b/third_party/blink/renderer/core/html/html_object_element.cc
index 8537c83..4ac6bf8 100644
--- a/third_party/blink/renderer/core/html/html_object_element.cc
+++ b/third_party/blink/renderer/core/html/html_object_element.cc

@@ -289,13 +289,13 @@
 }
 
 Node::InsertionNotificationRequest HTMLObjectElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLPlugInElement::InsertedInto(insertion_point);
   ListedElement::InsertedInto(insertion_point);
   return kInsertionDone;
 }
 
-void HTMLObjectElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLObjectElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLPlugInElement::RemovedFrom(insertion_point);
   ListedElement::RemovedFrom(insertion_point);
 }

diff --git a/third_party/blink/renderer/core/html/html_object_element.h b/third_party/blink/renderer/core/html/html_object_element.h
index 7e33237e..2d142b3 100644
--- a/third_party/blink/renderer/core/html/html_object_element.h
+++ b/third_party/blink/renderer/core/html/html_object_element.h

@@ -91,8 +91,8 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void DidMoveToNewDocument(Document& old_document) override;
 

diff --git a/third_party/blink/renderer/core/html/html_picture_element.cc b/third_party/blink/renderer/core/html/html_picture_element.cc
index 9172a770..acabeb3 100644
--- a/third_party/blink/renderer/core/html/html_picture_element.cc
+++ b/third_party/blink/renderer/core/html/html_picture_element.cc

@@ -50,7 +50,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLPictureElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   UseCounter::Count(GetDocument(), WebFeature::kPicture);
   return HTMLElement::InsertedInto(insertion_point);
 }

diff --git a/third_party/blink/renderer/core/html/html_picture_element.h b/third_party/blink/renderer/core/html/html_picture_element.h
index 27d6d850..0127628c 100644
--- a/third_party/blink/renderer/core/html/html_picture_element.h
+++ b/third_party/blink/renderer/core/html/html_picture_element.h

@@ -23,7 +23,7 @@
   explicit HTMLPictureElement(Document&);
 
  private:
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/html/html_plugin_element.cc b/third_party/blink/renderer/core/html/html_plugin_element.cc
index fb66fe1..07775adc 100644
--- a/third_party/blink/renderer/core/html/html_plugin_element.cc
+++ b/third_party/blink/renderer/core/html/html_plugin_element.cc

@@ -279,7 +279,7 @@
   }
 }
 
-void HTMLPlugInElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLPlugInElement::RemovedFrom(ContainerNode& insertion_point) {
   // If we've persisted the plugin and we're removed from the tree then
   // make sure we cleanup the persistance pointer.
   if (persisted_plugin_) {
@@ -436,7 +436,7 @@
   }
 }
 
-void HTMLPlugInElement::DefaultEventHandler(Event* event) {
+void HTMLPlugInElement::DefaultEventHandler(Event& event) {
   // Firefox seems to use a fake event listener to dispatch events to plugin
   // (tested with mouse events only). This is observable via different order
   // of events - in Firefox, event listeners specified in HTML attributes
@@ -457,8 +457,8 @@
   WebPluginContainerImpl* plugin = OwnedPlugin();
   if (!plugin)
     return;
-  plugin->HandleEvent(event);
-  if (event->DefaultHandled())
+  plugin->HandleEvent(&event);
+  if (event.DefaultHandled())
     return;
   HTMLFrameOwnerElement::DefaultEventHandler(event);
 }

diff --git a/third_party/blink/renderer/core/html/html_plugin_element.h b/third_party/blink/renderer/core/html/html_plugin_element.h
index 7581470c..5120fac0 100644
--- a/third_party/blink/renderer/core/html/html_plugin_element.h
+++ b/third_party/blink/renderer/core/html/html_plugin_element.h

@@ -110,7 +110,7 @@
                     PreferPlugInsForImagesOption);
 
   // Node functions:
-  void RemovedFrom(ContainerNode* insertion_point) override;
+  void RemovedFrom(ContainerNode& insertion_point) override;
   void DidMoveToNewDocument(Document& old_document) override;
   void AttachLayoutTree(AttachContext&) override;
 
@@ -160,7 +160,7 @@
   bool CanContainRangeEndPoint() const override { return false; }
   bool CanStartSelection() const override;
   bool WillRespondToMouseClickEvents() final;
-  void DefaultEventHandler(Event*) final;
+  void DefaultEventHandler(Event&) final;
   void DetachLayoutTree(const AttachContext& = AttachContext()) final;
   void FinishParsingChildren() final;
 

diff --git a/third_party/blink/renderer/core/html/html_script_element.cc b/third_party/blink/renderer/core/html/html_script_element.cc
index 50187b0..86b3cefd 100644
--- a/third_party/blink/renderer/core/html/html_script_element.cc
+++ b/third_party/blink/renderer/core/html/html_script_element.cc

@@ -88,9 +88,9 @@
 }
 
 Node::InsertionNotificationRequest HTMLScriptElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   ScriptType script_type = ScriptType::kClassic;
-  if (insertion_point->isConnected() && HasSourceAttribute() &&
+  if (insertion_point.isConnected() && HasSourceAttribute() &&
       !ScriptLoader::IsValidScriptTypeAndLanguage(
           TypeAttributeValue(), LanguageAttributeValue(),
           ScriptLoader::kDisallowLegacyTypeInTypeAttribute, script_type)) {

diff --git a/third_party/blink/renderer/core/html/html_script_element.h b/third_party/blink/renderer/core/html/html_script_element.h
index 2350ed92..c2ad9c0 100644
--- a/third_party/blink/renderer/core/html/html_script_element.h
+++ b/third_party/blink/renderer/core/html/html_script_element.h

@@ -60,7 +60,7 @@
   HTMLScriptElement(Document&, const CreateElementFlags);
 
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void DidNotifySubtreeInsertionsToDocument() override;
   void ChildrenChanged(const ChildrenChange&) override;
   void DidMoveToNewDocument(Document& old_document) override;

diff --git a/third_party/blink/renderer/core/html/html_slot_element.cc b/third_party/blink/renderer/core/html/html_slot_element.cc
index 615a953..14e954c 100644
--- a/third_party/blink/renderer/core/html/html_slot_element.cc
+++ b/third_party/blink/renderer/core/html/html_slot_element.cc

@@ -412,17 +412,17 @@
 }
 
 Node::InsertionNotificationRequest HTMLSlotElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   if (SupportsAssignment()) {
     ShadowRoot* root = ContainingShadowRoot();
     DCHECK(root);
     DCHECK(root->IsV1());
-    if (root == insertion_point->ContainingShadowRoot()) {
+    if (root == insertion_point.ContainingShadowRoot()) {
       // This slot is inserted into the same tree of |insertion_point|
       root->DidAddSlot(*this);
     } else if (RuntimeEnabledFeatures::IncrementalShadowDOMEnabled() &&
-               insertion_point->isConnected() &&
+               insertion_point.isConnected() &&
                root->NeedsSlotAssignmentRecalc()) {
       // Even when a slot and its containing shadow root is removed together
       // and inserted together again, the slot's cached assigned nodes can be
@@ -437,7 +437,7 @@
   return kInsertionDone;
 }
 
-void HTMLSlotElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLSlotElement::RemovedFrom(ContainerNode& insertion_point) {
   // `removedFrom` is called after the node is removed from the tree.
   // That means:
   // 1. If this slot is still in a tree scope, it means the slot has been in a
@@ -480,11 +480,11 @@
     } else {
       ClearDistribution();
     }
-  } else if (insertion_point->IsInV1ShadowTree()) {
+  } else if (insertion_point.IsInV1ShadowTree()) {
     // This slot was in a shadow tree and got disconnected from the shadow tree.
     // In the above example, (this slot == s1), (insertion point == d)
     // and (insertion_point->ContainingShadowRoot == sr1).
-    insertion_point->ContainingShadowRoot()->GetSlotAssignment().DidRemoveSlot(
+    insertion_point.ContainingShadowRoot()->GetSlotAssignment().DidRemoveSlot(
         *this);
     if (RuntimeEnabledFeatures::IncrementalShadowDOMEnabled()) {
       ClearAssignedNodesAndFlatTreeChildren();

diff --git a/third_party/blink/renderer/core/html/html_slot_element.h b/third_party/blink/renderer/core/html/html_slot_element.h
index 7b92296..f4a05372 100644
--- a/third_party/blink/renderer/core/html/html_slot_element.h
+++ b/third_party/blink/renderer/core/html/html_slot_element.h

@@ -137,8 +137,8 @@
  private:
   HTMLSlotElement(Document&);
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) final;
-  void RemovedFrom(ContainerNode*) final;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) final;
+  void RemovedFrom(ContainerNode&) final;
   void DidRecalcStyle(StyleRecalcChange) final;
 
   void EnqueueSlotChangeEvent();

diff --git a/third_party/blink/renderer/core/html/html_source_element.cc b/third_party/blink/renderer/core/html/html_source_element.cc
index ed02971..f46ad2de 100644
--- a/third_party/blink/renderer/core/html/html_source_element.cc
+++ b/third_party/blink/renderer/core/html/html_source_element.cc

@@ -89,7 +89,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLSourceElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   Element* parent = parentElement();
   if (auto* media = ToHTMLMediaElementOrNull(parent))
@@ -99,10 +99,10 @@
   return kInsertionDone;
 }
 
-void HTMLSourceElement::RemovedFrom(ContainerNode* removal_root) {
+void HTMLSourceElement::RemovedFrom(ContainerNode& removal_root) {
   Element* parent = parentElement();
-  if (!parent && removal_root->IsElementNode())
-    parent = ToElement(removal_root);
+  if (!parent && removal_root.IsElementNode())
+    parent = ToElement(&removal_root);
   if (auto* media = ToHTMLMediaElementOrNull(parent))
     media->SourceWasRemoved(this);
   if (auto* picture = ToHTMLPictureElementOrNull(parent)) {

diff --git a/third_party/blink/renderer/core/html/html_source_element.h b/third_party/blink/renderer/core/html/html_source_element.h
index 5d6fe8c..e60012d8 100644
--- a/third_party/blink/renderer/core/html/html_source_element.h
+++ b/third_party/blink/renderer/core/html/html_source_element.h

@@ -66,8 +66,8 @@
 
   void DidMoveToNewDocument(Document& old_document) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   bool IsURLAttribute(const Attribute&) const override;
   void ParseAttribute(const AttributeModificationParams&) override;
 

diff --git a/third_party/blink/renderer/core/html/html_style_element.cc b/third_party/blink/renderer/core/html/html_style_element.cc
index 1f5d4cf..2e216d1 100644
--- a/third_party/blink/renderer/core/html/html_style_element.cc
+++ b/third_party/blink/renderer/core/html/html_style_element.cc

@@ -75,7 +75,7 @@
 }
 
 Node::InsertionNotificationRequest HTMLStyleElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   if (isConnected()) {
     if (StyleElement::ProcessStyleSheet(GetDocument(), *this) ==
@@ -87,9 +87,9 @@
   return kInsertionDone;
 }
 
-void HTMLStyleElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLStyleElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLElement::RemovedFrom(insertion_point);
-  StyleElement::RemovedFrom(*this, insertion_point);
+  StyleElement::RemovedFrom(*this, &insertion_point);
 }
 
 void HTMLStyleElement::ChildrenChanged(const ChildrenChange& change) {

diff --git a/third_party/blink/renderer/core/html/html_style_element.h b/third_party/blink/renderer/core/html/html_style_element.h
index c8b6726..151ba08 100644
--- a/third_party/blink/renderer/core/html/html_style_element.h
+++ b/third_party/blink/renderer/core/html/html_style_element.h

@@ -55,8 +55,8 @@
 
   // overload from HTMLElement
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
   void FinishParsingChildren() override;

diff --git a/third_party/blink/renderer/core/html/html_summary_element.cc b/third_party/blink/renderer/core/html/html_summary_element.cc
index 0a7063b..751682d 100644
--- a/third_party/blink/renderer/core/html/html_summary_element.cc
+++ b/third_party/blink/renderer/core/html/html_summary_element.cc

@@ -101,40 +101,40 @@
   return IsMainSummary() || HTMLElement::SupportsFocus();
 }
 
-void HTMLSummaryElement::DefaultEventHandler(Event* event) {
+void HTMLSummaryElement::DefaultEventHandler(Event& event) {
   if (IsMainSummary()) {
-    if (event->type() == EventTypeNames::DOMActivate &&
-        !IsClickableControl(event->target()->ToNode())) {
+    if (event.type() == EventTypeNames::DOMActivate &&
+        !IsClickableControl(event.target()->ToNode())) {
       if (HTMLDetailsElement* details = DetailsElement())
         details->ToggleOpen();
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
       return;
     }
 
-    if (event->IsKeyboardEvent()) {
-      if (event->type() == EventTypeNames::keydown &&
-          ToKeyboardEvent(event)->key() == " ") {
+    if (event.IsKeyboardEvent()) {
+      if (event.type() == EventTypeNames::keydown &&
+          ToKeyboardEvent(event).key() == " ") {
         SetActive(true);
         // No setDefaultHandled() - IE dispatches a keypress in this case.
         return;
       }
-      if (event->type() == EventTypeNames::keypress) {
-        switch (ToKeyboardEvent(event)->charCode()) {
+      if (event.type() == EventTypeNames::keypress) {
+        switch (ToKeyboardEvent(event).charCode()) {
           case '\r':
-            DispatchSimulatedClick(event);
-            event->SetDefaultHandled();
+            DispatchSimulatedClick(&event);
+            event.SetDefaultHandled();
             return;
           case ' ':
             // Prevent scrolling down the page.
-            event->SetDefaultHandled();
+            event.SetDefaultHandled();
             return;
         }
       }
-      if (event->type() == EventTypeNames::keyup &&
-          ToKeyboardEvent(event)->key() == " ") {
+      if (event.type() == EventTypeNames::keyup &&
+          ToKeyboardEvent(event).key() == " ") {
         if (IsActive())
-          DispatchSimulatedClick(event);
-        event->SetDefaultHandled();
+          DispatchSimulatedClick(&event);
+        event.SetDefaultHandled();
         return;
       }
     }

diff --git a/third_party/blink/renderer/core/html/html_summary_element.h b/third_party/blink/renderer/core/html/html_summary_element.h
index 081f9b09..4641a8d1 100644
--- a/third_party/blink/renderer/core/html/html_summary_element.h
+++ b/third_party/blink/renderer/core/html/html_summary_element.h

@@ -39,7 +39,7 @@
   explicit HTMLSummaryElement(Document&);
 
   LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool HasActivationBehavior() const override;
   void DidAddUserAgentShadowRoot(ShadowRoot&) override;
   HTMLDetailsElement* DetailsElement() const;

diff --git a/third_party/blink/renderer/core/html/html_title_element.cc b/third_party/blink/renderer/core/html/html_title_element.cc
index e2bfb87..7118b49 100644
--- a/third_party/blink/renderer/core/html/html_title_element.cc
+++ b/third_party/blink/renderer/core/html/html_title_element.cc

@@ -41,16 +41,16 @@
 DEFINE_NODE_FACTORY(HTMLTitleElement)
 
 Node::InsertionNotificationRequest HTMLTitleElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   HTMLElement::InsertedInto(insertion_point);
   if (IsInDocumentTree())
     GetDocument().SetTitleElement(this);
   return kInsertionDone;
 }
 
-void HTMLTitleElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLTitleElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLElement::RemovedFrom(insertion_point);
-  if (insertion_point->IsInDocumentTree())
+  if (insertion_point.IsInDocumentTree())
     GetDocument().RemoveTitle(this);
 }
 

diff --git a/third_party/blink/renderer/core/html/html_title_element.h b/third_party/blink/renderer/core/html/html_title_element.h
index 7bd56a89..9089c14b 100644
--- a/third_party/blink/renderer/core/html/html_title_element.h
+++ b/third_party/blink/renderer/core/html/html_title_element.h

@@ -38,8 +38,8 @@
  private:
   explicit HTMLTitleElement(Document&);
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
   bool ignore_title_updates_when_children_change_;

diff --git a/third_party/blink/renderer/core/html/media/html_media_element.cc b/third_party/blink/renderer/core/html/media/html_media_element.cc
index 81168424..8131b5f7 100644
--- a/third_party/blink/renderer/core/html/media/html_media_element.cc
+++ b/third_party/blink/renderer/core/html/media/html_media_element.cc

@@ -689,12 +689,12 @@
 }
 
 Node::InsertionNotificationRequest HTMLMediaElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   BLINK_MEDIA_LOG << "insertedInto(" << (void*)this << ", " << insertion_point
                   << ")";
 
   HTMLElement::InsertedInto(insertion_point);
-  if (insertion_point->isConnected()) {
+  if (insertion_point.isConnected()) {
     UseCounter::Count(GetDocument(), WebFeature::kHTMLMediaElementInDocument);
     if ((!getAttribute(srcAttr).IsEmpty() || src_object_) &&
         network_state_ == kNetworkEmpty) {
@@ -710,12 +710,12 @@
   UpdateControlsVisibility();
 }
 
-void HTMLMediaElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLMediaElement::RemovedFrom(ContainerNode& insertion_point) {
   BLINK_MEDIA_LOG << "removedFrom(" << (void*)this << ", " << insertion_point
                   << ")";
 
   HTMLElement::RemovedFrom(insertion_point);
-  if (insertion_point->InActiveDocument()) {
+  if (insertion_point.InActiveDocument()) {
     UpdateControlsVisibility();
     if (network_state_ > kNetworkEmpty)
       PauseInternal();

diff --git a/third_party/blink/renderer/core/html/media/html_media_element.h b/third_party/blink/renderer/core/html/media/html_media_element.h
index 007c1bc..e8a8b97 100644
--- a/third_party/blink/renderer/core/html/media/html_media_element.h
+++ b/third_party/blink/renderer/core/html/media/html_media_element.h

@@ -344,8 +344,8 @@
   void CloneNonAttributePropertiesFrom(const Element&,
                                        CloneChildrenFlag) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   // Return true if media is cross origin from the current document
   // and has not passed a cors check, meaning that we should return

diff --git a/third_party/blink/renderer/core/html/media/html_video_element.cc b/third_party/blink/renderer/core/html/media/html_video_element.cc
index 17bdb87..99952223 100644
--- a/third_party/blink/renderer/core/html/media/html_video_element.cc
+++ b/third_party/blink/renderer/core/html/media/html_video_element.cc

@@ -108,14 +108,14 @@
 }
 
 Node::InsertionNotificationRequest HTMLVideoElement::InsertedInto(
-    ContainerNode* insertion_point) {
-  if (insertion_point->isConnected() && custom_controls_fullscreen_detector_)
+    ContainerNode& insertion_point) {
+  if (insertion_point.isConnected() && custom_controls_fullscreen_detector_)
     custom_controls_fullscreen_detector_->Attach();
 
   return HTMLMediaElement::InsertedInto(insertion_point);
 }
 
-void HTMLVideoElement::RemovedFrom(ContainerNode* insertion_point) {
+void HTMLVideoElement::RemovedFrom(ContainerNode& insertion_point) {
   HTMLMediaElement::RemovedFrom(insertion_point);
 
   if (custom_controls_fullscreen_detector_)

diff --git a/third_party/blink/renderer/core/html/media/html_video_element.h b/third_party/blink/renderer/core/html/media/html_video_element.h
index d4289e6..9f80cbf 100644
--- a/third_party/blink/renderer/core/html/media/html_video_element.h
+++ b/third_party/blink/renderer/core/html/media/html_video_element.h

@@ -58,8 +58,8 @@
   bool HasPendingActivity() const final;
 
   // Node override.
-  Node::InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  Node::InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   unsigned videoWidth() const;
   unsigned videoHeight() const;

diff --git a/third_party/blink/renderer/core/html/media/media_document.cc b/third_party/blink/renderer/core/html/media/media_document.cc
index 184bbfd..5263a79 100644
--- a/third_party/blink/renderer/core/html/media/media_document.cc
+++ b/third_party/blink/renderer/core/html/media/media_document.cc

@@ -137,23 +137,23 @@
   return MediaDocumentParser::Create(this);
 }
 
-void MediaDocument::DefaultEventHandler(Event* event) {
-  Node* target_node = event->target()->ToNode();
+void MediaDocument::DefaultEventHandler(Event& event) {
+  Node* target_node = event.target()->ToNode();
   if (!target_node)
     return;
 
-  if (event->type() == EventTypeNames::keydown && event->IsKeyboardEvent()) {
+  if (event.type() == EventTypeNames::keydown && event.IsKeyboardEvent()) {
     HTMLVideoElement* video =
         Traversal<HTMLVideoElement>::FirstWithin(*target_node);
     if (!video)
       return;
 
-    KeyboardEvent* keyboard_event = ToKeyboardEvent(event);
-    if (keyboard_event->key() == " " ||
-        keyboard_event->keyCode() == VKEY_MEDIA_PLAY_PAUSE) {
+    auto& keyboard_event = ToKeyboardEvent(event);
+    if (keyboard_event.key() == " " ||
+        keyboard_event.keyCode() == VKEY_MEDIA_PLAY_PAUSE) {
       // space or media key (play/pause)
       video->TogglePlayState();
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
     }
   }
 }

diff --git a/third_party/blink/renderer/core/html/media/media_document.h b/third_party/blink/renderer/core/html/media/media_document.h
index 7ed8b75..c877e11 100644
--- a/third_party/blink/renderer/core/html/media/media_document.h
+++ b/third_party/blink/renderer/core/html/media/media_document.h

@@ -41,7 +41,7 @@
 
   DocumentParser* CreateParser() override;
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.cc b/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.cc
index 5f760986..e0adc278 100644
--- a/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.cc
+++ b/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.cc

@@ -117,7 +117,7 @@
 }
 
 Node::InsertionNotificationRequest PictureInPictureInterstitial::InsertedInto(
-    ContainerNode* root) {
+    ContainerNode& root) {
   if (GetVideoElement().isConnected() && !resize_observer_) {
     resize_observer_ =
         ResizeObserver::Create(GetVideoElement().GetDocument(),
@@ -128,7 +128,7 @@
   return HTMLDivElement::InsertedInto(root);
 }
 
-void PictureInPictureInterstitial::RemovedFrom(ContainerNode*) {
+void PictureInPictureInterstitial::RemovedFrom(ContainerNode&) {
   DCHECK(!GetVideoElement().isConnected());
 
   if (resize_observer_) {

diff --git a/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.h b/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.h
index 991b29da..5cddd5d 100644
--- a/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.h
+++ b/third_party/blink/renderer/core/html/media/picture_in_picture_interstitial.h

@@ -36,8 +36,8 @@
   HTMLVideoElement& GetVideoElement() const { return *video_element_; }
 
   // Node override.
-  Node::InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  Node::InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   // Element:
   void Trace(blink::Visitor*) override;

diff --git a/third_party/blink/renderer/core/html/portal/html_portal_element.cc b/third_party/blink/renderer/core/html/portal/html_portal_element.cc
index b93a9d3..2cfa6ac4 100644
--- a/third_party/blink/renderer/core/html/portal/html_portal_element.cc
+++ b/third_party/blink/renderer/core/html/portal/html_portal_element.cc

@@ -25,12 +25,12 @@
 }
 
 HTMLPortalElement::InsertionNotificationRequest HTMLPortalElement::InsertedInto(
-    ContainerNode* node) {
+    ContainerNode& node) {
   auto result = HTMLFrameOwnerElement::InsertedInto(node);
 
   Document& document = GetDocument();
 
-  if (node->IsInDocumentTree() && document.IsHTMLDocument()) {
+  if (node.IsInDocumentTree() && document.IsHTMLDocument()) {
     document.GetFrame()->GetInterfaceProvider().GetInterface(
         mojo::MakeRequest(&portal_ptr_));
   }
@@ -38,12 +38,12 @@
   return result;
 }
 
-void HTMLPortalElement::RemovedFrom(ContainerNode* node) {
+void HTMLPortalElement::RemovedFrom(ContainerNode& node) {
   HTMLFrameOwnerElement::RemovedFrom(node);
 
   Document& document = GetDocument();
 
-  if (node->IsInDocumentTree() && document.IsHTMLDocument()) {
+  if (node.IsInDocumentTree() && document.IsHTMLDocument()) {
     portal_ptr_.reset();
   }
 }

diff --git a/third_party/blink/renderer/core/html/portal/html_portal_element.h b/third_party/blink/renderer/core/html/portal/html_portal_element.h
index e459eca..c9ad51f 100644
--- a/third_party/blink/renderer/core/html/portal/html_portal_element.h
+++ b/third_party/blink/renderer/core/html/portal/html_portal_element.h

@@ -33,8 +33,8 @@
   explicit HTMLPortalElement(Document&);
 
   // Node overrides
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   // HTMLFrameOwnerElement overrides
   ParsedFeaturePolicy ConstructContainerPolicy(Vector<String>*) const override {

diff --git a/third_party/blink/renderer/core/html/track/html_track_element.cc b/third_party/blink/renderer/core/html/track/html_track_element.cc
index 7e294424..8c92636 100644
--- a/third_party/blink/renderer/core/html/track/html_track_element.cc
+++ b/third_party/blink/renderer/core/html/track/html_track_element.cc

@@ -61,7 +61,7 @@
 HTMLTrackElement::~HTMLTrackElement() = default;
 
 Node::InsertionNotificationRequest HTMLTrackElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   DVLOG(TRACK_LOG_LEVEL) << "insertedInto";
 
   // Since we've moved to a new parent, we may now be able to load.
@@ -69,14 +69,14 @@
 
   HTMLElement::InsertedInto(insertion_point);
   HTMLMediaElement* parent = MediaElement();
-  if (insertion_point == parent)
+  if (&insertion_point == parent)
     parent->DidAddTrackElement(this);
   return kInsertionDone;
 }
 
-void HTMLTrackElement::RemovedFrom(ContainerNode* insertion_point) {
-  if (!parentNode() && IsHTMLMediaElement(*insertion_point))
-    ToHTMLMediaElement(insertion_point)->DidRemoveTrackElement(this);
+void HTMLTrackElement::RemovedFrom(ContainerNode& insertion_point) {
+  if (!parentNode() && IsHTMLMediaElement(insertion_point))
+    ToHTMLMediaElement(insertion_point).DidRemoveTrackElement(this);
   HTMLElement::RemovedFrom(insertion_point);
 }
 

diff --git a/third_party/blink/renderer/core/html/track/html_track_element.h b/third_party/blink/renderer/core/html/track/html_track_element.h
index f33b453..bce64ce 100644
--- a/third_party/blink/renderer/core/html/track/html_track_element.h
+++ b/third_party/blink/renderer/core/html/track/html_track_element.h

@@ -61,9 +61,9 @@
 
   void ParseAttribute(const AttributeModificationParams&) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
 
-  void RemovedFrom(ContainerNode*) override;
+  void RemovedFrom(ContainerNode&) override;
   bool IsURLAttribute(const Attribute&) const override;
 
   // TextTrackLoaderClient

diff --git a/third_party/blink/renderer/core/layout/api/line_layout_inline.h b/third_party/blink/renderer/core/layout/api/line_layout_inline.h
index b61921ec..885fd9b 100644
--- a/third_party/blink/renderer/core/layout/api/line_layout_inline.h
+++ b/third_party/blink/renderer/core/layout/api/line_layout_inline.h

@@ -63,7 +63,7 @@
     return ToInline()->LastLineBoxIncludingCulling();
   }
 
-  LineBoxList* LineBoxes() { return ToInline()->LineBoxes(); }
+  LineBoxList* LineBoxes() { return ToInline()->MutableLineBoxes(); }
 
   bool HitTestCulledInline(HitTestResult& result,
                            const HitTestLocation& location_in_container,

diff --git a/third_party/blink/renderer/core/layout/layout_block_flow.cc b/third_party/blink/renderer/core/layout/layout_block_flow.cc
index 0813f20..4f12cafb 100644
--- a/third_party/blink/renderer/core/layout/layout_block_flow.cc
+++ b/third_party/blink/renderer/core/layout/layout_block_flow.cc

@@ -274,7 +274,13 @@
   SetChildrenInline(true);
 }
 
+#if DCHECK_IS_ON()
+LayoutBlockFlow::~LayoutBlockFlow() {
+  line_boxes_.AssertIsEmpty();
+}
+#else
 LayoutBlockFlow::~LayoutBlockFlow() = default;
+#endif
 
 LayoutBlockFlow* LayoutBlockFlow::CreateAnonymous(
     Document* document,
@@ -2535,9 +2541,11 @@
                                             scoped_refptr<NGLayoutResult>) {}
 
 void LayoutBlockFlow::SetPaintFragment(
+    const NGBreakToken*,
     scoped_refptr<const NGPhysicalFragment>) {}
 
 void LayoutBlockFlow::UpdatePaintFragmentFromCachedLayoutResult(
+    const NGBreakToken*,
     scoped_refptr<const NGPhysicalFragment>) {}
 
 void LayoutBlockFlow::ComputeOverflow(LayoutUnit old_client_after_edge,

diff --git a/third_party/blink/renderer/core/layout/layout_block_flow.h b/third_party/blink/renderer/core/layout/layout_block_flow.h
index 5eb703ee..ce749445 100644
--- a/third_party/blink/renderer/core/layout/layout_block_flow.h
+++ b/third_party/blink/renderer/core/layout/layout_block_flow.h

@@ -460,10 +460,11 @@
                                      NGBreakToken*,
                                      scoped_refptr<NGLayoutResult>);
   virtual void WillCollectInlines() {}
-  virtual void SetPaintFragment(scoped_refptr<const NGPhysicalFragment>);
+  virtual void SetPaintFragment(const NGBreakToken*,
+                                scoped_refptr<const NGPhysicalFragment>);
   virtual void UpdatePaintFragmentFromCachedLayoutResult(
+      const NGBreakToken*,
       scoped_refptr<const NGPhysicalFragment>);
-  virtual void ClearPaintFragment() {}
   virtual const NGPhysicalBoxFragment* CurrentFragment() const {
     return nullptr;
   }

diff --git a/third_party/blink/renderer/core/layout/layout_box.cc b/third_party/blink/renderer/core/layout/layout_box.cc
index 06476d1..5815cfbe 100644
--- a/third_party/blink/renderer/core/layout/layout_box.cc
+++ b/third_party/blink/renderer/core/layout/layout_box.cc

@@ -2182,7 +2182,9 @@
 }
 
 void LayoutBox::DirtyLineBoxes(bool full_layout) {
-  if (inline_box_wrapper_) {
+  if (IsInLayoutNGInlineFormattingContext()) {
+    first_paint_fragment_ = nullptr;
+  } else if (inline_box_wrapper_) {
     if (full_layout) {
       inline_box_wrapper_->Destroy();
       inline_box_wrapper_ = nullptr;
@@ -2192,6 +2194,19 @@
   }
 }
 
+void LayoutBox::SetFirstInlineFragment(NGPaintFragment* fragment) {
+  CHECK(IsInLayoutNGInlineFormattingContext()) << *this;
+  first_paint_fragment_ = fragment;
+}
+
+void LayoutBox::InLayoutNGInlineFormattingContextWillChange(bool new_value) {
+  DeleteLineBoxWrapper();
+
+  // Because |first_paint_fragment_| and |inline_box_wrapper_| are union, when
+  // one is deleted, the other should be initialized to nullptr.
+  DCHECK(new_value ? !first_paint_fragment_ : !inline_box_wrapper_);
+}
+
 void LayoutBox::PositionLineBox(InlineBox* box) {
   if (IsOutOfFlowPositioned()) {
     // Cache the x position only if we were an INLINE type originally.
@@ -2240,7 +2255,9 @@
 }
 
 void LayoutBox::DeleteLineBoxWrapper() {
-  if (inline_box_wrapper_) {
+  if (IsInLayoutNGInlineFormattingContext()) {
+    first_paint_fragment_ = nullptr;
+  } else if (inline_box_wrapper_) {
     if (!DocumentBeingDestroyed())
       inline_box_wrapper_->Remove();
     inline_box_wrapper_->Destroy();

diff --git a/third_party/blink/renderer/core/layout/layout_box.h b/third_party/blink/renderer/core/layout/layout_box.h
index eaebbfe..0bb8a00 100644
--- a/third_party/blink/renderer/core/layout/layout_box.h
+++ b/third_party/blink/renderer/core/layout/layout_box.h

@@ -818,10 +818,16 @@
   // contains us. Enables the atomic inline LayoutObject to quickly determine
   // what line it is contained on and to easily iterate over structures on the
   // line.
-  InlineBox* InlineBoxWrapper() const { return inline_box_wrapper_; }
+  //
+  // InlineBoxWrapper() and FirstInlineFragment() are mutually exclusive,
+  // depends on IsInLayoutNGInlineFormattingContext().
+  InlineBox* InlineBoxWrapper() const;
   void SetInlineBoxWrapper(InlineBox*);
   void DeleteLineBoxWrapper();
 
+  NGPaintFragment* FirstInlineFragment() const final;
+  void SetFirstInlineFragment(NGPaintFragment*) final;
+
   void SetSpannerPlaceholder(LayoutMultiColumnSpannerPlaceholder&);
   void ClearSpannerPlaceholder();
   LayoutMultiColumnSpannerPlaceholder* SpannerPlaceholder() const final {
@@ -1458,6 +1464,8 @@
   void StyleDidChange(StyleDifference, const ComputedStyle* old_style) override;
   void UpdateFromStyle() override;
 
+  void InLayoutNGInlineFormattingContextWillChange(bool) final;
+
   virtual ItemPosition SelfAlignmentNormalBehavior(
       const LayoutBox* child = nullptr) const {
     DCHECK(!child);
@@ -1705,8 +1713,15 @@
         &LayoutBox::SetMarginBottom, &LayoutBox::SetMarginLeft);
   }
 
-  // The inline box containing this LayoutBox, for atomic inline elements.
-  InlineBox* inline_box_wrapper_;
+  union {
+    // The inline box containing this LayoutBox, for atomic inline elements.
+    // Valid only when !IsInLayoutNGInlineFormattingContext().
+    InlineBox* inline_box_wrapper_;
+    // The first fragment of the inline box containing this LayoutBox, for
+    // atomic inline elements. Valid only when
+    // IsInLayoutNGInlineFormattingContext().
+    NGPaintFragment* first_paint_fragment_;
+  };
 
   std::unique_ptr<LayoutBoxRareData> rare_data_;
 };
@@ -1767,7 +1782,13 @@
   return NextSiblingBox();
 }
 
+inline InlineBox* LayoutBox::InlineBoxWrapper() const {
+  return IsInLayoutNGInlineFormattingContext() ? nullptr : inline_box_wrapper_;
+}
+
 inline void LayoutBox::SetInlineBoxWrapper(InlineBox* box_wrapper) {
+  CHECK(!IsInLayoutNGInlineFormattingContext());
+
   if (box_wrapper) {
     DCHECK(!inline_box_wrapper_);
     // m_inlineBoxWrapper should already be nullptr. Deleting it is a safeguard
@@ -1782,6 +1803,11 @@
   inline_box_wrapper_ = box_wrapper;
 }
 
+inline NGPaintFragment* LayoutBox::FirstInlineFragment() const {
+  return IsInLayoutNGInlineFormattingContext() ? first_paint_fragment_
+                                               : nullptr;
+}
+
 inline bool LayoutBox::IsForcedFragmentainerBreakValue(
     EBreakBetween break_value) {
   return break_value == EBreakBetween::kColumn ||

diff --git a/third_party/blink/renderer/core/layout/layout_inline.cc b/third_party/blink/renderer/core/layout/layout_inline.cc
index 09e6e2c..44bc054 100644
--- a/third_party/blink/renderer/core/layout/layout_inline.cc
+++ b/third_party/blink/renderer/core/layout/layout_inline.cc

@@ -70,10 +70,18 @@
 static_assert(sizeof(LayoutInline) == sizeof(SameSizeAsLayoutInline),
               "LayoutInline should stay small");
 
-LayoutInline::LayoutInline(Element* element) : LayoutBoxModelObject(element) {
+LayoutInline::LayoutInline(Element* element)
+    : LayoutBoxModelObject(element), line_boxes_() {
   SetChildrenInline(true);
 }
 
+#if DCHECK_IS_ON()
+LayoutInline::~LayoutInline() {
+  if (!IsInLayoutNGInlineFormattingContext())
+    line_boxes_.AssertIsEmpty();
+}
+#endif
+
 LayoutInline* LayoutInline::CreateAnonymous(Document* document) {
   LayoutInline* layout_inline = new LayoutInline(nullptr);
   layout_inline->SetDocumentForAnonymous(document);
@@ -119,11 +127,31 @@
     }
   }
 
-  line_boxes_.DeleteLineBoxes();
+  DeleteLineBoxes();
 
   LayoutBoxModelObject::WillBeDestroyed();
 }
 
+void LayoutInline::DeleteLineBoxes() {
+  if (IsInLayoutNGInlineFormattingContext())
+    first_paint_fragment_ = nullptr;
+  else
+    MutableLineBoxes()->DeleteLineBoxes();
+}
+
+void LayoutInline::SetFirstInlineFragment(NGPaintFragment* fragment) {
+  CHECK(IsInLayoutNGInlineFormattingContext());
+  first_paint_fragment_ = fragment;
+}
+
+void LayoutInline::InLayoutNGInlineFormattingContextWillChange(bool new_value) {
+  DeleteLineBoxes();
+
+  // Because |first_paint_fragment_| and |line_boxes_| are union, when one is
+  // deleted, the other should be initialized to nullptr.
+  DCHECK(new_value ? !first_paint_fragment_ : !line_boxes_.First());
+}
+
 LayoutInline* LayoutInline::InlineElementContinuation() const {
   LayoutBoxModelObject* continuation = Continuation();
   if (!continuation || continuation->IsInline())
@@ -901,9 +929,9 @@
     return false;
   }
 
-  return line_boxes_.HitTest(LineLayoutBoxModel(this), result,
-                             location_in_container, accumulated_offset,
-                             hit_test_action);
+  return LineBoxes()->HitTest(LineLayoutBoxModel(this), result,
+                              location_in_container, accumulated_offset,
+                              hit_test_action);
 }
 
 namespace {
@@ -1400,7 +1428,7 @@
 
 void LayoutInline::DirtyLineBoxes(bool full_layout) {
   if (full_layout) {
-    line_boxes_.DeleteLineBoxes();
+    DeleteLineBoxes();
     return;
   }
 
@@ -1427,7 +1455,7 @@
       }
     }
   } else {
-    line_boxes_.DirtyLineBoxes();
+    MutableLineBoxes()->DirtyLineBoxes();
   }
 }
 
@@ -1438,20 +1466,18 @@
 InlineFlowBox* LayoutInline::CreateAndAppendInlineFlowBox() {
   SetAlwaysCreateLineBoxes();
   InlineFlowBox* flow_box = CreateInlineFlowBox();
-  line_boxes_.AppendLineBox(flow_box);
+  MutableLineBoxes()->AppendLineBox(flow_box);
   return flow_box;
 }
 
 void LayoutInline::DirtyLinesFromChangedChild(
     LayoutObject* child,
     MarkingBehavior marking_behavior) {
-  // During layout tree construction, we can't detect whether this node is
-  // in LayoutNG or not.
-  if (Parent() && EnclosingNGBlockFlow()) {
+  if (IsInLayoutNGInlineFormattingContext()) {
     SetAncestorLineBoxDirty();
     return;
   }
-  line_boxes_.DirtyLinesFromChangedChild(
+  MutableLineBoxes()->DirtyLinesFromChangedChild(
       LineLayoutItem(this), LineLayoutItem(child),
       marking_behavior == kMarkContainerChain);
 }

diff --git a/third_party/blink/renderer/core/layout/layout_inline.h b/third_party/blink/renderer/core/layout/layout_inline.h
index c9ebb0b..ce62205 100644
--- a/third_party/blink/renderer/core/layout/layout_inline.h
+++ b/third_party/blink/renderer/core/layout/layout_inline.h

@@ -116,6 +116,10 @@
  public:
   explicit LayoutInline(Element*);
 
+#if DCHECK_IS_ON()
+  ~LayoutInline() override;
+#endif
+
   static LayoutInline* CreateAnonymous(Document*);
 
   LayoutObject* FirstChild() const {
@@ -158,11 +162,16 @@
 
   void DirtyLineBoxes(bool full_layout);
 
-  LineBoxList* LineBoxes() { return &line_boxes_; }
-  const LineBoxList* LineBoxes() const { return &line_boxes_; }
+  // LineBoxes() and FirstInlineFragment() are mutually exclusive,
+  // depends on IsInLayoutNGInlineFormattingContext().
+  const LineBoxList* LineBoxes() const {
+    return IsInLayoutNGInlineFormattingContext() ? &LineBoxList::Empty()
+                                                 : &line_boxes_;
+  }
+  LineBoxList* MutableLineBoxes();
 
-  InlineFlowBox* FirstLineBox() const { return line_boxes_.First(); }
-  InlineFlowBox* LastLineBox() const { return line_boxes_.Last(); }
+  InlineFlowBox* FirstLineBox() const { return LineBoxes()->First(); }
+  InlineFlowBox* LastLineBox() const { return LineBoxes()->Last(); }
   InlineBox* FirstLineBoxIncludingCulling() const {
     return AlwaysCreateLineBoxes() ? FirstLineBox()
                                    : CulledInlineFirstLineBox();
@@ -171,6 +180,9 @@
     return AlwaysCreateLineBoxes() ? LastLineBox() : CulledInlineLastLineBox();
   }
 
+  NGPaintFragment* FirstInlineFragment() const final;
+  void SetFirstInlineFragment(NGPaintFragment*) final;
+
   LayoutBoxModelObject* VirtualContinuation() const final {
     return Continuation();
   }
@@ -229,6 +241,10 @@
  protected:
   void WillBeDestroyed() override;
 
+  void InLayoutNGInlineFormattingContextWillChange(bool) final;
+
+  void DeleteLineBoxes();
+
   void StyleDidChange(StyleDifference, const ComputedStyle* old_style) override;
 
   void ComputeSelfHitTestRects(Vector<LayoutRect>& rects,
@@ -353,11 +369,28 @@
   LayoutBoxModelObject* ContinuationBefore(LayoutObject* before_child);
 
   LayoutObjectChildList children_;
-  // All of the line boxes created for this inline flow. For example,
-  // <i>Hello<br>world.</i> will have two <i> line boxes.
-  LineBoxList line_boxes_;
+
+  union {
+    // All of the line boxes created for this inline flow. For example,
+    // <i>Hello<br>world.</i> will have two <i> line boxes.
+    // Valid only when !IsInLayoutNGInlineFormattingContext().
+    LineBoxList line_boxes_;
+    // The first fragment of inline boxes associated with this object.
+    // Valid only when IsInLayoutNGInlineFormattingContext().
+    NGPaintFragment* first_paint_fragment_;
+  };
 };
 
+inline LineBoxList* LayoutInline::MutableLineBoxes() {
+  CHECK(!IsInLayoutNGInlineFormattingContext());
+  return &line_boxes_;
+}
+
+inline NGPaintFragment* LayoutInline::FirstInlineFragment() const {
+  return IsInLayoutNGInlineFormattingContext() ? first_paint_fragment_
+                                               : nullptr;
+}
+
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutInline, IsLayoutInline());
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/layout/layout_object.h b/third_party/blink/renderer/core/layout/layout_object.h
index 6bee3a61..17e9e4d7 100644
--- a/third_party/blink/renderer/core/layout/layout_object.h
+++ b/third_party/blink/renderer/core/layout/layout_object.h

@@ -72,6 +72,7 @@
 class LayoutMultiColumnSpannerPlaceholder;
 class LayoutView;
 class LocalFrameView;
+class NGPaintFragment;
 class NGPhysicalBoxFragment;
 class PaintLayer;
 class PseudoStyleRequest;
@@ -843,6 +844,9 @@
   bool IsText() const { return bitfields_.IsText(); }
   bool IsBox() const { return bitfields_.IsBox(); }
   bool IsInline() const { return bitfields_.IsInline(); }  // inline object
+  bool IsInLayoutNGInlineFormattingContext() const {
+    return bitfields_.IsInLayoutNGInlineFormattingContext();
+  }
   bool IsAtomicInlineLevel() const { return bitfields_.IsAtomicInlineLevel(); }
   bool IsHorizontalWritingMode() const {
     return bitfields_.HorizontalWritingMode();
@@ -1123,6 +1127,10 @@
   void SetFloating(bool is_floating) { bitfields_.SetFloating(is_floating); }
   void SetInline(bool is_inline) { bitfields_.SetIsInline(is_inline); }
 
+  void SetIsInLayoutNGInlineFormattingContext(bool);
+  virtual NGPaintFragment* FirstInlineFragment() const { return nullptr; }
+  virtual void SetFirstInlineFragment(NGPaintFragment*) {}
+
   void SetHasBoxDecorationBackground(bool);
 
   enum BackgroundObscurationState {
@@ -2168,6 +2176,8 @@
   // changes at all).
   virtual bool AnonymousHasStylePropagationOverride() { return false; }
 
+  virtual void InLayoutNGInlineFormattingContextWillChange(bool) {}
+
   // A fast path for MapToVisualRectInAncestorSpace for when GeometryMapper
   // can be used. |intersects| is set to whether the input rect intersected
   // (see documentation of return value of MapToVisualRectInAncestorSpace).
@@ -2420,6 +2430,7 @@
           is_text_(false),
           is_box_(false),
           is_inline_(true),
+          is_in_layout_ng_inline_formatting_context_(false),
           is_atomic_inline_level_(false),
           horizontal_writing_mode_(true),
           has_layer_(false),
@@ -2549,6 +2560,12 @@
     // siblings (think of paragraphs).
     ADD_BOOLEAN_BITFIELD(is_inline_, IsInline);
 
+    // This boolean is set when this LayoutObject is in LayoutNG inline
+    // formatting context. Note, this LayoutObject itself may be laid out by
+    // legacy.
+    ADD_BOOLEAN_BITFIELD(is_in_layout_ng_inline_formatting_context_,
+                         IsInLayoutNGInlineFormattingContext);
+
     // This boolean is set if the element is an atomic inline-level box.
     //
     // In CSS, atomic inline-level boxes are laid out on a line but they
@@ -2894,6 +2911,14 @@
     MarkContainerChainForLayout();
 }
 
+inline void LayoutObject::SetIsInLayoutNGInlineFormattingContext(
+    bool new_value) {
+  if (IsInLayoutNGInlineFormattingContext() == new_value)
+    return;
+  InLayoutNGInlineFormattingContextWillChange(new_value);
+  bitfields_.SetIsInLayoutNGInlineFormattingContext(new_value);
+}
+
 inline void LayoutObject::SetHasBoxDecorationBackground(bool b) {
   if (b == bitfields_.HasBoxDecorationBackground())
     return;

diff --git a/third_party/blink/renderer/core/layout/layout_text.cc b/third_party/blink/renderer/core/layout/layout_text.cc
index 49c5c716..61df7611 100644
--- a/third_party/blink/renderer/core/layout/layout_text.cc
+++ b/third_party/blink/renderer/core/layout/layout_text.cc

@@ -132,7 +132,8 @@
       max_width_(-1),
       first_line_min_width_(0),
       last_line_line_min_width_(0),
-      text_(std::move(str)) {
+      text_(std::move(str)),
+      text_boxes_() {
   DCHECK(text_);
   DCHECK(!node || !node->IsDocumentNode());
 
@@ -142,6 +143,13 @@
     GetFrameView()->IncrementVisuallyNonEmptyCharacterCount(text_.length());
 }
 
+#if DCHECK_IS_ON()
+LayoutText::~LayoutText() {
+  if (!IsInLayoutNGInlineFormattingContext())
+    text_boxes_.AssertIsEmpty();
+}
+#endif
+
 LayoutText* LayoutText::CreateEmptyAnonymous(
     Document& doc,
     scoped_refptr<ComputedStyle> style) {
@@ -223,19 +231,35 @@
 }
 
 void LayoutText::ExtractTextBox(InlineTextBox* box) {
-  text_boxes_.ExtractLineBox(box);
+  MutableTextBoxes().ExtractLineBox(box);
 }
 
 void LayoutText::AttachTextBox(InlineTextBox* box) {
-  text_boxes_.AttachLineBox(box);
+  MutableTextBoxes().AttachLineBox(box);
 }
 
 void LayoutText::RemoveTextBox(InlineTextBox* box) {
-  text_boxes_.RemoveLineBox(box);
+  MutableTextBoxes().RemoveLineBox(box);
 }
 
 void LayoutText::DeleteTextBoxes() {
-  text_boxes_.DeleteLineBoxes();
+  if (IsInLayoutNGInlineFormattingContext())
+    first_paint_fragment_ = nullptr;
+  else
+    MutableTextBoxes().DeleteLineBoxes();
+}
+
+void LayoutText::SetFirstInlineFragment(NGPaintFragment* fragment) {
+  CHECK(IsInLayoutNGInlineFormattingContext());
+  first_paint_fragment_ = fragment;
+}
+
+void LayoutText::InLayoutNGInlineFormattingContextWillChange(bool new_value) {
+  DeleteTextBoxes();
+
+  // Because |first_paint_fragment_| and |text_boxes_| are union, when one is
+  // deleted, the other should be initialized to nullptr.
+  DCHECK(new_value ? !first_paint_fragment_ : !text_boxes_.First());
 }
 
 Vector<LayoutText::TextBoxInfo> LayoutText::GetTextBoxInfo() const {
@@ -1807,7 +1831,7 @@
 InlineTextBox* LayoutText::CreateInlineTextBox(int start,
                                                unsigned short length) {
   InlineTextBox* text_box = CreateTextBox(start, length);
-  text_boxes_.AppendLineBox(text_box);
+  MutableTextBoxes().AppendLineBox(text_box);
   return text_box;
 }
 
@@ -1818,7 +1842,7 @@
   if (!s->Len()) {
     // We want the box to be destroyed.
     s->Remove(kDontMarkLineBoxes);
-    text_boxes_.RemoveLineBox(s);
+    MutableTextBoxes().RemoveLineBox(s);
     s->Destroy();
     return;
   }

diff --git a/third_party/blink/renderer/core/layout/layout_text.h b/third_party/blink/renderer/core/layout/layout_text.h
index fcf74cef..36a11637 100644
--- a/third_party/blink/renderer/core/layout/layout_text.h
+++ b/third_party/blink/renderer/core/layout/layout_text.h

@@ -77,6 +77,10 @@
   // doesn't re-transform the string.
   LayoutText(Node*, scoped_refptr<StringImpl>);
 
+#if DCHECK_IS_ON()
+  ~LayoutText() override;
+#endif
+
   static LayoutText* CreateEmptyAnonymous(Document&,
                                           scoped_refptr<ComputedStyle>);
 
@@ -91,6 +95,9 @@
   void AttachTextBox(InlineTextBox*);
   void RemoveTextBox(InlineTextBox*);
 
+  NGPaintFragment* FirstInlineFragment() const final;
+  void SetFirstInlineFragment(NGPaintFragment*) final;
+
   const String& GetText() const { return text_; }
   virtual unsigned TextStartOffset() const { return 0; }
   String PlainText() const;
@@ -205,13 +212,18 @@
       int caret_offset,
       LayoutUnit* extra_width_to_end_of_line = nullptr) const override;
 
-  const InlineTextBoxList& TextBoxes() const { return text_boxes_; }
+  // TextBoxes() and FirstInlineFragment() are mutually exclusive,
+  // depends on IsInLayoutNGInlineFormattingContext().
+  const InlineTextBoxList& TextBoxes() const {
+    return IsInLayoutNGInlineFormattingContext() ? InlineTextBoxList::Empty()
+                                                 : text_boxes_;
+  }
 
   // Returns first |InlineTextBox| produces for associated |Node|.
   // Note: When |this| is remaining part of ::first-letter, this function
   // returns first-letter part of |InlineTextBox| instead of remaining part.
-  InlineTextBox* FirstTextBox() const { return text_boxes_.First(); }
-  InlineTextBox* LastTextBox() const { return text_boxes_.Last(); }
+  InlineTextBox* FirstTextBox() const { return TextBoxes().First(); }
+  InlineTextBox* LastTextBox() const { return TextBoxes().Last(); }
 
   // Returns upper left corner point in local physical coordinates with flipped
   // block-flow direction if this object has rendered text.
@@ -310,6 +322,8 @@
   void StyleWillChange(StyleDifference, const ComputedStyle&) final {}
   void StyleDidChange(StyleDifference, const ComputedStyle* old_style) override;
 
+  void InLayoutNGInlineFormattingContextWillChange(bool) final;
+
   void AddLayerHitTestRects(
       LayerHitTestRects&,
       const PaintLayer* current_layer,
@@ -327,6 +341,8 @@
   bool CanBeSelectionLeafInternal() const final { return true; }
 
  private:
+  InlineTextBoxList& MutableTextBoxes();
+
   void AccumlateQuads(Vector<FloatQuad>&,
                       const IntRect& ellipsis_rect,
                       LocalOrAbsoluteOption,
@@ -411,11 +427,27 @@
 
   String text_;
 
-  // The line boxes associated with this object.
-  // Read the LINE BOXES OWNERSHIP section in the class header comment.
-  InlineTextBoxList text_boxes_;
+  union {
+    // The line boxes associated with this object.
+    // Read the LINE BOXES OWNERSHIP section in the class header comment.
+    // Valid only when !IsInLayoutNGInlineFormattingContext().
+    InlineTextBoxList text_boxes_;
+    // The first fragment of text boxes associated with this object.
+    // Valid only when IsInLayoutNGInlineFormattingContext().
+    NGPaintFragment* first_paint_fragment_;
+  };
 };
 
+inline InlineTextBoxList& LayoutText::MutableTextBoxes() {
+  CHECK(!IsInLayoutNGInlineFormattingContext());
+  return text_boxes_;
+}
+
+inline NGPaintFragment* LayoutText::FirstInlineFragment() const {
+  return IsInLayoutNGInlineFormattingContext() ? first_paint_fragment_
+                                               : nullptr;
+}
+
 inline UChar LayoutText::UncheckedCharacterAt(unsigned i) const {
   SECURITY_DCHECK(i < TextLength());
   return Is8Bit() ? Characters8()[i] : Characters16()[i];

diff --git a/third_party/blink/renderer/core/layout/line/line_box_list.cc b/third_party/blink/renderer/core/layout/line/line_box_list.cc
index c780319..68c362d 100644
--- a/third_party/blink/renderer/core/layout/line/line_box_list.cc
+++ b/third_party/blink/renderer/core/layout/line/line_box_list.cc

@@ -39,14 +39,27 @@
 #include "third_party/blink/renderer/core/paint/paint_info.h"
 
 namespace blink {
+
 #if DCHECK_IS_ON()
 template <typename InlineBoxType>
-InlineBoxList<InlineBoxType>::~InlineBoxList() {
+void InlineBoxList<InlineBoxType>::AssertIsEmpty() {
   DCHECK(!first_);
   DCHECK(!last_);
 }
 #endif
 
+const LineBoxList& LineBoxList::Empty() {
+  // Need to use "static" because DISALLOW_NEW.
+  static LineBoxList empty;
+  return empty;
+}
+
+const InlineTextBoxList& InlineTextBoxList::Empty() {
+  // Need to use "static" because DISALLOW_NEW.
+  static InlineTextBoxList empty;
+  return empty;
+}
+
 template <typename InlineBoxType>
 void InlineBoxList<InlineBoxType>::AppendLineBox(InlineBoxType* box) {
   if (!first_) {

diff --git a/third_party/blink/renderer/core/layout/line/line_box_list.h b/third_party/blink/renderer/core/layout/line/line_box_list.h
index 9bb03d9..969f137b 100644
--- a/third_party/blink/renderer/core/layout/line/line_box_list.h
+++ b/third_party/blink/renderer/core/layout/line/line_box_list.h

@@ -54,7 +54,9 @@
   InlineBoxList() : first_(nullptr), last_(nullptr) {}
 
 #if DCHECK_IS_ON()
-  ~InlineBoxList();
+  // Owners should check this on destructor. This class does not implement
+  // destructor to be part of a union.
+  void AssertIsEmpty();
 #endif
 
   InlineBoxType* First() const { return first_; }
@@ -139,8 +141,10 @@
 extern template class CORE_EXTERN_TEMPLATE_EXPORT InlineBoxList<InlineFlowBox>;
 extern template class CORE_EXTERN_TEMPLATE_EXPORT InlineBoxList<InlineTextBox>;
 
-class LineBoxList : public InlineBoxList<InlineFlowBox> {
+class CORE_EXPORT LineBoxList : public InlineBoxList<InlineFlowBox> {
  public:
+  static const LineBoxList& Empty();
+
   void DeleteLineBoxTree();
 
   void DirtyLineBoxes();
@@ -169,7 +173,10 @@
                            const LayoutPoint&) const;
 };
 
-class InlineTextBoxList : public InlineBoxList<InlineTextBox> {};
+class CORE_EXPORT InlineTextBoxList : public InlineBoxList<InlineTextBox> {
+ public:
+  static const InlineTextBoxList& Empty();
+};
 
 }  // namespace blink
 

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
index d797831d..6e4b51a9 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc

@@ -48,21 +48,26 @@
   return count * 4;
 }
 
-// Templated helper function for CollectInlinesInternal().
-template <typename OffsetMappingBuilder>
-void ClearNeedsLayoutIfUpdatingLayout(LayoutObject* node) {
-  node->ClearNeedsLayout();
-  node->ClearNeedsCollectInlines();
+// Ensure this LayoutObject IsInLayoutNGInlineFormattingContext and does not
+// have associated NGPaintFragment.
+void ClearInlineFragment(LayoutObject* object) {
+  object->SetIsInLayoutNGInlineFormattingContext(true);
+  object->SetFirstInlineFragment(nullptr);
+}
+
+void ClearNeedsLayout(LayoutObject* object) {
+  object->ClearNeedsLayout();
+  object->ClearNeedsCollectInlines();
+
+  ClearInlineFragment(object);
+
   // Reset previous items if they cannot be reused to prevent stale items
   // for subsequent layouts. Items that can be reused have already been
   // added to the builder.
-  if (node->IsLayoutNGText())
-    ToLayoutNGText(node)->ClearInlineItems();
+  if (object->IsLayoutNGText())
+    ToLayoutNGText(object)->ClearInlineItems();
 }
 
-template <>
-void ClearNeedsLayoutIfUpdatingLayout<NGOffsetMappingBuilder>(LayoutObject*) {}
-
 // The function is templated to indicate the purpose of collected inlines:
 // - With EmptyOffsetMappingBuilder: updating layout;
 // - With NGOffsetMappingBuilder: building offset mapping on clean layout.
@@ -77,7 +82,8 @@
 void CollectInlinesInternal(
     LayoutBlockFlow* block,
     NGInlineItemsBuilderTemplate<OffsetMappingBuilder>* builder,
-    String* previous_text) {
+    String* previous_text,
+    bool update_layout) {
   builder->EnterBlock(block->Style());
   LayoutObject* node = GetLayoutObjectForFirstChildNode(block);
 
@@ -109,7 +115,8 @@
       if (symbol == layout_text)
         builder->SetIsSymbolMarker(true);
 
-      ClearNeedsLayoutIfUpdatingLayout<OffsetMappingBuilder>(layout_text);
+      if (update_layout)
+        ClearNeedsLayout(layout_text);
 
     } else if (node->IsFloating()) {
       // Add floats and positioned objects in the same way as atomic inlines.
@@ -133,6 +140,9 @@
         // signal the presence of a non-text object to the unicode bidi
         // algorithm.
         builder->AppendAtomicInline(node->Style(), node);
+
+        if (update_layout)
+          ClearInlineFragment(node);
       }
 
     } else {
@@ -147,13 +157,13 @@
       if (LayoutObject* child = node->SlowFirstChild()) {
         node = child;
         continue;
-
-      } else {
-        // An empty inline node.
-        ClearNeedsLayoutIfUpdatingLayout<OffsetMappingBuilder>(node);
       }
 
+      // An empty inline node.
       builder->ExitInline(node);
+
+      if (update_layout)
+        ClearNeedsLayout(node);
     }
 
     // Find the next sibling, or parent, until we reach |block|.
@@ -170,7 +180,9 @@
       }
       DCHECK(node->IsInline());
       builder->ExitInline(node);
-      ClearNeedsLayoutIfUpdatingLayout<OffsetMappingBuilder>(node);
+
+      if (update_layout)
+        ClearNeedsLayout(node);
     }
   }
   builder->ExitBlock();
@@ -293,7 +305,9 @@
     Vector<NGInlineItem> items;
     items.ReserveCapacity(EstimateInlineItemsCount(*GetLayoutBlockFlow()));
     NGInlineItemsBuilderForOffsetMapping builder(&items);
-    CollectInlinesInternal(GetLayoutBlockFlow(), &builder, nullptr);
+    const bool update_layout = false;
+    CollectInlinesInternal(GetLayoutBlockFlow(), &builder, nullptr,
+                           update_layout);
     String text = builder.ToString();
     DCHECK_EQ(data->text_content, text);
 
@@ -323,7 +337,8 @@
       previous_data ? &previous_data->text_content : nullptr;
   data->items.ReserveCapacity(EstimateInlineItemsCount(*block));
   NGInlineItemsBuilder builder(&data->items);
-  CollectInlinesInternal(block, &builder, previous_text);
+  const bool update_layout = true;
+  CollectInlinesInternal(block, &builder, previous_text, update_layout);
   data->text_content = builder.ToString();
 
   // Set |is_bidi_enabled_| for all UTF-16 strings for now, because at this
@@ -648,13 +663,42 @@
   }
 }
 
+// Clear associated fragments for all LayoutObjects. They are associated when
+// NGPaintFragment is constructed.
+void NGInlineNode::ClearAssociatedFragments(NGInlineBreakToken* break_token) {
+  if (!IsPrepareLayoutFinished())
+    return;
+
+  LayoutObject* last_object = nullptr;
+  const Vector<NGInlineItem>& items = Data().items;
+  for (unsigned i = break_token ? break_token->ItemIndex() : 0;
+       i < items.size(); i++) {
+    const NGInlineItem& item = items[i];
+    if (item.Type() == NGInlineItem::kFloating ||
+        item.Type() == NGInlineItem::kOutOfFlowPositioned ||
+        item.Type() == NGInlineItem::kListMarker)
+      continue;
+    LayoutObject* object = item.GetLayoutObject();
+    if (!object || object == last_object)
+      continue;
+    object->SetFirstInlineFragment(nullptr);
+    last_object = object;
+  }
+}
+
 scoped_refptr<NGLayoutResult> NGInlineNode::Layout(
     const NGConstraintSpace& constraint_space,
     NGBreakToken* break_token) {
+  bool needs_clear_fragments = IsPrepareLayoutFinished();
   PrepareLayoutIfNeeded();
 
+  NGInlineBreakToken* inline_break_token = ToNGInlineBreakToken(break_token);
+  if (needs_clear_fragments && !constraint_space.IsIntermediateLayout()) {
+    ClearAssociatedFragments(inline_break_token);
+  }
+
   NGInlineLayoutAlgorithm algorithm(*this, constraint_space,
-                                    ToNGInlineBreakToken(break_token));
+                                    inline_break_token);
   return algorithm.Layout();
 }
 

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.h b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.h
index 76843ec..9ea381d 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.h

@@ -14,6 +14,7 @@
 namespace blink {
 
 class NGConstraintSpace;
+class NGInlineBreakToken;
 class NGInlineItem;
 class NGLayoutResult;
 class NGOffsetMapping;
@@ -93,6 +94,8 @@
   void ShapeTextForFirstLineIfNeeded(NGInlineNodeData*);
   void AssociateItemsWithInlines(NGInlineNodeData*);
 
+  void ClearAssociatedFragments(NGInlineBreakToken*);
+
   NGInlineNodeData* MutableData();
   const NGInlineNodeData& Data() const;
   const NGInlineNodeData& EnsureData();

diff --git a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
index 37d63ad..3bfef2d3 100644
--- a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
+++ b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc

@@ -261,30 +261,72 @@
 
 template <typename Base>
 void LayoutNGMixin<Base>::SetPaintFragment(
+    NGPaintFragment* last_paint_fragment,
+    std::unique_ptr<NGPaintFragment> paint_fragment) {
+  if (paint_fragment) {
+    // When paint fragment is replaced, the subtree needs paint invalidation to
+    // re-compute paint properties in NGPaintFragment.
+    Base::SetSubtreeShouldDoFullPaintInvalidation();
+  }
+
+  if (last_paint_fragment) {
+    last_paint_fragment->SetNext(std::move(paint_fragment));
+  } else {
+    paint_fragment_ = std::move(paint_fragment);
+  }
+}
+
+template <typename Base>
+void LayoutNGMixin<Base>::SetPaintFragment(
+    const NGBreakToken* break_token,
     scoped_refptr<const NGPhysicalFragment> fragment) {
-  DCHECK(fragment);
-
-  paint_fragment_ = NGPaintFragment::Create(std::move(fragment));
-
-  // When paint fragment is replaced, the subtree needs paint invalidation to
-  // re-compute paint properties in NGPaintFragment.
-  Base::SetSubtreeShouldDoFullPaintInvalidation();
+  // TODO(kojii): There are cases where the first call has break_token.
+  // Investigate why and handle appropriately.
+  // DCHECK(!break_token || paint_fragment_);
+  NGPaintFragment* last_paint_fragment = nullptr;
+  if (break_token && paint_fragment_) {
+    last_paint_fragment = paint_fragment_->Last(*break_token);
+    // TODO(kojii): Sometimes an unknown break_token is given. Need to
+    // investigate why, and handle appropriately. For now, just keep it to avoid
+    // crashes and use-after-free.
+    if (!last_paint_fragment)
+      last_paint_fragment = paint_fragment_->Last();
+    DCHECK(last_paint_fragment);
+  }
+  SetPaintFragment(last_paint_fragment,
+                   fragment ? NGPaintFragment::Create(fragment) : nullptr);
 }
 
 template <typename Base>
 void LayoutNGMixin<Base>::UpdatePaintFragmentFromCachedLayoutResult(
+    const NGBreakToken* break_token,
     scoped_refptr<const NGPhysicalFragment> fragment) {
   DCHECK(fragment);
+  // TODO(kojii): There are cases where the first call has break_token.
+  // Investigate why and handle appropriately.
+  // DCHECK(!break_token || paint_fragment_);
+  NGPaintFragment* paint_fragment = nullptr;
+  NGPaintFragment* last_paint_fragment = nullptr;
+  if (!break_token) {
+    paint_fragment = paint_fragment_.get();
+  } else if (paint_fragment_) {
+    last_paint_fragment = paint_fragment_->Last(*break_token);
+    // TODO(kojii): Sometimes an unknown break_token is given. Need to
+    // investigate why, and handle appropriately. For now, just keep it to avoid
+    // crashes and use-after-free.
+    if (!last_paint_fragment)
+      last_paint_fragment = paint_fragment_->Last();
+    DCHECK(last_paint_fragment);
+    paint_fragment = last_paint_fragment->Next();
+  }
 
-  if (!paint_fragment_)
-    return SetPaintFragment(fragment);
+  if (!paint_fragment) {
+    SetPaintFragment(last_paint_fragment,
+                     NGPaintFragment::Create(std::move(fragment)));
+    return;
+  }
 
-  paint_fragment_->UpdatePhysicalFragmentFromCachedLayoutResult(fragment);
-}
-
-template <typename Base>
-void LayoutNGMixin<Base>::ClearPaintFragment() {
-  paint_fragment_ = nullptr;
+  paint_fragment->UpdatePhysicalFragmentFromCachedLayoutResult(fragment);
 }
 
 template <typename Base>

diff --git a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.h b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.h
index 807454bf..27e2eb85 100644
--- a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.h
+++ b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.h

@@ -70,10 +70,11 @@
   NGPaintFragment* PaintFragment() const override {
     return paint_fragment_.get();
   }
-  void SetPaintFragment(scoped_refptr<const NGPhysicalFragment>) final;
+  void SetPaintFragment(const NGBreakToken*,
+                        scoped_refptr<const NGPhysicalFragment>) final;
   void UpdatePaintFragmentFromCachedLayoutResult(
+      const NGBreakToken*,
       scoped_refptr<const NGPhysicalFragment>) final;
-  void ClearPaintFragment() final;
 
  protected:
   bool IsOfType(LayoutObject::LayoutObjectType) const override;
@@ -82,6 +83,8 @@
 
  private:
   void AddScrollingOverflowFromChildren();
+  void SetPaintFragment(NGPaintFragment* last_paint_fragment,
+                        std::unique_ptr<NGPaintFragment>);
 
  protected:
   void AddOutlineRects(

diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
index 1c399d52..f2fb036 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc

@@ -218,7 +218,7 @@
       if (!constraint_space.IsIntermediateLayout() && first_child &&
           first_child.IsInline()) {
         block_flow->UpdatePaintFragmentFromCachedLayoutResult(
-            layout_result->PhysicalFragment());
+            break_token, layout_result->PhysicalFragment());
       }
       return layout_result;
     }
@@ -261,7 +261,7 @@
                                       layout_result);
     if (layout_result->Status() == NGLayoutResult::kSuccess &&
         !constraint_space.IsIntermediateLayout())
-      block_flow->ClearPaintFragment();
+      block_flow->SetPaintFragment(break_token, nullptr);
   }
 
   if (IsBlockLayoutComplete(constraint_space, *layout_result)) {
@@ -275,7 +275,8 @@
               scrollbars.block_start,
           Style().IsFlippedBlocksWritingMode());
 
-      block_flow->SetPaintFragment(layout_result->PhysicalFragment());
+      block_flow->SetPaintFragment(break_token,
+                                   layout_result->PhysicalFragment());
     }
 
     // TODO(kojii): Even when we paint fragments, there seem to be some data we

diff --git a/third_party/blink/renderer/core/loader/http_equiv.cc b/third_party/blink/renderer/core/loader/http_equiv.cc
index fb240b62..befb7ae 100644
--- a/third_party/blink/renderer/core/loader/http_equiv.cc
+++ b/third_party/blink/renderer/core/loader/http_equiv.cc

@@ -205,12 +205,6 @@
                       WebFeature::kMetaSetCookieWhenCSPBlocksInlineScript);
   }
 
-  if (!RuntimeEnabledFeatures::BlockMetaSetCookieEnabled()) {
-    // Exception (for sandboxed documents) ignored.
-    document.setCookie(content, IGNORE_EXCEPTION_FOR_TESTING);
-    return;
-  }
-
   document.AddConsoleMessage(ConsoleMessage::Create(
       kSecurityMessageSource, kErrorMessageLevel,
       String::Format("Blocked setting the `%s` cookie from a `<meta>` tag.",

diff --git a/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.cc b/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.cc
index a3de791f..489b8d3 100644
--- a/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.cc
+++ b/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.cc

@@ -352,6 +352,24 @@
   return GraphicsLayerTreeAsJSON(layer, flags)->ToPrettyJSONString();
 }
 
+#if DCHECK_IS_ON()
+void VerboseLogGraphicsLayerTree(const GraphicsLayer* root) {
+  if (!VLOG_IS_ON(2))
+    return;
+
+  using GraphicsLayerTreeMap = HashMap<const GraphicsLayer*, String>;
+  DEFINE_STATIC_LOCAL(GraphicsLayerTreeMap, s_previous_trees, ());
+  LayerTreeFlags flags = VLOG_IS_ON(3) ? 0xffffffff : kOutputAsLayerTree;
+  String new_tree = GraphicsLayerTreeAsTextForTesting(root, flags);
+  auto it = s_previous_trees.find(root);
+  if (it == s_previous_trees.end() || it->value != new_tree) {
+    VLOG(2) << "GraphicsLayer tree:\n" << new_tree.Utf8().data();
+    s_previous_trees.Set(root, new_tree);
+    // For simplification, we don't remove deleted GraphicsLayers from the map.
+  }
+}
+#endif
+
 }  // namespace blink
 
 #if DCHECK_IS_ON()

diff --git a/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.h b/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.h
index ac28082..204e334 100644
--- a/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.h
+++ b/third_party/blink/renderer/core/paint/compositing/graphics_layer_tree_as_text.h

@@ -21,6 +21,9 @@
 String CORE_EXPORT GraphicsLayerTreeAsTextForTesting(const GraphicsLayer*,
                                                      LayerTreeFlags);
 
+#if DCHECK_IS_ON()
+void CORE_EXPORT VerboseLogGraphicsLayerTree(const GraphicsLayer*);
+#endif
 }  // namespace blink
 
 #if DCHECK_IS_ON()

diff --git a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc
index 29fc84d..326fc46 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc
+++ b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc

@@ -171,7 +171,6 @@
 
   HashMap<const LayoutObject*, NGPaintFragment*> last_fragment_map;
   paint_fragment->PopulateDescendants(NGPhysicalOffset(),
-                                      &paint_fragment->first_fragment_map_,
                                       &last_fragment_map);
 
   return paint_fragment;
@@ -196,6 +195,28 @@
   physical_fragment_ = fragment;
 }
 
+NGPaintFragment* NGPaintFragment::Last(const NGBreakToken& break_token) {
+  for (NGPaintFragment* fragment = this; fragment;
+       fragment = fragment->next_fragmented_.get()) {
+    if (fragment->PhysicalFragment().BreakToken() == &break_token)
+      return fragment;
+  }
+  return nullptr;
+}
+
+NGPaintFragment* NGPaintFragment::Last() {
+  for (NGPaintFragment* fragment = this;;) {
+    NGPaintFragment* next = fragment->next_fragmented_.get();
+    if (!next)
+      return fragment;
+    fragment = next;
+  }
+}
+
+void NGPaintFragment::SetNext(std::unique_ptr<NGPaintFragment> fragment) {
+  next_fragmented_ = std::move(fragment);
+}
+
 bool NGPaintFragment::IsDescendantOfNotSelf(
     const NGPaintFragment& ancestor) const {
   for (const NGPaintFragment* fragment = Parent(); fragment;
@@ -232,7 +253,6 @@
 // Populate descendants from NGPhysicalFragment tree.
 void NGPaintFragment::PopulateDescendants(
     const NGPhysicalOffset inline_offset_to_container_box,
-    HashMap<const LayoutObject*, NGPaintFragment*>* first_fragment_map,
     HashMap<const LayoutObject*, NGPaintFragment*>* last_fragment_map) {
   DCHECK(children_.IsEmpty());
   const NGPhysicalFragment& fragment = PhysicalFragment();
@@ -246,30 +266,16 @@
     std::unique_ptr<NGPaintFragment> child =
         std::make_unique<NGPaintFragment>(child_fragment, this);
 
-    // Create a linked list for each LayoutObject.
-    //
-    // |first_fragment_map| and |last_fragment_map| each keeps the first and the
-    // last of the list of fragments for a LayoutObject. We use two maps because
-    // |last_fragment_map| is needed only while creating lists, while
-    // |first_fragment_map| is kept for later queries. This may change when we
-    // use fields in LayoutObject to keep the first fragments.
-    if (LayoutObject* layout_object = child_fragment->GetLayoutObject()) {
-      auto add_result = last_fragment_map->insert(layout_object, child.get());
-      if (add_result.is_new_entry) {
-        DCHECK(first_fragment_map->find(layout_object) ==
-               first_fragment_map->end());
-        first_fragment_map->insert(layout_object, child.get());
-      } else {
-        DCHECK(first_fragment_map->find(layout_object) !=
-               first_fragment_map->end());
-        DCHECK(add_result.stored_value->value);
-        add_result.stored_value->value->next_fragment_ = child.get();
-        add_result.stored_value->value = child.get();
+    if (!child_fragment->IsFloating() &&
+        !child_fragment->IsOutOfFlowPositioned() &&
+        !child_fragment->IsListMarker()) {
+      if (LayoutObject* layout_object = child_fragment->GetLayoutObject()) {
+        child->AssociateWithLayoutObject(layout_object, last_fragment_map);
       }
-    }
 
-    child->inline_offset_to_container_box_ =
-        inline_offset_to_container_box + child_fragment->Offset();
+      child->inline_offset_to_container_box_ =
+          inline_offset_to_container_box + child_fragment->Offset();
+    }
 
     // Recurse children, except when this is a block formatting context root.
     // TODO(kojii): At the block formatting context root, children may be for
@@ -278,13 +284,39 @@
     // engine boundaries.
     if (!child_fragment->IsBlockFormattingContextRoot()) {
       child->PopulateDescendants(child->inline_offset_to_container_box_,
-                                 first_fragment_map, last_fragment_map);
+                                 last_fragment_map);
     }
 
     children_.push_back(std::move(child));
   }
 }
 
+// Add to a linked list for each LayoutObject.
+void NGPaintFragment::AssociateWithLayoutObject(
+    LayoutObject* layout_object,
+    HashMap<const LayoutObject*, NGPaintFragment*>* last_fragment_map) {
+  DCHECK(layout_object);
+
+  // TODO(kojii): The LayoutObject is inline, except for column container
+  // fragment. We should have better way to distinguish it, probably after we
+  // determined the generated fragment tree for multicol with fragmentations
+  // supported.
+  if (!layout_object->IsInline()) {
+    DCHECK(Parent() && layout_object == Parent()->GetLayoutObject());
+    return;
+  }
+
+  auto add_result = last_fragment_map->insert(layout_object, this);
+  if (add_result.is_new_entry) {
+    DCHECK(!layout_object->FirstInlineFragment());
+    layout_object->SetFirstInlineFragment(this);
+  } else {
+    DCHECK(add_result.stored_value->value);
+    add_result.stored_value->value->next_fragment_ = this;
+    add_result.stored_value->value = this;
+  }
+}
+
 NGPaintFragment* NGPaintFragment::GetForInlineContainer(
     const LayoutObject* layout_object) {
   DCHECK(layout_object && layout_object->IsInline());
@@ -292,25 +324,30 @@
   // the LayoutObject is a box (i.e., atomic inline, including inline block and
   // replaced elements.)
   if (LayoutObject* parent = layout_object->Parent()) {
-    if (LayoutBlockFlow* block_flow = parent->EnclosingNGBlockFlow())
-      return block_flow->PaintFragment();
+    if (LayoutBlockFlow* block_flow = parent->EnclosingNGBlockFlow()) {
+      if (NGPaintFragment* fragment = block_flow->PaintFragment())
+        return fragment;
+
+      // TODO(kojii): IsLayoutFlowThread should probably be done in
+      // EnclosingNGBlockFlow(), but there seem to be both expectations today.
+      // This needs cleanup.
+      if (block_flow->IsLayoutFlowThread()) {
+        DCHECK(block_flow->Parent() &&
+               block_flow->Parent()->IsLayoutBlockFlow());
+        return ToLayoutBlockFlow(block_flow->Parent())->PaintFragment();
+      }
+    }
   }
   return nullptr;
 }
 
 NGPaintFragment::FragmentRange NGPaintFragment::InlineFragmentsFor(
     const LayoutObject* layout_object) {
-  DCHECK(layout_object && layout_object->IsInline());
-  if (const NGPaintFragment* root = GetForInlineContainer(layout_object)) {
-    auto it = root->first_fragment_map_.find(layout_object);
-    if (it != root->first_fragment_map_.end())
-      return FragmentRange(it->value);
+  DCHECK(layout_object && layout_object->IsInline() &&
+         !layout_object->IsFloatingOrOutOfFlowPositioned());
 
-    // Reaching here means that there are no fragments for the LayoutObject.
-    // Culled inline box is one, but can be space-only LayoutText that were
-    // collapsed out.
-    return FragmentRange(nullptr);
-  }
+  if (layout_object->IsInLayoutNGInlineFormattingContext())
+    return FragmentRange(layout_object->FirstInlineFragment());
   return FragmentRange(nullptr, false);
 }
 

diff --git a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h
index 68d62c6..c54c228a 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h
+++ b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h

@@ -49,6 +49,12 @@
   void UpdatePhysicalFragmentFromCachedLayoutResult(
       scoped_refptr<const NGPhysicalFragment>);
 
+  // Next/last fragment for  when this is fragmented.
+  NGPaintFragment* Next() { return next_fragmented_.get(); }
+  void SetNext(std::unique_ptr<NGPaintFragment>);
+  NGPaintFragment* Last();
+  NGPaintFragment* Last(const NGBreakToken&);
+
   // The parent NGPaintFragment. This is nullptr for a root; i.e., when parent
   // is not for NGPaint. In the first phase, this means that this is a root of
   // an inline formatting context.
@@ -218,7 +224,9 @@
  private:
   void PopulateDescendants(
       const NGPhysicalOffset inline_offset_to_container_box,
-      HashMap<const LayoutObject*, NGPaintFragment*>* first_fragment_map,
+      HashMap<const LayoutObject*, NGPaintFragment*>* last_fragment_map);
+  void AssociateWithLayoutObject(
+      LayoutObject*,
       HashMap<const LayoutObject*, NGPaintFragment*>* last_fragment_map);
 
   // Helps for PositionForPoint() when |this| falls in different categories.
@@ -237,21 +245,12 @@
   NGPaintFragment* parent_;
   Vector<std::unique_ptr<NGPaintFragment>> children_;
 
+  // The next fragment for when this is fragmented.
+  std::unique_ptr<NGPaintFragment> next_fragmented_;
+
   NGPaintFragment* next_fragment_ = nullptr;
   NGPhysicalOffset inline_offset_to_container_box_;
 
-  // Maps LayoutObject to NGPaintFragment for the root of an inline formatting
-  // context.
-  // TODO(kojii): This is to be stored in fields of LayoutObject where they are
-  // no longer used in NGPaint, specifically:
-  //   LayoutText::first_text_box_
-  //   LayoutInline::line_boxes_
-  //   LayotuBox::inline_box_wrapper_
-  // but doing so is likely to have some impacts on the performance.
-  // Alternatively we can keep in the root NGPaintFragment. Having this in all
-  // NGPaintFragment is tentative.
-  HashMap<const LayoutObject*, NGPaintFragment*> first_fragment_map_;
-
   //
   // Following fields are computed in the pre-paint phase.
   //

diff --git a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
index 7b7403e5..a402b93 100644
--- a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
+++ b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc

@@ -612,14 +612,26 @@
           object_, context_.current.paint_offset);
       bool has_clip_path =
           style.ClipPath() && fragment_data_.ClipPathBoundingBox();
-      bool has_spv1_composited_clip_path =
-          has_clip_path && object_.HasLayer() &&
+      bool is_spv1_composited =
+          object_.HasLayer() &&
           ToLayoutBoxModelObject(object_).Layer()->GetCompositedLayerMapping();
+      bool has_spv1_composited_clip_path = has_clip_path && is_spv1_composited;
       bool has_mask_based_clip_path =
           has_clip_path && !fragment_data_.ClipPathPath();
       base::Optional<IntRect> clip_path_clip;
       if (has_spv1_composited_clip_path || has_mask_based_clip_path) {
         clip_path_clip = fragment_data_.ClipPathBoundingBox();
+      } else if (!mask_clip && is_spv1_composited &&
+                 ToLayoutBoxModelObject(object_)
+                     .Layer()
+                     ->GetCompositedLayerMapping()
+                     ->MaskLayer()) {
+        // TODO(crbug.com/856818): This should never happen.
+        // This is a band-aid to avoid nullptr properties on the mask layer
+        // crashing the renderer, but will result in incorrect rendering.
+        NOTREACHED();
+        has_spv1_composited_clip_path = true;
+        clip_path_clip = IntRect();
       }
       if (mask_clip || clip_path_clip) {
         IntRect combined_clip = mask_clip ? *mask_clip : *clip_path_clip;

diff --git a/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc b/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc
index cdc28cd..26c1790 100644
--- a/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc
+++ b/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc

@@ -302,10 +302,10 @@
 }
 
 Node::InsertionNotificationRequest SVGSMILElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGElement::InsertedInto(root_parent);
 
-  if (!root_parent->isConnected())
+  if (!root_parent.isConnected())
     return kInsertionDone;
 
   UseCounter::Count(GetDocument(), WebFeature::kSVGSMILElementInDocument);
@@ -338,8 +338,8 @@
   return kInsertionDone;
 }
 
-void SVGSMILElement::RemovedFrom(ContainerNode* root_parent) {
-  if (root_parent->isConnected()) {
+void SVGSMILElement::RemovedFrom(ContainerNode& root_parent) {
+  if (root_parent.isConnected()) {
     ClearResourceAndEventBaseReferences();
     ClearConditions();
     SetTargetElement(nullptr);

diff --git a/third_party/blink/renderer/core/svg/animation/svg_smil_element.h b/third_party/blink/renderer/core/svg/animation/svg_smil_element.h
index 410f9b0..b6545a42 100644
--- a/third_party/blink/renderer/core/svg/animation/svg_smil_element.h
+++ b/third_party/blink/renderer/core/svg/animation/svg_smil_element.h

@@ -51,8 +51,8 @@
 
   void ParseAttribute(const AttributeModificationParams&) override;
   void SvgAttributeChanged(const QualifiedName&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   virtual bool HasValidTarget();
   virtual void AnimationAttributeChanged() = 0;

diff --git a/third_party/blink/renderer/core/svg/svg_a_element.cc b/third_party/blink/renderer/core/svg/svg_a_element.cc
index a6328c0..56b02cd4 100644
--- a/third_party/blink/renderer/core/svg/svg_a_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_a_element.cc

@@ -104,15 +104,15 @@
   return new LayoutSVGTransformableContainer(this);
 }
 
-void SVGAElement::DefaultEventHandler(Event* event) {
+void SVGAElement::DefaultEventHandler(Event& event) {
   if (IsLink()) {
-    if (IsFocused() && IsEnterKeyKeydownEvent(event)) {
-      event->SetDefaultHandled();
-      DispatchSimulatedClick(event);
+    if (IsFocused() && IsEnterKeyKeydownEvent(&event)) {
+      event.SetDefaultHandled();
+      DispatchSimulatedClick(&event);
       return;
     }
 
-    if (IsLinkClick(event)) {
+    if (IsLinkClick(&event)) {
       String url = StripLeadingAndTrailingHTMLSpaces(HrefString());
 
       if (url[0] == '#') {
@@ -120,7 +120,7 @@
             GetTreeScope().getElementById(AtomicString(url.Substring(1)));
         if (target_element && IsSVGSMILElement(*target_element)) {
           ToSVGSMILElement(target_element)->BeginByLinkActivation();
-          event->SetDefaultHandled();
+          event.SetDefaultHandled();
           return;
         }
       }
@@ -128,7 +128,7 @@
       AtomicString target(svg_target_->CurrentValue()->Value());
       if (target.IsEmpty() && FastGetAttribute(XLinkNames::showAttr) == "new")
         target = AtomicString("_blank");
-      event->SetDefaultHandled();
+      event.SetDefaultHandled();
 
       LocalFrame* frame = GetDocument().GetFrame();
       if (!frame)
@@ -137,11 +137,11 @@
           &GetDocument(), ResourceRequest(GetDocument().CompleteURL(url)),
           target);
       frame_request.SetTriggeringEventInfo(
-          event->isTrusted() ? WebTriggeringEventInfo::kFromTrustedEvent
-                             : WebTriggeringEventInfo::kFromUntrustedEvent);
+          event.isTrusted() ? WebTriggeringEventInfo::kFromTrustedEvent
+                            : WebTriggeringEventInfo::kFromUntrustedEvent);
       frame->Loader().StartNavigation(frame_request,
                                       WebFrameLoadType::kStandard,
-                                      NavigationPolicyFromEvent(event));
+                                      NavigationPolicyFromEvent(&event));
       return;
     }
   }

diff --git a/third_party/blink/renderer/core/svg/svg_a_element.h b/third_party/blink/renderer/core/svg/svg_a_element.h
index 1743279b..d6d7e15 100644
--- a/third_party/blink/renderer/core/svg/svg_a_element.h
+++ b/third_party/blink/renderer/core/svg/svg_a_element.h

@@ -48,7 +48,7 @@
 
   LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool HasActivationBehavior() const override;
 
   bool IsLiveLink() const override { return IsLink(); }

diff --git a/third_party/blink/renderer/core/svg/svg_animate_element.cc b/third_party/blink/renderer/core/svg/svg_animate_element.cc
index 7490576..a642c1c 100644
--- a/third_party/blink/renderer/core/svg/svg_animate_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_animate_element.cc

@@ -136,17 +136,17 @@
 }
 
 Node::InsertionNotificationRequest SVGAnimateElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGAnimationElement::InsertedInto(root_parent);
-  if (root_parent->isConnected()) {
+  if (root_parent.isConnected()) {
     SetAttributeName(ConstructQualifiedName(
         *this, FastGetAttribute(SVGNames::attributeNameAttr)));
   }
   return kInsertionDone;
 }
 
-void SVGAnimateElement::RemovedFrom(ContainerNode* root_parent) {
-  if (root_parent->isConnected())
+void SVGAnimateElement::RemovedFrom(ContainerNode& root_parent) {
+  if (root_parent.isConnected())
     SetAttributeName(AnyQName());
   SVGAnimationElement::RemovedFrom(root_parent);
 }

diff --git a/third_party/blink/renderer/core/svg/svg_animate_element.h b/third_party/blink/renderer/core/svg/svg_animate_element.h
index 4f344be..0a300c31 100644
--- a/third_party/blink/renderer/core/svg/svg_animate_element.h
+++ b/third_party/blink/renderer/core/svg/svg_animate_element.h

@@ -98,8 +98,8 @@
 
   void SetAttributeType(const AtomicString&);
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) final;
-  void RemovedFrom(ContainerNode*) final;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) final;
+  void RemovedFrom(ContainerNode&) final;
 
   virtual void ResolveTargetProperty();
   void ClearTargetProperty();

diff --git a/third_party/blink/renderer/core/svg/svg_element.cc b/third_party/blink/renderer/core/svg/svg_element.cc
index cab34a8..af24e2e 100644
--- a/third_party/blink/renderer/core/svg/svg_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_element.cc

@@ -367,7 +367,7 @@
 }
 
 Node::InsertionNotificationRequest SVGElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   Element::InsertedInto(root_parent);
   UpdateRelativeLengthsInformation();
 
@@ -382,26 +382,26 @@
   return kInsertionDone;
 }
 
-void SVGElement::RemovedFrom(ContainerNode* root_parent) {
-  bool was_in_document = root_parent->isConnected();
+void SVGElement::RemovedFrom(ContainerNode& root_parent) {
+  bool was_in_document = root_parent.isConnected();
 
   if (was_in_document && HasRelativeLengths()) {
     // The root of the subtree being removed should take itself out from its
     // parent's relative length set. For the other nodes in the subtree we don't
     // need to do anything: they will get their own removedFrom() notification
     // and just clear their sets.
-    if (root_parent->IsSVGElement() && !parentNode()) {
+    if (root_parent.IsSVGElement() && !parentNode()) {
       DCHECK(ToSVGElement(root_parent)
-                 ->elements_with_relative_lengths_.Contains(this));
-      ToSVGElement(root_parent)->UpdateRelativeLengthsInformation(false, this);
+                 .elements_with_relative_lengths_.Contains(this));
+      ToSVGElement(root_parent).UpdateRelativeLengthsInformation(false, this);
     }
 
     elements_with_relative_lengths_.clear();
   }
 
-  SECURITY_DCHECK(!root_parent->IsSVGElement() ||
+  SECURITY_DCHECK(!root_parent.IsSVGElement() ||
                   !ToSVGElement(root_parent)
-                       ->elements_with_relative_lengths_.Contains(this));
+                       .elements_with_relative_lengths_.Contains(this));
 
   Element::RemovedFrom(root_parent);
 

diff --git a/third_party/blink/renderer/core/svg/svg_element.h b/third_party/blink/renderer/core/svg/svg_element.h
index 84db978d..4a0a16c 100644
--- a/third_party/blink/renderer/core/svg/svg_element.h
+++ b/third_party/blink/renderer/core/svg/svg_element.h

@@ -229,8 +229,8 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
   static CSSPropertyID CssPropertyIdForSVGAttributeName(const QualifiedName&);

diff --git a/third_party/blink/renderer/core/svg/svg_fe_image_element.cc b/third_party/blink/renderer/core/svg/svg_fe_image_element.cc
index f44a740..475a22e 100644
--- a/third_party/blink/renderer/core/svg/svg_fe_image_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_fe_image_element.cc

@@ -124,15 +124,15 @@
 }
 
 Node::InsertionNotificationRequest SVGFEImageElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGFilterPrimitiveStandardAttributes::InsertedInto(root_parent);
   BuildPendingResource();
   return kInsertionDone;
 }
 
-void SVGFEImageElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGFEImageElement::RemovedFrom(ContainerNode& root_parent) {
   SVGFilterPrimitiveStandardAttributes::RemovedFrom(root_parent);
-  if (root_parent->isConnected())
+  if (root_parent.isConnected())
     ClearResourceReferences();
 }
 

diff --git a/third_party/blink/renderer/core/svg/svg_fe_image_element.h b/third_party/blink/renderer/core/svg/svg_fe_image_element.h
index 69815802..759f6ad3 100644
--- a/third_party/blink/renderer/core/svg/svg_fe_image_element.h
+++ b/third_party/blink/renderer/core/svg/svg_fe_image_element.h

@@ -65,8 +65,8 @@
   void ClearImageResource();
 
   void BuildPendingResource() override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   Member<SVGAnimatedPreserveAspectRatio> preserve_aspect_ratio_;
 

diff --git a/third_party/blink/renderer/core/svg/svg_gradient_element.cc b/third_party/blink/renderer/core/svg/svg_gradient_element.cc
index fe3fcd9..033e8c5 100644
--- a/third_party/blink/renderer/core/svg/svg_gradient_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_gradient_element.cc

@@ -128,16 +128,16 @@
 }
 
 Node::InsertionNotificationRequest SVGGradientElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGElement::InsertedInto(root_parent);
-  if (root_parent->isConnected())
+  if (root_parent.isConnected())
     BuildPendingResource();
   return kInsertionDone;
 }
 
-void SVGGradientElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGGradientElement::RemovedFrom(ContainerNode& root_parent) {
   SVGElement::RemovedFrom(root_parent);
-  if (root_parent->isConnected())
+  if (root_parent.isConnected())
     ClearResourceReferences();
 }
 

diff --git a/third_party/blink/renderer/core/svg/svg_gradient_element.h b/third_party/blink/renderer/core/svg/svg_gradient_element.h
index 48d4b36..2e6116e 100644
--- a/third_party/blink/renderer/core/svg/svg_gradient_element.h
+++ b/third_party/blink/renderer/core/svg/svg_gradient_element.h

@@ -81,8 +81,8 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) final;
-  void RemovedFrom(ContainerNode*) final;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) final;
+  void RemovedFrom(ContainerNode&) final;
   void ChildrenChanged(const ChildrenChange&) final;
 
   void BuildPendingResource() override;

diff --git a/third_party/blink/renderer/core/svg/svg_image_element.cc b/third_party/blink/renderer/core/svg/svg_image_element.cc
index e849c73..3e7ca19 100644
--- a/third_party/blink/renderer/core/svg/svg_image_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_image_element.cc

@@ -188,11 +188,11 @@
 }
 
 Node::InsertionNotificationRequest SVGImageElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   // A previous loader update may have failed to actually fetch the image if
   // the document was inactive. In that case, force a re-update (but don't
   // clear previous errors).
-  if (root_parent->isConnected() && !GetImageLoader().GetContent())
+  if (root_parent.isConnected() && !GetImageLoader().GetContent())
     GetImageLoader().UpdateFromElement(ImageLoader::kUpdateNormal);
 
   return SVGGraphicsElement::InsertedInto(root_parent);

diff --git a/third_party/blink/renderer/core/svg/svg_image_element.h b/third_party/blink/renderer/core/svg/svg_image_element.h
index 48e8bb1..d8e7c35 100644
--- a/third_party/blink/renderer/core/svg/svg_image_element.h
+++ b/third_party/blink/renderer/core/svg/svg_image_element.h

@@ -81,7 +81,7 @@
   void ParseAttribute(const AttributeModificationParams&) override;
 
   void AttachLayoutTree(AttachContext&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
 
   LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
 

diff --git a/third_party/blink/renderer/core/svg/svg_mpath_element.cc b/third_party/blink/renderer/core/svg/svg_mpath_element.cc
index 6bc80cf..8256e3f 100644
--- a/third_party/blink/renderer/core/svg/svg_mpath_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_mpath_element.cc

@@ -62,17 +62,17 @@
 }
 
 Node::InsertionNotificationRequest SVGMPathElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGElement::InsertedInto(root_parent);
-  if (root_parent->isConnected())
+  if (root_parent.isConnected())
     BuildPendingResource();
   return kInsertionDone;
 }
 
-void SVGMPathElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGMPathElement::RemovedFrom(ContainerNode& root_parent) {
   SVGElement::RemovedFrom(root_parent);
-  NotifyParentOfPathChange(root_parent);
-  if (root_parent->isConnected())
+  NotifyParentOfPathChange(&root_parent);
+  if (root_parent.isConnected())
     ClearResourceReferences();
 }
 

diff --git a/third_party/blink/renderer/core/svg/svg_mpath_element.h b/third_party/blink/renderer/core/svg/svg_mpath_element.h
index 5bf2525..6bd308b 100644
--- a/third_party/blink/renderer/core/svg/svg_mpath_element.h
+++ b/third_party/blink/renderer/core/svg/svg_mpath_element.h

@@ -47,8 +47,8 @@
 
   void BuildPendingResource() override;
   void ClearResourceReferences();
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void SvgAttributeChanged(const QualifiedName&) override;
 

diff --git a/third_party/blink/renderer/core/svg/svg_path_element.cc b/third_party/blink/renderer/core/svg/svg_path_element.cc
index 241cdad..1f96415 100644
--- a/third_party/blink/renderer/core/svg/svg_path_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_path_element.cc

@@ -123,13 +123,13 @@
 }
 
 Node::InsertionNotificationRequest SVGPathElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGGeometryElement::InsertedInto(root_parent);
   InvalidateMPathDependencies();
   return kInsertionDone;
 }
 
-void SVGPathElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGPathElement::RemovedFrom(ContainerNode& root_parent) {
   SVGGeometryElement::RemovedFrom(root_parent);
   InvalidateMPathDependencies();
 }

diff --git a/third_party/blink/renderer/core/svg/svg_path_element.h b/third_party/blink/renderer/core/svg/svg_path_element.h
index 247481d2..3543b90 100644
--- a/third_party/blink/renderer/core/svg/svg_path_element.h
+++ b/third_party/blink/renderer/core/svg/svg_path_element.h

@@ -63,8 +63,8 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
-  Node::InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  Node::InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void InvalidateMPathDependencies();
 

diff --git a/third_party/blink/renderer/core/svg/svg_pattern_element.cc b/third_party/blink/renderer/core/svg/svg_pattern_element.cc
index 822f622..9f1ddb67 100644
--- a/third_party/blink/renderer/core/svg/svg_pattern_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_pattern_element.cc

@@ -163,16 +163,16 @@
 }
 
 Node::InsertionNotificationRequest SVGPatternElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGElement::InsertedInto(root_parent);
-  if (root_parent->isConnected())
+  if (root_parent.isConnected())
     BuildPendingResource();
   return kInsertionDone;
 }
 
-void SVGPatternElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGPatternElement::RemovedFrom(ContainerNode& root_parent) {
   SVGElement::RemovedFrom(root_parent);
-  if (root_parent->isConnected())
+  if (root_parent.isConnected())
     ClearResourceReferences();
 }
 

diff --git a/third_party/blink/renderer/core/svg/svg_pattern_element.h b/third_party/blink/renderer/core/svg/svg_pattern_element.h
index e5a6c56f..1775ff6 100644
--- a/third_party/blink/renderer/core/svg/svg_pattern_element.h
+++ b/third_party/blink/renderer/core/svg/svg_pattern_element.h

@@ -93,8 +93,8 @@
       MutableCSSPropertyValueSet*) override;
 
   void SvgAttributeChanged(const QualifiedName&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) final;
-  void RemovedFrom(ContainerNode*) final;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) final;
+  void RemovedFrom(ContainerNode&) final;
   void ChildrenChanged(const ChildrenChange&) override;
 
   void BuildPendingResource() override;

diff --git a/third_party/blink/renderer/core/svg/svg_script_element.cc b/third_party/blink/renderer/core/svg/svg_script_element.cc
index ddcc037..b81bf53 100644
--- a/third_party/blink/renderer/core/svg/svg_script_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_script_element.cc

@@ -68,7 +68,7 @@
 }
 
 Node::InsertionNotificationRequest SVGScriptElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGElement::InsertedInto(root_parent);
   return kInsertionShouldCallDidNotifySubtreeInsertions;
 }

diff --git a/third_party/blink/renderer/core/svg/svg_script_element.h b/third_party/blink/renderer/core/svg/svg_script_element.h
index c6dae0e..157afba 100644
--- a/third_party/blink/renderer/core/svg/svg_script_element.h
+++ b/third_party/blink/renderer/core/svg/svg_script_element.h

@@ -55,7 +55,7 @@
   SVGScriptElement(Document&, const CreateElementFlags);
 
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void DidNotifySubtreeInsertionsToDocument() override;
   void ChildrenChanged(const ChildrenChange&) override;
   void DidMoveToNewDocument(Document& old_document) override;

diff --git a/third_party/blink/renderer/core/svg/svg_style_element.cc b/third_party/blink/renderer/core/svg/svg_style_element.cc
index 91137d5..ce6165a 100644
--- a/third_party/blink/renderer/core/svg/svg_style_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_style_element.cc

@@ -103,7 +103,7 @@
 }
 
 Node::InsertionNotificationRequest SVGStyleElement::InsertedInto(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   SVGElement::InsertedInto(insertion_point);
   if (isConnected()) {
     if (StyleElement::ProcessStyleSheet(GetDocument(), *this) ==
@@ -115,9 +115,9 @@
   return kInsertionDone;
 }
 
-void SVGStyleElement::RemovedFrom(ContainerNode* insertion_point) {
+void SVGStyleElement::RemovedFrom(ContainerNode& insertion_point) {
   SVGElement::RemovedFrom(insertion_point);
-  StyleElement::RemovedFrom(*this, insertion_point);
+  StyleElement::RemovedFrom(*this, &insertion_point);
 }
 
 void SVGStyleElement::ChildrenChanged(const ChildrenChange& change) {

diff --git a/third_party/blink/renderer/core/svg/svg_style_element.h b/third_party/blink/renderer/core/svg/svg_style_element.h
index 477c720..763e0b1 100644
--- a/third_party/blink/renderer/core/svg/svg_style_element.h
+++ b/third_party/blink/renderer/core/svg/svg_style_element.h

@@ -57,8 +57,8 @@
   SVGStyleElement(Document&, const CreateElementFlags);
 
   void ParseAttribute(const AttributeModificationParams&) override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
   void FinishParsingChildren() override;

diff --git a/third_party/blink/renderer/core/svg/svg_svg_element.cc b/third_party/blink/renderer/core/svg/svg_svg_element.cc
index 3402a3c..4264266 100644
--- a/third_party/blink/renderer/core/svg/svg_svg_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_svg_element.cc

@@ -523,10 +523,10 @@
 }
 
 Node::InsertionNotificationRequest SVGSVGElement::InsertedInto(
-    ContainerNode* root_parent) {
-  if (root_parent->isConnected()) {
+    ContainerNode& root_parent) {
+  if (root_parent.isConnected()) {
     UseCounter::Count(GetDocument(), WebFeature::kSVGSVGElementInDocument);
-    if (root_parent->GetDocument().IsXMLDocument())
+    if (root_parent.GetDocument().IsXMLDocument())
       UseCounter::Count(GetDocument(), WebFeature::kSVGSVGElementInXMLDocument);
 
     if (RuntimeEnabledFeatures::SMILEnabled()) {
@@ -544,8 +544,8 @@
   return SVGGraphicsElement::InsertedInto(root_parent);
 }
 
-void SVGSVGElement::RemovedFrom(ContainerNode* root_parent) {
-  if (root_parent->isConnected()) {
+void SVGSVGElement::RemovedFrom(ContainerNode& root_parent) {
+  if (root_parent.isConnected()) {
     SVGDocumentExtensions& svg_extensions = GetDocument().AccessSVGExtensions();
     svg_extensions.RemoveTimeContainer(this);
     svg_extensions.RemoveSVGRootWithRelativeLengthDescendents(this);

diff --git a/third_party/blink/renderer/core/svg/svg_svg_element.h b/third_party/blink/renderer/core/svg/svg_svg_element.h
index f843f67..550b9290 100644
--- a/third_party/blink/renderer/core/svg/svg_svg_element.h
+++ b/third_party/blink/renderer/core/svg/svg_svg_element.h

@@ -129,8 +129,8 @@
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
   LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void SvgAttributeChanged(const QualifiedName&) override;
 

diff --git a/third_party/blink/renderer/core/svg/svg_text_path_element.cc b/third_party/blink/renderer/core/svg/svg_text_path_element.cc
index 90d0e3eb..6c419aad 100644
--- a/third_party/blink/renderer/core/svg/svg_text_path_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_text_path_element.cc

@@ -137,15 +137,15 @@
 }
 
 Node::InsertionNotificationRequest SVGTextPathElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGTextContentElement::InsertedInto(root_parent);
   BuildPendingResource();
   return kInsertionDone;
 }
 
-void SVGTextPathElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGTextPathElement::RemovedFrom(ContainerNode& root_parent) {
   SVGTextContentElement::RemovedFrom(root_parent);
-  if (root_parent->isConnected())
+  if (root_parent.isConnected())
     ClearResourceReferences();
 }
 

diff --git a/third_party/blink/renderer/core/svg/svg_text_path_element.h b/third_party/blink/renderer/core/svg/svg_text_path_element.h
index a06acd1..a1816bc 100644
--- a/third_party/blink/renderer/core/svg/svg_text_path_element.h
+++ b/third_party/blink/renderer/core/svg/svg_text_path_element.h

@@ -81,8 +81,8 @@
   void ClearResourceReferences();
 
   void BuildPendingResource() override;
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void SvgAttributeChanged(const QualifiedName&) override;
 

diff --git a/third_party/blink/renderer/core/svg/svg_title_element.cc b/third_party/blink/renderer/core/svg/svg_title_element.cc
index 17071c2..c98d0599b 100644
--- a/third_party/blink/renderer/core/svg/svg_title_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_title_element.cc

@@ -35,18 +35,18 @@
 DEFINE_NODE_FACTORY(SVGTitleElement)
 
 Node::InsertionNotificationRequest SVGTitleElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   SVGElement::InsertedInto(root_parent);
-  if (!root_parent->isConnected())
+  if (!root_parent.isConnected())
     return kInsertionDone;
   if (HasChildren() && GetDocument().IsSVGDocument())
     GetDocument().SetTitleElement(this);
   return kInsertionDone;
 }
 
-void SVGTitleElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGTitleElement::RemovedFrom(ContainerNode& root_parent) {
   SVGElement::RemovedFrom(root_parent);
-  if (root_parent->isConnected() && GetDocument().IsSVGDocument())
+  if (root_parent.isConnected() && GetDocument().IsSVGDocument())
     GetDocument().RemoveTitle(this);
 }
 

diff --git a/third_party/blink/renderer/core/svg/svg_title_element.h b/third_party/blink/renderer/core/svg/svg_title_element.h
index 3f67126..6b662d3 100644
--- a/third_party/blink/renderer/core/svg/svg_title_element.h
+++ b/third_party/blink/renderer/core/svg/svg_title_element.h

@@ -36,8 +36,8 @@
  private:
   explicit SVGTitleElement(Document&);
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override {

diff --git a/third_party/blink/renderer/core/svg/svg_use_element.cc b/third_party/blink/renderer/core/svg/svg_use_element.cc
index 0c711130..b013b75 100644
--- a/third_party/blink/renderer/core/svg/svg_use_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_use_element.cc

@@ -112,11 +112,11 @@
 #endif
 
 Node::InsertionNotificationRequest SVGUseElement::InsertedInto(
-    ContainerNode* root_parent) {
+    ContainerNode& root_parent) {
   // This functions exists to assure assumptions made in the code regarding
   // SVGElementInstance creation/destruction are satisfied.
   SVGGraphicsElement::InsertedInto(root_parent);
-  if (!root_parent->isConnected())
+  if (!root_parent.isConnected())
     return kInsertionDone;
 #if DCHECK_IS_ON()
   DCHECK(!target_element_instance_ || !IsWellFormedDocument(&GetDocument()));
@@ -125,9 +125,9 @@
   return kInsertionDone;
 }
 
-void SVGUseElement::RemovedFrom(ContainerNode* root_parent) {
+void SVGUseElement::RemovedFrom(ContainerNode& root_parent) {
   SVGGraphicsElement::RemovedFrom(root_parent);
-  if (root_parent->isConnected()) {
+  if (root_parent.isConnected()) {
     ClearResourceReference();
     CancelShadowTreeRecreation();
   }

diff --git a/third_party/blink/renderer/core/svg/svg_use_element.h b/third_party/blink/renderer/core/svg/svg_use_element.h
index 5bbe0d3..f231c9fc 100644
--- a/third_party/blink/renderer/core/svg/svg_use_element.h
+++ b/third_party/blink/renderer/core/svg/svg_use_element.h

@@ -75,8 +75,8 @@
 
   bool IsStructurallyExternal() const override;
 
-  InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void SvgAttributeChanged(const QualifiedName&) override;
 

diff --git a/third_party/blink/renderer/devtools/front_end/bindings/BreakpointManager.js b/third_party/blink/renderer/devtools/front_end/bindings/BreakpointManager.js
index c54d808..2230513c 100644
--- a/third_party/blink/renderer/devtools/front_end/bindings/BreakpointManager.js
+++ b/third_party/blink/renderer/devtools/front_end/bindings/BreakpointManager.js

@@ -48,9 +48,7 @@
     /** @type {!Map<string, !Bindings.BreakpointManager.Breakpoint>} */
     this._breakpointByStorageId = new Map();
 
-    this._workspace.addEventListener(Workspace.Workspace.Events.ProjectRemoved, this._projectRemoved, this);
     this._workspace.addEventListener(Workspace.Workspace.Events.UISourceCodeAdded, this._uiSourceCodeAdded, this);
-    this._workspace.addEventListener(Workspace.Workspace.Events.UISourceCodeRemoved, this._uiSourceCodeRemoved, this);
   }
 
   /**
@@ -99,23 +97,6 @@
   }
 
   /**
-   * @param {!Common.Event} event
-   */
-  _uiSourceCodeRemoved(event) {
-    const uiSourceCode = /** @type {!Workspace.UISourceCode} */ (event.data);
-    this._removeUISourceCode(uiSourceCode);
-  }
-
-  /**
-   * @param {!Workspace.UISourceCode} uiSourceCode
-   */
-  _removeUISourceCode(uiSourceCode) {
-    const breakpoints = uiSourceCode[Bindings.BreakpointManager._breakpointsSymbol] || new Set();
-    for (const breakpoint of breakpoints)
-      breakpoint._resetLocations();
-  }
-
-  /**
    * @param {!Workspace.UISourceCode} uiSourceCode
    * @param {number} lineNumber
    * @param {number} columnNumber
@@ -146,8 +127,8 @@
     const itemId = Bindings.BreakpointManager._breakpointStorageId(uiSourceCode.url(), lineNumber, columnNumber);
     let breakpoint = this._breakpointByStorageId.get(itemId);
     if (breakpoint) {
-      breakpoint.setPrimaryUISourceCode(uiSourceCode);
       breakpoint._updateState(condition, enabled);
+      breakpoint.setPrimaryUISourceCode(uiSourceCode);
       breakpoint._updateBreakpoint();
       return breakpoint;
     }
@@ -238,13 +219,6 @@
     return result;
   }
 
-  _projectRemoved(event) {
-    const project = /** @type {!Workspace.Project} */ (event.data);
-    const uiSourceCodes = project.uiSourceCodes();
-    for (let i = 0; i < uiSourceCodes.length; ++i)
-      this._removeUISourceCode(uiSourceCodes[i]);
-  }
-
   /**
    * @param {!Bindings.BreakpointManager.Breakpoint} breakpoint
    * @param {boolean} removeFromStorage
@@ -322,20 +296,19 @@
     this._lineNumber = lineNumber;
     this._columnNumber = columnNumber;
 
-    this.setPrimaryUISourceCode(primaryUISourceCode);
-
-    /** @type {!Map<string, number>} */
-    this._numberOfDebuggerLocationForUILocation = new Map();
+    /** @type {?Workspace.UILocation} */
+    this._defaultUILocation = null;
+    /** @type {!Set<!Workspace.UILocation>} */
+    this._uiLocations = new Set();
 
     /** @type {string} */ this._condition;
     /** @type {boolean} */ this._enabled;
     /** @type {boolean} */ this._isRemoved;
-    /** @type {!Workspace.UILocation|undefined} */ this._fakePrimaryLocation;
 
-    this._currentState = null;
     /** @type {!Map.<!SDK.DebuggerModel, !Bindings.BreakpointManager.ModelBreakpoint>}*/
     this._modelBreakpoints = new Map();
     this._updateState(condition, enabled);
+    this.setPrimaryUISourceCode(primaryUISourceCode);
     this._breakpointManager._targetManager.observeModels(SDK.DebuggerModel, this);
   }
 
@@ -370,15 +343,14 @@
    * @param {?Workspace.UISourceCode} primaryUISourceCode
    */
   setPrimaryUISourceCode(primaryUISourceCode) {
-    const symbol = Bindings.BreakpointManager._breakpointsSymbol;
-    if (this._primaryUISourceCode)
-      this._primaryUISourceCode[symbol].delete(this);
-    this._primaryUISourceCode = primaryUISourceCode;
-    if (!primaryUISourceCode)
-      return;
-    if (!this._primaryUISourceCode[symbol])
-      this._primaryUISourceCode[symbol] = new Set();
-    this._primaryUISourceCode[symbol].add(this);
+    if (this._uiLocations.size === 0 && this._defaultUILocation)
+      this._breakpointManager._uiLocationRemoved(this, this._defaultUILocation);
+    if (primaryUISourceCode)
+      this._defaultUILocation = primaryUISourceCode.uiLocation(this._lineNumber, this._columnNumber);
+    else
+      this._defaultUILocation = null;
+    if (this._uiLocations.size === 0 && this._defaultUILocation && !this._isRemoved)
+      this._breakpointManager._uiLocationAdded(this, this._defaultUILocation);
   }
 
   /**
@@ -403,38 +375,25 @@
   }
 
   /**
-   * @param {?Workspace.UILocation} oldUILocation
-   * @param {!Workspace.UILocation} newUILocation
+   * @param {!Workspace.UILocation} uiLocation
    */
-  _replaceUILocation(oldUILocation, newUILocation) {
+  _uiLocationAdded(uiLocation) {
     if (this._isRemoved)
       return;
-
-    this._removeUILocation(oldUILocation, true);
-    this._removeFakeBreakpointAtPrimaryLocation();
-
-    const current = (this._numberOfDebuggerLocationForUILocation.get(newUILocation.id()) || 0) + 1;
-    this._numberOfDebuggerLocationForUILocation.set(newUILocation.id(), current);
-    if (current === 1)
-      this._breakpointManager._uiLocationAdded(this, newUILocation);
+    if (this._uiLocations.size === 0 && this._defaultUILocation)
+      this._breakpointManager._uiLocationRemoved(this, this._defaultUILocation);
+    this._uiLocations.add(uiLocation);
+    this._breakpointManager._uiLocationAdded(this, uiLocation);
   }
 
   /**
-   * @param {?Workspace.UILocation} uiLocation
-   * @param {boolean=} muteCreationFakeBreakpoint
+   * @param {!Workspace.UILocation} uiLocation
    */
-  _removeUILocation(uiLocation, muteCreationFakeBreakpoint) {
-    if (!uiLocation || !this._numberOfDebuggerLocationForUILocation.has(uiLocation.id()))
-      return;
-    const current = (this._numberOfDebuggerLocationForUILocation.get(uiLocation.id()) || 0) - 1;
-    this._numberOfDebuggerLocationForUILocation.set(uiLocation.id(), current);
-    if (current !== 0)
-      return;
-
-    this._numberOfDebuggerLocationForUILocation.delete(uiLocation.id());
+  _uiLocationRemoved(uiLocation) {
+    this._uiLocations.delete(uiLocation);
     this._breakpointManager._uiLocationRemoved(this, uiLocation);
-    if (!muteCreationFakeBreakpoint)
-      this._fakeBreakpointAtPrimaryLocation();
+    if (this._uiLocations.size === 0 && this._defaultUILocation && !this._isRemoved)
+      this._breakpointManager._uiLocationAdded(this, this._defaultUILocation);
   }
 
   /**
@@ -479,8 +438,6 @@
   }
 
   _updateBreakpoint() {
-    this._removeFakeBreakpointAtPrimaryLocation();
-    this._fakeBreakpointAtPrimaryLocation();
     const modelBreakpoints = this._modelBreakpoints.valuesArray();
     for (let i = 0; i < modelBreakpoints.length; ++i)
       modelBreakpoints[i]._scheduleUpdateInDebugger();
@@ -492,23 +449,15 @@
   remove(keepInStorage) {
     this._isRemoved = true;
     const removeFromStorage = !keepInStorage;
-    this._removeFakeBreakpointAtPrimaryLocation();
     const modelBreakpoints = this._modelBreakpoints.valuesArray();
     for (let i = 0; i < modelBreakpoints.length; ++i) {
       modelBreakpoints[i]._scheduleUpdateInDebugger();
       modelBreakpoints[i]._removeEventListeners();
     }
 
-    this.setPrimaryUISourceCode(null);
     this._breakpointManager._removeBreakpoint(this, removeFromStorage);
     this._breakpointManager._targetManager.unobserveModels(SDK.DebuggerModel, this);
-  }
-
-  /**
-   * @param {!SDK.DebuggerModel} debuggerModel
-   */
-  _updateInDebuggerForModel(debuggerModel) {
-    this._modelBreakpoints.get(debuggerModel)._scheduleUpdateInDebugger();
+    this.setPrimaryUISourceCode(null);
   }
 
   /**
@@ -518,36 +467,14 @@
     return Bindings.BreakpointManager._breakpointStorageId(this._url, this._lineNumber, this._columnNumber);
   }
 
-  _fakeBreakpointAtPrimaryLocation() {
-    if (this._isRemoved || this._numberOfDebuggerLocationForUILocation.size || this._fakePrimaryLocation)
-      return;
-
-    if (!this._primaryUISourceCode)
-      return;
-
-    this._fakePrimaryLocation = this._primaryUISourceCode.uiLocation(this._lineNumber, this._columnNumber);
-    if (this._fakePrimaryLocation)
-      this._breakpointManager._uiLocationAdded(this, this._fakePrimaryLocation);
-  }
-
-  _removeFakeBreakpointAtPrimaryLocation() {
-    if (this._fakePrimaryLocation) {
-      this._breakpointManager._uiLocationRemoved(this, this._fakePrimaryLocation);
-      delete this._fakePrimaryLocation;
-    }
-  }
-
   _resetLocations() {
     this.setPrimaryUISourceCode(null);
-    this._removeFakeBreakpointAtPrimaryLocation();
     const modelBreakpoints = this._modelBreakpoints.valuesArray();
     for (let i = 0; i < modelBreakpoints.length; ++i)
       modelBreakpoints[i]._resetLocations();
   }
 };
 
-Bindings.BreakpointManager._breakpointsSymbol = Symbol('breakpoints');
-
 /**
  * @unrestricted
  */
@@ -564,7 +491,7 @@
 
     this._liveLocations = new Bindings.LiveLocationPool();
 
-    /** @type {!Map<string, !Workspace.UILocation>} */
+    /** @type {!Map<!Bindings.LiveLocation, !Workspace.UILocation>} */
     this._uiLocations = new Map();
     this._debuggerModel.addEventListener(
         SDK.DebuggerModel.Events.DebuggerWasDisabled, this._cleanUpAfterDebuggerIsGone, this);
@@ -580,7 +507,7 @@
 
   _resetLocations() {
     for (const uiLocation of this._uiLocations.values())
-      this._breakpoint._removeUILocation(uiLocation);
+      this._breakpoint._uiLocationRemoved(uiLocation);
 
     this._uiLocations.clear();
     this._liveLocations.disposeAll();
@@ -608,7 +535,8 @@
    * @return {boolean}
    */
   _scriptDiverged() {
-    const uiSourceCode = this._breakpoint._primaryUISourceCode;
+    const uiLocation = this._breakpoint._defaultUILocation;
+    const uiSourceCode = uiLocation ? uiLocation.uiSourceCode : null;
     if (!uiSourceCode)
       return false;
     const scriptFile = this._debuggerWorkspaceBinding.scriptFile(uiSourceCode, this._debuggerModel);
@@ -626,7 +554,8 @@
       return;
     }
 
-    const uiSourceCode = this._breakpoint._primaryUISourceCode;
+    const uiLocation = this._breakpoint._defaultUILocation;
+    const uiSourceCode = uiLocation ? uiLocation.uiSourceCode : null;
     const lineNumber = this._breakpoint._lineNumber;
     const columnNumber = this._breakpoint._columnNumber;
     const condition = this._breakpoint.condition();
@@ -649,10 +578,6 @@
         newState = new Bindings.BreakpointManager.Breakpoint.State(
             null, script.scriptId, script.hash, debuggerLocation.lineNumber, debuggerLocation.columnNumber, condition);
       }
-    } else if (this._breakpoint._currentState && this._breakpoint._currentState.url) {
-      const position = this._breakpoint._currentState;
-      newState = new Bindings.BreakpointManager.Breakpoint.State(
-          position.url, null, null, position.lineNumber, position.columnNumber, condition);
     } else if (uiSourceCode) {
       newState = new Bindings.BreakpointManager.Breakpoint.State(
           uiSourceCode.url(), null, null, lineNumber, columnNumber, condition);
@@ -662,8 +587,6 @@
       return;
     }
 
-    this._breakpoint._currentState = newState;
-
     if (this._debuggerId) {
       await this._refreshBreakpoint();
       callback();
@@ -746,16 +669,26 @@
   }
 
   /**
-   * @param {!SDK.DebuggerModel.Location} location
    * @param {!Bindings.LiveLocation} liveLocation
    */
-  _locationUpdated(location, liveLocation) {
-    const uiLocation = liveLocation.uiLocation();
-    if (!uiLocation)
-      return;
-    const oldUILocation = this._uiLocations.get(location.id()) || null;
-    this._uiLocations.set(location.id(), uiLocation);
-    this._breakpoint._replaceUILocation(oldUILocation, uiLocation);
+  _locationUpdated(liveLocation) {
+    const oldUILocation = this._uiLocations.get(liveLocation);
+    if (oldUILocation)
+      this._breakpoint._uiLocationRemoved(oldUILocation);
+    let uiLocation = liveLocation.uiLocation();
+
+    if (uiLocation) {
+      const breakpointLocation = this._breakpoint._breakpointManager.findBreakpoint(uiLocation);
+      if (breakpointLocation && breakpointLocation.uiLocation !== breakpointLocation.breakpoint._defaultUILocation)
+        uiLocation = null;
+    }
+
+    if (uiLocation) {
+      this._uiLocations.set(liveLocation, uiLocation);
+      this._breakpoint._uiLocationAdded(uiLocation);
+    } else {
+      this._uiLocations.delete(liveLocation);
+    }
   }
 
   /**
@@ -772,8 +705,7 @@
       this._breakpoint.remove(false /* keepInStorage */);
       return false;
     }
-    this._debuggerWorkspaceBinding.createLiveLocation(
-        location, this._locationUpdated.bind(this, location), this._liveLocations);
+    this._debuggerWorkspaceBinding.createLiveLocation(location, this._locationUpdated.bind(this), this._liveLocations);
     return true;
   }
 

diff --git a/third_party/blink/renderer/devtools/front_end/object_ui/objectPropertiesSection.css b/third_party/blink/renderer/devtools/front_end/object_ui/objectPropertiesSection.css
index 2ce0756a..1ef1a876 100644
--- a/third_party/blink/renderer/devtools/front_end/object_ui/objectPropertiesSection.css
+++ b/third_party/blink/renderer/devtools/front_end/object_ui/objectPropertiesSection.css

@@ -52,7 +52,7 @@
 }
 
 .name-and-value {
-    overflow-x: hidden;
+    overflow: hidden;
     text-overflow: ellipsis;
     line-height: normal;
 }

diff --git a/third_party/blink/renderer/devtools/front_end/sources/JavaScriptBreakpointsSidebarPane.js b/third_party/blink/renderer/devtools/front_end/sources/JavaScriptBreakpointsSidebarPane.js
index 22c9ab0..281c34c 100644
--- a/third_party/blink/renderer/devtools/front_end/sources/JavaScriptBreakpointsSidebarPane.js
+++ b/third_party/blink/renderer/devtools/front_end/sources/JavaScriptBreakpointsSidebarPane.js

@@ -25,7 +25,9 @@
    * @return {!Promise<?>}
    */
   doUpdate() {
-    const breakpointLocations = this._breakpointManager.allBreakpointLocations();
+    const breakpointLocations = this._breakpointManager.allBreakpointLocations().filter(
+        breakpointLocation =>
+            breakpointLocation.uiLocation.uiSourceCode.project().type() !== Workspace.projectTypes.Debugger);
     if (!breakpointLocations.length) {
       this._listElement = null;
       this.contentElement.removeChildren();

diff --git a/third_party/blink/renderer/devtools/front_end/sources_test_runner/DebuggerTestRunner.js b/third_party/blink/renderer/devtools/front_end/sources_test_runner/DebuggerTestRunner.js
index da41b42..8ea7e66 100644
--- a/third_party/blink/renderer/devtools/front_end/sources_test_runner/DebuggerTestRunner.js
+++ b/third_party/blink/renderer/devtools/front_end/sources_test_runner/DebuggerTestRunner.js

@@ -495,7 +495,7 @@
       return;
 
     for (const {breakpoint} of Bindings.breakpointManager.allBreakpointLocations()) {
-      if (breakpoint._fakePrimaryLocation && breakpoint.enabled())
+      if (breakpoint._uiLocations.size === 0 && breakpoint.enabled())
         return SourcesTestRunner.waitBreakpointSidebarPane();
     }
   }
@@ -707,7 +707,7 @@
 
   function checkIfReady() {
     for (const {breakpoint} of Bindings.breakpointManager.allBreakpointLocations()) {
-      if (breakpoint._fakePrimaryLocation && breakpoint.enabled())
+      if (breakpoint._uiLocations.size === 0 && breakpoint.enabled())
         return waitUpdate().then(checkIfReady);
     }
 

diff --git a/third_party/blink/renderer/devtools/front_end/timeline/TimelineController.js b/third_party/blink/renderer/devtools/front_end/timeline/TimelineController.js
index dc8e8d35..63d73d1 100644
--- a/third_party/blink/renderer/devtools/front_end/timeline/TimelineController.js
+++ b/third_party/blink/renderer/devtools/front_end/timeline/TimelineController.js

@@ -302,16 +302,12 @@
       } else {
         // Or there was no tracing manager in the main target at all, in this case build the model full
         // of cpu profiles.
-        // Assign tids equal to the target ordinals for the thread name lookup.
-        // This is a little shaky because targets can disappear, but we will read these tids sooner than
-        // that.
-        // TODO(pfeldman): resolve this.
-        let counter = 1000;
+        let tid = 0;
         for (const pair of this._cpuProfiles) {
           const target = SDK.targetManager.targetById(pair[0]);
-          const tid = target ? SDK.targetManager.targets().indexOf(target) : ++counter;
-          this._tracingModel.addEvents(
-              TimelineModel.TimelineJSProfileProcessor.buildTraceProfileFromCpuProfile(pair[1], tid));
+          const name = target && target.name();
+          this._tracingModel.addEvents(TimelineModel.TimelineJSProfileProcessor.buildTraceProfileFromCpuProfile(
+              pair[1], ++tid, /* injectPageEvent */ tid === 1, name));
         }
       }
     }

diff --git a/third_party/blink/renderer/devtools/front_end/timeline/TimelineLoader.js b/third_party/blink/renderer/devtools/front_end/timeline/TimelineLoader.js
index ada59507..65bf6f9 100644
--- a/third_party/blink/renderer/devtools/front_end/timeline/TimelineLoader.js
+++ b/third_party/blink/renderer/devtools/front_end/timeline/TimelineLoader.js

@@ -221,7 +221,8 @@
     let traceEvents;
     try {
       const profile = JSON.parse(text);
-      traceEvents = TimelineModel.TimelineJSProfileProcessor.buildTraceProfileFromCpuProfile(profile, 1);
+      traceEvents = TimelineModel.TimelineJSProfileProcessor.buildTraceProfileFromCpuProfile(
+          profile, /* tid */ 1, /* injectPageEvent */ true);
     } catch (e) {
       this._reportErrorAndCancelLoading(Common.UIString('Malformed CPU profile format'));
       return;

diff --git a/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineJSProfile.js b/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineJSProfile.js
index f5a6bdd..df66bb9 100644
--- a/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineJSProfile.js
+++ b/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineJSProfile.js

@@ -228,13 +228,19 @@
   /**
    * @param {*} profile
    * @param {number} tid
+   * @param {boolean} injectPageEvent
+   * @param {?string=} name
    * @return {!Array<!SDK.TracingManager.EventPayload>}
    */
-  static buildTraceProfileFromCpuProfile(profile, tid) {
-    if (!profile)
-      return [];
+  static buildTraceProfileFromCpuProfile(profile, tid, injectPageEvent, name) {
     const events = [];
-    appendEvent('TracingStartedInPage', {'sessionId': '1'}, 0, 0, 'M');
+    if (injectPageEvent)
+      appendEvent('TracingStartedInPage', {data: {'sessionId': '1'}}, 0, 0, 'M');
+    if (!name)
+      name = ls`Thread ${tid}`;
+    appendEvent(SDK.TracingModel.MetadataEvent.ThreadName, {name}, 0, 0, 'M', '__metadata');
+    if (!profile)
+      return events;
     const idToNode = new Map();
     const nodes = profile['nodes'];
     for (let i = 0; i < nodes.length; ++i)
@@ -264,11 +270,11 @@
       } else {
         // A JS function.
         if (!functionEvent)
-          functionEvent = appendEvent('FunctionCall', {'sessionId': '1'}, currentTime);
+          functionEvent = appendEvent('FunctionCall', {data: {'sessionId': '1'}}, currentTime);
       }
     }
     closeEvents();
-    appendEvent('CpuProfile', {'cpuProfile': profile}, profile.endTime, 0, 'I');
+    appendEvent('CpuProfile', {data: {'cpuProfile': profile}}, profile.endTime, 0, 'I');
     return events;
 
     function closeEvents() {
@@ -282,23 +288,16 @@
 
     /**
      * @param {string} name
-     * @param {*} data
+     * @param {*} args
      * @param {number} ts
      * @param {number=} dur
      * @param {string=} ph
      * @param {string=} cat
      * @return {!SDK.TracingManager.EventPayload}
      */
-    function appendEvent(name, data, ts, dur, ph, cat) {
-      const event = /** @type {!SDK.TracingManager.EventPayload} */ ({
-        cat: cat || 'disabled-by-default-devtools.timeline',
-        name: name,
-        ph: ph || 'X',
-        pid: 1,
-        tid,
-        ts: ts,
-        args: {data: data}
-      });
+    function appendEvent(name, args, ts, dur, ph, cat) {
+      const event = /** @type {!SDK.TracingManager.EventPayload} */ (
+          {cat: cat || 'disabled-by-default-devtools.timeline', name, ph: ph || 'X', pid: 1, tid, ts, args});
       if (dur)
         event.dur = dur;
       events.push(event);

diff --git a/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineModel.js b/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineModel.js
index 02d563d6..332ace6 100644
--- a/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineModel.js
+++ b/third_party/blink/renderer/devtools/front_end/timeline_model/TimelineModel.js

@@ -201,6 +201,8 @@
       const metaEvent = metadataEvents.page[i];
       const process = metaEvent.thread.process();
       const endTime = i + 1 < length ? metadataEvents.page[i + 1].startTime : Infinity;
+      if (startTime === endTime)
+        continue;
       this._legacyCurrentPage = metaEvent.args['data'] && metaEvent.args['data']['page'];
       for (const thread of process.sortedThreads()) {
         let workerUrl = null;

diff --git a/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css b/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css
index 2e7fa6e..824db97f 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css

@@ -137,9 +137,8 @@
 
 .highlighted-search-result {
     border-radius: 1px;
-    padding: 1px;
-    margin: -1px;
     background-color: rgba(255, 255, 0, 0.8);
+    outline: 1px solid rgba(255, 255, 0, 0.8);
 }
 
 .-theme-with-dark-background .highlighted-search-result,

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.cc
index 67ea8c32..ea489594 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.cc

@@ -92,8 +92,8 @@
              : IsOverflowElement() ? "CastOverflowButton" : "CastButton";
 }
 
-void MediaControlCastButtonElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::click) {
+void MediaControlCastButtonElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::click) {
     if (is_overlay_button_) {
       Platform::Current()->RecordAction(
           UserMetricsAction("Media.Controls.CastOverlay"));

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.h
index d692354..0b0a774a 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_cast_button_element.h

@@ -33,7 +33,7 @@
   const char* GetNameForHistograms() const final;
 
  private:
-  void DefaultEventHandler(Event*) final;
+  void DefaultEventHandler(Event&) final;
   bool KeepEventInNode(const Event&) const final;
 
   bool IsPlayingRemotely() const;

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.cc
index 938d9c1..50c19e0 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.cc

@@ -69,9 +69,9 @@
   }
 }
 
-void MediaControlDownloadButtonElement::DefaultEventHandler(Event* event) {
+void MediaControlDownloadButtonElement::DefaultEventHandler(Event& event) {
   const KURL& url = MediaElement().currentSrc();
-  if (event->type() == EventTypeNames::click &&
+  if (event.type() == EventTypeNames::click &&
       !(url.IsNull() || url.IsEmpty())) {
     Platform::Current()->RecordAction(
         UserMetricsAction("Media.Controls.Download"));

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.h
index 887c909..991b212 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_download_button_element.h

@@ -42,7 +42,7 @@
     kCount  // Keep last.
   };
 
-  void DefaultEventHandler(Event*) final;
+  void DefaultEventHandler(Event&) final;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.cc
index 3ac97ca..b3ae69b 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.cc

@@ -48,14 +48,14 @@
   return IsOverflowElement() ? "FullscreenOverflowButton" : "FullscreenButton";
 }
 
-void MediaControlFullscreenButtonElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::click) {
+void MediaControlFullscreenButtonElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::click) {
     RecordClickMetrics();
     if (MediaElement().IsFullscreen())
       GetMediaControls().ExitFullscreen();
     else
       GetMediaControls().EnterFullscreen();
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
   }
   MediaControlInputElement::DefaultEventHandler(event);
 }

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.h
index a7cdbc7b..776b111 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_fullscreen_button_element.h

@@ -29,7 +29,7 @@
   const char* GetNameForHistograms() const override;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   void RecordClickMetrics();
 };
 

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.cc
index 0d57f19..806b4ea 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.cc

@@ -198,8 +198,8 @@
   MediaControlElementBase::UpdateShownState();
 }
 
-void MediaControlInputElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::click)
+void MediaControlInputElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::click)
     MaybeRecordInteracted();
 
   HTMLInputElement::DefaultEventHandler(event);

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.h
index d392c81..0fc1d31 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element.h

@@ -53,7 +53,7 @@
   virtual WebLocalizedString::Name GetOverflowStringName() const;
 
   // Implements a default event handler to record interaction on click.
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   // Implements MediaControlElementBase.
   void UpdateShownState() override;

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.cc
index 620d7160..531a372e 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.cc

@@ -100,7 +100,7 @@
 }
 
 void MediaControlLoadingPanelElement::RemovedFrom(
-    ContainerNode* insertion_point) {
+    ContainerNode& insertion_point) {
   if (event_listener_) {
     event_listener_->Detach();
     event_listener_.Clear();

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.h
index 15b30a4..c18ffda 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element.h

@@ -70,7 +70,7 @@
   void PopulateShadowDOM();
 
   // Cleans up the event listener when this element is removed from the DOM.
-  void RemovedFrom(ContainerNode*) override;
+  void RemovedFrom(ContainerNode&) override;
 
   // This counts how many animation iterations the background elements have
   // played.

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.cc
index 155419eb..34f2aff 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.cc

@@ -50,8 +50,8 @@
   return IsOverflowElement() ? "MuteOverflowButton" : "MuteButton";
 }
 
-void MediaControlMuteButtonElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::click) {
+void MediaControlMuteButtonElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::click) {
     if (MediaElement().muted()) {
       Platform::Current()->RecordAction(
           UserMetricsAction("Media.Controls.Unmute"));
@@ -61,7 +61,7 @@
     }
 
     MediaElement().setMuted(!MediaElement().muted());
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
   }
 
   MediaControlInputElement::DefaultEventHandler(event);

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.h
index ae9cd018..10e9e75 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_mute_button_element.h

@@ -26,7 +26,7 @@
   const char* GetNameForHistograms() const override;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.cc
index 2de2daf..cb2ffa7 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.cc

@@ -41,10 +41,10 @@
   }
 }
 
-void MediaControlOverflowMenuButtonElement::DefaultEventHandler(Event* event) {
+void MediaControlOverflowMenuButtonElement::DefaultEventHandler(Event& event) {
   // Only respond to a click event if we are not disabled.
   if (!hasAttribute(HTMLNames::disabledAttr) &&
-      event->type() == EventTypeNames::click) {
+      event.type() == EventTypeNames::click) {
     if (GetMediaControls().OverflowMenuVisible()) {
       Platform::Current()->RecordAction(
           UserMetricsAction("Media.Controls.OverflowClose"));
@@ -54,7 +54,7 @@
     }
 
     GetMediaControls().ToggleOverflowMenu();
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
   }
 
   MediaControlInputElement::DefaultEventHandler(event);

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.h
index 47f94bc..bf65cb6 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_button_element.h

@@ -27,7 +27,7 @@
   void UpdateShownState() final;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.cc
index 5012a09..cb7d4e6 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.cc

@@ -37,9 +37,9 @@
   time_shown_.reset();
 }
 
-void MediaControlOverflowMenuListElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::click)
-    event->SetDefaultHandled();
+void MediaControlOverflowMenuListElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::click)
+    event.SetDefaultHandled();
 
   MediaControlPopupMenuElement::DefaultEventHandler(event);
 }

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.h
index aaf61b2..4da049d 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overflow_menu_list_element.h

@@ -33,7 +33,7 @@
   };
   void MaybeRecordTimeTaken(TimeTakenHistogram);
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   TaskHandle current_task_handle_;
 

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.cc
index 46fd015..1e80f7fc 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.cc

@@ -15,13 +15,13 @@
   SetShadowPseudoId(AtomicString("-webkit-media-controls-overlay-enclosure"));
 }
 
-void MediaControlOverlayEnclosureElement::DefaultEventHandler(Event* event) {
+void MediaControlOverlayEnclosureElement::DefaultEventHandler(Event& event) {
   // When the user interacts with the media element, the Cast overlay button
   // needs to be shown.
-  if (event->type() == EventTypeNames::gesturetap ||
-      event->type() == EventTypeNames::click ||
-      event->type() == EventTypeNames::pointerover ||
-      event->type() == EventTypeNames::pointermove) {
+  if (event.type() == EventTypeNames::gesturetap ||
+      event.type() == EventTypeNames::click ||
+      event.type() == EventTypeNames::pointerover ||
+      event.type() == EventTypeNames::pointermove) {
     GetMediaControls().ShowOverlayCastButtonIfNeeded();
   }
 

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.h
index f91049d..b43bba8 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_enclosure_element.h

@@ -17,7 +17,7 @@
  public:
   explicit MediaControlOverlayEnclosureElement(MediaControlsImpl&);
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc
index 5673b15..735633a3 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc

@@ -216,16 +216,16 @@
     left_jump_arrow_->Show();
 }
 
-void MediaControlOverlayPlayButtonElement::DefaultEventHandler(Event* event) {
-  if (ShouldCausePlayPause(*event)) {
-    event->SetDefaultHandled();
+void MediaControlOverlayPlayButtonElement::DefaultEventHandler(Event& event) {
+  if (ShouldCausePlayPause(event)) {
+    event.SetDefaultHandled();
     MaybePlayPause();
-  } else if (event->type() == EventTypeNames::click) {
-    event->SetDefaultHandled();
+  } else if (event.type() == EventTypeNames::click) {
+    event.SetDefaultHandled();
 
-    DCHECK(event->IsMouseEvent());
-    MouseEvent* mouse_event = ToMouseEvent(event);
-    DCHECK(mouse_event->HasPosition());
+    DCHECK(event.IsMouseEvent());
+    auto& mouse_event = ToMouseEvent(event);
+    DCHECK(mouse_event.HasPosition());
 
     if (!tap_timer_.IsActive()) {
       // If there was not a previous touch and this was outside of the button
@@ -233,7 +233,7 @@
       // case their is a second tap.
       if (tap_timer_.IsActive())
         return;
-      tap_was_touch_event_ = MediaControlsImpl::IsTouchEvent(event);
+      tap_was_touch_event_ = MediaControlsImpl::IsTouchEvent(&event);
       tap_timer_.StartOneShot(kDoubleTapDelay, FROM_HERE);
     } else {
       // Cancel the play pause event.
@@ -241,12 +241,12 @@
 
       // If both taps were touch events, then jump.
       if (tap_was_touch_event_.value() &&
-          MediaControlsImpl::IsTouchEvent(event)) {
+          MediaControlsImpl::IsTouchEvent(&event)) {
         // Jump forwards or backwards based on the position of the tap.
         WebSize element_size =
             MediaControlElementsHelper::GetSizeOrDefault(*this, WebSize(0, 0));
 
-        if (mouse_event->clientX() >= element_size.width / 2) {
+        if (mouse_event.clientX() >= element_size.width / 2) {
           MaybeJump(kNumberOfSecondsToJump);
         } else {
           MaybeJump(kNumberOfSecondsToJump * -1);

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.h
index 377ed4f..d2eec86 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.h

@@ -29,7 +29,7 @@
   // MediaControlInputElement overrides.
   void UpdateDisplayType() override;
 
-  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(event); }
+  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(*event); }
 
   WebSize GetSizeOrDefault() const final;
 
@@ -79,7 +79,7 @@
 
   void TapTimerFired(TimerBase*);
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool KeepEventInNode(const Event&) const override;
 
   bool ShouldCausePlayPause(const Event&) const;

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.cc
index 0240bca..b4d02b1 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.cc

@@ -125,7 +125,7 @@
   opaque_ = false;
 }
 
-void MediaControlPanelElement::RemovedFrom(ContainerNode*) {
+void MediaControlPanelElement::RemovedFrom(ContainerNode&) {
   DetachTransitionEventListener();
 }
 
@@ -165,11 +165,11 @@
     event_listener_->Detach();
 }
 
-void MediaControlPanelElement::DefaultEventHandler(Event* event) {
+void MediaControlPanelElement::DefaultEventHandler(Event& event) {
   // Suppress the media element activation behavior (toggle play/pause) when
   // any part of the control panel is clicked.
-  if (event->type() == EventTypeNames::click) {
-    event->SetDefaultHandled();
+  if (event.type() == EventTypeNames::click) {
+    event.SetDefaultHandled();
     return;
   }
   HTMLDivElement::DefaultEventHandler(event);

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.h
index cfa0e58..301e1a26 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element.h

@@ -29,7 +29,7 @@
   void SetKeepDisplayedForAccessibility(bool);
 
   // Node override;
-  void RemovedFrom(ContainerNode*) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void Trace(blink::Visitor*) override;
 
@@ -44,7 +44,7 @@
   void EnsureTransitionEventListener();
   void DetachTransitionEventListener();
 
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool KeepEventInNode(const Event&) const override;
 
   void DidBecomeVisible();

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.cc
index cd492d9f6..3c6c798 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.cc

@@ -65,8 +65,8 @@
 }
 
 void MediaControlPictureInPictureButtonElement::DefaultEventHandler(
-    Event* event) {
-  if (event->type() == EventTypeNames::click) {
+    Event& event) {
+  if (event.type() == EventTypeNames::click) {
     PictureInPictureControllerImpl& controller =
         PictureInPictureControllerImpl::From(MediaElement().GetDocument());
 

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.h
index 13c8575..4a395d2 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_picture_in_picture_button_element.h

@@ -23,13 +23,13 @@
   WebLocalizedString::Name GetOverflowStringName() const override;
   bool HasOverflowButton() const override;
 
-  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(event); }
+  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(*event); }
 
  protected:
   const char* GetNameForHistograms() const override;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.cc
index 7f4ef3c..e358f000 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.cc

@@ -48,8 +48,8 @@
   return IsOverflowElement() ? "PlayPauseOverflowButton" : "PlayPauseButton";
 }
 
-void MediaControlPlayButtonElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::click) {
+void MediaControlPlayButtonElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::click) {
     if (MediaElement().paused()) {
       Platform::Current()->RecordAction(
           UserMetricsAction("Media.Controls.Play"));
@@ -68,7 +68,7 @@
 
     MediaElement().TogglePlayState();
     UpdateDisplayType();
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
   }
   MediaControlInputElement::DefaultEventHandler(event);
 }

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.h
index 4767a15..279d966a 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_play_button_element.h

@@ -22,13 +22,13 @@
   WebLocalizedString::Name GetOverflowStringName() const override;
   bool HasOverflowButton() const override;
 
-  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(event); }
+  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(*event); }
 
  protected:
   const char* GetNameForHistograms() const override;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.cc
index 18460ab..03276da 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.cc

@@ -142,26 +142,26 @@
   SetIsWanted(false);
 }
 
-void MediaControlPopupMenuElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::pointermove) {
-    ToElement(event->target()->ToNode())->focus();
-  } else if (event->type() == EventTypeNames::focusout) {
+void MediaControlPopupMenuElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::pointermove) {
+    ToElement(event.target()->ToNode())->focus();
+  } else if (event.type() == EventTypeNames::focusout) {
     GetDocument()
         .GetTaskRunner(TaskType::kMediaElementEvent)
         ->PostTask(FROM_HERE,
                    WTF::Bind(&MediaControlPopupMenuElement::HideIfNotFocused,
                              WrapWeakPersistent(this)));
-  } else if (event->type() == EventTypeNames::click) {
+  } else if (event.type() == EventTypeNames::click) {
     OnItemSelected();
 
-    event->stopPropagation();
-    event->SetDefaultHandled();
+    event.stopPropagation();
+    event.SetDefaultHandled();
   }
 
   MediaControlDivElement::DefaultEventHandler(event);
 }
 
-void MediaControlPopupMenuElement::RemovedFrom(ContainerNode* container) {
+void MediaControlPopupMenuElement::RemovedFrom(ContainerNode& container) {
   if (IsWanted())
     SetIsWanted(false);
   event_listener_ = nullptr;

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.h
index 042dc8a..691f301b 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_popup_menu_element.h

@@ -25,8 +25,8 @@
   virtual void OnItemSelected();
 
   // Node override.
-  void DefaultEventHandler(Event*) override;
-  void RemovedFrom(ContainerNode*) override;
+  void DefaultEventHandler(Event&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   void Trace(blink::Visitor*) override;
 

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.cc
index bee8c4b..c04a951 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.cc

@@ -70,15 +70,15 @@
   return &GetMediaControls().ToggleClosedCaptions();
 }
 
-void MediaControlTextTrackListElement::DefaultEventHandler(Event* event) {
-  if (event->type() == EventTypeNames::click) {
+void MediaControlTextTrackListElement::DefaultEventHandler(Event& event) {
+  if (event.type() == EventTypeNames::click) {
     // This handles the back button click. Clicking on a menu item triggers the
     // change event instead.
     GetMediaControls().ToggleOverflowMenu();
-    event->SetDefaultHandled();
-  } else if (event->type() == EventTypeNames::change) {
+    event.SetDefaultHandled();
+  } else if (event.type() == EventTypeNames::change) {
     // Identify which input element was selected and set track to showing
-    Node* target = event->target()->ToNode();
+    Node* target = event.target()->ToNode();
     if (!target || !target->IsElementNode())
       return;
 
@@ -91,7 +91,7 @@
       MediaElement().DisableAutomaticTextTrackSelection();
     }
 
-    event->SetDefaultHandled();
+    event.SetDefaultHandled();
   }
   MediaControlPopupMenuElement::DefaultEventHandler(event);
 }

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.h
index 7cc4031..1c9b7ae 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_text_track_list_element.h

@@ -25,7 +25,7 @@
   Element* PopupAnchor() const final;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 
   void RefreshTextTrackListMenu();
 

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc
index 2c66e7b..293c523f 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc

@@ -104,52 +104,52 @@
   return "TimelineSlider";
 }
 
-void MediaControlTimelineElement::DefaultEventHandler(Event* event) {
+void MediaControlTimelineElement::DefaultEventHandler(Event& event) {
   if (!isConnected() || !GetDocument().IsActive() || controls_hidden_)
     return;
 
   RenderBarSegments();
 
-  if (BeginScrubbingEvent(*event)) {
+  if (BeginScrubbingEvent(event)) {
     Platform::Current()->RecordAction(
         UserMetricsAction("Media.Controls.ScrubbingBegin"));
-    GetMediaControls().BeginScrubbing(MediaControlsImpl::IsTouchEvent(event));
+    GetMediaControls().BeginScrubbing(MediaControlsImpl::IsTouchEvent(&event));
     Element* thumb = UserAgentShadowRoot()->getElementById(
         ShadowElementNames::SliderThumb());
-    bool started_from_thumb = thumb && thumb == event->target()->ToNode();
+    bool started_from_thumb = thumb && thumb == event.target()->ToNode();
     metrics_.StartGesture(started_from_thumb);
-  } else if (EndScrubbingEvent(*event)) {
+  } else if (EndScrubbingEvent(event)) {
     Platform::Current()->RecordAction(
         UserMetricsAction("Media.Controls.ScrubbingEnd"));
     GetMediaControls().EndScrubbing();
     metrics_.RecordEndGesture(TrackWidth(), MediaElement().duration());
   }
 
-  if (event->type() == EventTypeNames::keydown) {
+  if (event.type() == EventTypeNames::keydown) {
     metrics_.StartKey();
   }
-  if (event->type() == EventTypeNames::keyup && event->IsKeyboardEvent()) {
-    metrics_.RecordEndKey(TrackWidth(), ToKeyboardEvent(event)->keyCode());
+  if (event.type() == EventTypeNames::keyup && event.IsKeyboardEvent()) {
+    metrics_.RecordEndKey(TrackWidth(), ToKeyboardEvent(event).keyCode());
   }
 
   MediaControlInputElement::DefaultEventHandler(event);
 
-  if (event->IsMouseEvent() || event->IsKeyboardEvent() ||
-      event->IsGestureEvent() || event->IsPointerEvent()) {
+  if (event.IsMouseEvent() || event.IsKeyboardEvent() ||
+      event.IsGestureEvent() || event.IsPointerEvent()) {
     MaybeRecordInteracted();
   }
 
   // Update the value based on the touchmove event.
-  if (is_touching_ && event->type() == EventTypeNames::touchmove) {
-    TouchEvent* touch_event = ToTouchEvent(event);
-    if (touch_event->touches()->length() != 1)
+  if (is_touching_ && event.type() == EventTypeNames::touchmove) {
+    auto& touch_event = ToTouchEvent(event);
+    if (touch_event.touches()->length() != 1)
       return;
 
-    const Touch* touch = touch_event->touches()->item(0);
+    const Touch* touch = touch_event.touches()->item(0);
     double position =
         max(0.0, fmin(1.0, touch->clientX() / TrackWidth() * ZoomFactor()));
     SetPosition(position * MediaElement().duration());
-  } else if (event->type() != EventTypeNames::input) {
+  } else if (event.type() != EventTypeNames::input) {
     return;
   }
 

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.h
index 4c8d58dc..b46f2469 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.h

@@ -29,7 +29,7 @@
 
   void OnPlaying();
 
-  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(event); }
+  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(*event); }
 
   void RenderBarSegments();
 
@@ -43,7 +43,7 @@
   const char* GetNameForHistograms() const override;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool KeepEventInNode(const Event&) const override;
 
   // Checks if we can begin or end a scrubbing event. If the event is a pointer

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.cc
index a58b550a..fae04b591 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.cc

@@ -103,8 +103,8 @@
 }
 
 void MediaControlToggleClosedCaptionsButtonElement::DefaultEventHandler(
-    Event* event) {
-  if (event->type() == EventTypeNames::click) {
+    Event& event) {
+  if (event.type() == EventTypeNames::click) {
     if (MediaElement().textTracks()->length() == 1) {
       // If only one track exists, toggle it on/off
       if (MediaElement().textTracks()->HasShowingTracks())

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.h
index 1d1b48d..470b3c2 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_toggle_closed_captions_button_element.h

@@ -29,7 +29,7 @@
   const char* GetNameForHistograms() const override;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.cc
index 33024aa..afc97376 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.cc

@@ -48,28 +48,28 @@
   return "VolumeSlider";
 }
 
-void MediaControlVolumeSliderElement::DefaultEventHandler(Event* event) {
+void MediaControlVolumeSliderElement::DefaultEventHandler(Event& event) {
   if (!isConnected() || !GetDocument().IsActive())
     return;
 
   MediaControlInputElement::DefaultEventHandler(event);
 
-  if (event->IsMouseEvent() || event->IsKeyboardEvent() ||
-      event->IsGestureEvent() || event->IsPointerEvent()) {
+  if (event.IsMouseEvent() || event.IsKeyboardEvent() ||
+      event.IsGestureEvent() || event.IsPointerEvent()) {
     MaybeRecordInteracted();
   }
 
-  if (event->type() == EventTypeNames::pointerdown) {
+  if (event.type() == EventTypeNames::pointerdown) {
     Platform::Current()->RecordAction(
         UserMetricsAction("Media.Controls.VolumeChangeBegin"));
   }
 
-  if (event->type() == EventTypeNames::pointerup) {
+  if (event.type() == EventTypeNames::pointerup) {
     Platform::Current()->RecordAction(
         UserMetricsAction("Media.Controls.VolumeChangeEnd"));
   }
 
-  if (event->type() == EventTypeNames::input) {
+  if (event.type() == EventTypeNames::input) {
     double volume = value().ToDouble();
     MediaElement().setVolume(volume);
     MediaElement().setMuted(false);

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.h b/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.h
index 4a950ccaf..2e9962f 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.h
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.h

@@ -23,13 +23,13 @@
   bool WillRespondToMouseMoveEvents() override;
   bool WillRespondToMouseClickEvents() override;
 
-  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(event); }
+  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(*event); }
 
  protected:
   const char* GetNameForHistograms() const override;
 
  private:
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool KeepEventInNode(const Event&) const override;
   void SetVolumeInternal(double);
 };

diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_impl.cc b/third_party/blink/renderer/modules/media_controls/media_controls_impl.cc
index 5ca3a5f8..1481658e 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_impl.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_impl.cc

@@ -662,7 +662,7 @@
 }
 
 Node::InsertionNotificationRequest MediaControlsImpl::InsertedInto(
-    ContainerNode* root) {
+    ContainerNode& root) {
   if (!MediaElement().isConnected())
     return HTMLDivElement::InsertedInto(root);
 
@@ -795,7 +795,7 @@
   return ControlsState::kStopped;
 }
 
-void MediaControlsImpl::RemovedFrom(ContainerNode*) {
+void MediaControlsImpl::RemovedFrom(ContainerNode&) {
   DCHECK(!MediaElement().isConnected());
 
   // TODO(mlamouri): we hide show the controls instead of having
@@ -1411,7 +1411,7 @@
   MaybeShow();
 }
 
-void MediaControlsImpl::DefaultEventHandler(Event* event) {
+void MediaControlsImpl::DefaultEventHandler(Event& event) {
   HTMLDivElement::DefaultEventHandler(event);
 
   // Do not handle events to not interfere with the rest of the page if no
@@ -1423,7 +1423,7 @@
   // event, to allow the hide-timer to do the right thing when it fires.
   // FIXME: Preferably we would only do this when we're actually handling the
   // event here ourselves.
-  bool is_touch_event = IsTouchEvent(event);
+  bool is_touch_event = IsTouchEvent(&event);
   hide_timer_behavior_flags_ |=
       is_touch_event ? kIgnoreControlsHover : kIgnoreNone;
 
@@ -1431,46 +1431,46 @@
   // random behavior. The expect behaviour for touch is that a tap will show the
   // controls and they will hide when the timer to hide fires.
   if (is_touch_event)
-    HandleTouchEvent(event);
+    HandleTouchEvent(&event);
 
-  if (event->type() == EventTypeNames::mouseover && !is_touch_event)
+  if (event.type() == EventTypeNames::mouseover && !is_touch_event)
     is_touch_interaction_ = false;
 
-  if ((event->type() == EventTypeNames::pointerover ||
-       event->type() == EventTypeNames::pointermove ||
-       event->type() == EventTypeNames::pointerout) &&
+  if ((event.type() == EventTypeNames::pointerover ||
+       event.type() == EventTypeNames::pointermove ||
+       event.type() == EventTypeNames::pointerout) &&
       !is_touch_interaction_) {
-    HandlePointerEvent(event);
+    HandlePointerEvent(&event);
   }
 
   // If the user is interacting with the controls via the keyboard, don't hide
   // the controls. This will fire when the user tabs between controls (focusin)
   // or when they seek either the timeline or volume sliders (input).
-  if (event->type() == EventTypeNames::focusin ||
-      event->type() == EventTypeNames::input) {
+  if (event.type() == EventTypeNames::focusin ||
+      event.type() == EventTypeNames::input) {
     ResetHideMediaControlsTimer();
   }
 
-  if (event->IsKeyboardEvent() &&
+  if (event.IsKeyboardEvent() &&
       !IsSpatialNavigationEnabled(GetDocument().GetFrame())) {
-    const String& key = ToKeyboardEvent(event)->key();
-    if (key == "Enter" || ToKeyboardEvent(event)->keyCode() == ' ') {
+    const String& key = ToKeyboardEvent(event).key();
+    if (key == "Enter" || ToKeyboardEvent(event).keyCode() == ' ') {
       if (IsModern()) {
-        overlay_play_button_->OnMediaKeyboardEvent(event);
+        overlay_play_button_->OnMediaKeyboardEvent(&event);
       } else {
-        play_button_->OnMediaKeyboardEvent(event);
+        play_button_->OnMediaKeyboardEvent(&event);
       }
       return;
     }
     if (key == "ArrowLeft" || key == "ArrowRight" || key == "Home" ||
         key == "End") {
-      timeline_->OnMediaKeyboardEvent(event);
+      timeline_->OnMediaKeyboardEvent(&event);
       return;
     }
     // We don't allow the user to change the volume on modern media controls.
     if (!IsModern() && (key == "ArrowDown" || key == "ArrowUp")) {
       for (int i = 0; i < 5; i++)
-        volume_slider_->OnMediaKeyboardEvent(event);
+        volume_slider_->OnMediaKeyboardEvent(&event);
       return;
     }
   }

diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_impl.h b/third_party/blink/renderer/modules/media_controls/media_controls_impl.h
index 28ef1e8..486ab5a 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_impl.h
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_impl.h

@@ -85,8 +85,8 @@
   static bool IsTouchEvent(Event*);
 
   // Node override.
-  Node::InsertionNotificationRequest InsertedInto(ContainerNode*) override;
-  void RemovedFrom(ContainerNode*) override;
+  Node::InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+  void RemovedFrom(ContainerNode&) override;
 
   // MediaControls implementation.
   void MaybeShow() override;
@@ -292,7 +292,7 @@
   // Node
   bool IsMediaControls() const override { return true; }
   bool WillRespondToMouseMoveEvents() override { return true; }
-  void DefaultEventHandler(Event*) override;
+  void DefaultEventHandler(Event&) override;
   bool ContainsRelatedTarget(Event*);
 
   void HandlePointerEvent(Event*);
@@ -319,7 +319,7 @@
   void OnExitedFullscreen();
   void OnPictureInPictureChanged();
   void OnPanelKeypress();
-  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(event); }
+  void OnMediaKeyboardEvent(Event* event) { DefaultEventHandler(*event); }
   void OnWaiting();
   void OnLoadingProgress();
   void OnLoadedData();

diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc
index d0a0abc..cac97ac9 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc

@@ -43,6 +43,7 @@
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/fetch/global_fetch.h"
+#include "third_party/blink/renderer/core/frame/deprecation.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
 #include "third_party/blink/renderer/core/inspector/worker_inspector_controller.h"
@@ -328,6 +329,8 @@
         !installed_scripts_manager->IsScriptInstalled(completed_url)) {
       DCHECK(installed_scripts_manager->IsScriptInstalled(Url()));
       CountFeature(WebFeature::kServiceWorkerImportScriptNotInstalled);
+      Deprecation::CountDeprecation(
+          this, WebFeature::kServiceWorkerImportScriptNotInstalled);
     }
     // Bust the MemoryCache to ensure script requests reach the browser-side
     // and get added to and retrieved from the ServiceWorker's script cache.

diff --git a/third_party/blink/renderer/platform/mojo/geometry_struct_traits_test.cc b/third_party/blink/renderer/platform/mojo/geometry_struct_traits_test.cc
index fb7c7241..46a82b7 100644
--- a/third_party/blink/renderer/platform/mojo/geometry_struct_traits_test.cc
+++ b/third_party/blink/renderer/platform/mojo/geometry_struct_traits_test.cc

@@ -37,6 +37,12 @@
     std::move(callback).Run(p);
   }
 
+  void EchoPoint3F(::gfx::mojom::blink::Point3FPtr p,
+                   EchoPoint3FCallback callback) override {
+    // The type map is not specified.
+    NOTREACHED();
+  }
+
   void EchoSize(const WebSize& s, EchoSizeCallback callback) override {
     std::move(callback).Run(s);
   }
@@ -77,6 +83,12 @@
     NOTREACHED();
   }
 
+  void EchoVector3dF(gfx::mojom::blink::Vector3dFPtr,
+                     EchoVector3dFCallback) override {
+    // The type map is not specified.
+    NOTREACHED();
+  }
+
   mojo::BindingSet<gfx::mojom::blink::GeometryTraitsTestService>
       traits_test_bindings_;
 

diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index e732d04..5953fb799 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5

@@ -143,10 +143,6 @@
       name: "BlockingDownloadsInSandbox",
     },
     {
-      name: "BlockMetaSetCookie",
-      status: "stable"
-    },
-    {
       name: "BudgetQuery",
       origin_trial_feature_name: "BudgetQuery",
       status: "experimental",

diff --git a/third_party/dom_distiller_js/update_domdistiller_js.sh b/third_party/dom_distiller_js/update_domdistiller_js.sh
index 0078fcf..640982c 100755
--- a/third_party/dom_distiller_js/update_domdistiller_js.sh
+++ b/third_party/dom_distiller_js/update_domdistiller_js.sh

@@ -60,6 +60,11 @@
   rm -rf $tmpdir/dom-distiller-dist/*
   pushd dom-distiller-dist
   cp -r $tmpdir/dom-distiller/out/package/* .
+
+  # Stop rolling python/plugin_pb2.py for protobuf backward compatibility.
+  # See https://crbug.com/874509
+  git checkout -- python/plugin_pb2.py
+
   git add .
   if [[ $(git status --short | wc -l) -ne 0 ]]; then
     git commit -a -m "Package for ${new_gitsha}"

diff --git a/third_party/tcmalloc/chromium/src/central_freelist.cc b/third_party/tcmalloc/chromium/src/central_freelist.cc
index 01a73104..bd63ac2 100644
--- a/third_party/tcmalloc/chromium/src/central_freelist.cc
+++ b/third_party/tcmalloc/chromium/src/central_freelist.cc

@@ -31,11 +31,11 @@
 // ---
 // Author: Sanjay Ghemawat <opensource@google.com>
 
-#include "config.h"
-#include <algorithm>
 #include "central_freelist.h"
+#include <algorithm>
+#include "config.h"
+#include "free_list.h"         // for FL_Next, FL_Push, etc
 #include "internal_logging.h"  // for ASSERT, MESSAGE
-#include "linked_list.h"       // for SLL_Next, SLL_Push, etc
 #include "page_heap.h"         // for PageHeap
 #include "static_vars.h"       // for Static
 
@@ -81,7 +81,7 @@
 
 void CentralFreeList::ReleaseListToSpans(void* start) {
   while (start) {
-    void *next = SLL_Next(start);
+    void* next = FL_Next(start);
     ReleaseToSpans(start);
     start = next;
   }
@@ -117,7 +117,7 @@
   if (false) {
     // Check that object does not occur in list
     int got = 0;
-    for (void* p = span->objects; p != NULL; p = *((void**) p)) {
+    for (void* p = span->objects; p != NULL; p = FL_Next(p)) {
       ASSERT(p != object);
       got++;
     }
@@ -143,8 +143,7 @@
     }
     lock_.Lock();
   } else {
-    *(reinterpret_cast<void**>(object)) = span->objects;
-    span->objects = object;
+    FL_Push(&(span->objects), object);
   }
 }
 
@@ -270,7 +269,7 @@
       n = FetchFromOneSpans(N - result, &head, &tail);
       if (!n) break;
       result += n;
-      SLL_PushRange(start, head, tail);
+      FL_PushRange(start, head, tail);
     }
   }
   lock_.Unlock();
@@ -298,7 +297,7 @@
   curr = span->objects;
   do {
     prev = curr;
-    curr = *(reinterpret_cast<void**>(curr));
+    curr = FL_Next(curr);
   } while (++result < N && curr != NULL);
 
   if (curr == NULL) {
@@ -311,7 +310,8 @@
   *start = span->objects;
   *end = prev;
   span->objects = curr;
-  SLL_SetNext(*end, NULL);
+  FL_SetNext(*end, NULL);
+  FL_SetPrevious(*start, NULL);
   span->refcount += result;
   counter_ -= result;
   return result;
@@ -345,19 +345,18 @@
 
   // Split the block into pieces and add to the free-list
   // TODO: coloring of objects to avoid cache conflicts?
-  void** tail = &span->objects;
+  void* list = NULL;
   char* ptr = reinterpret_cast<char*>(span->start << kPageShift);
   char* limit = ptr + (npages << kPageShift);
   const size_t size = Static::sizemap()->ByteSizeForClass(size_class_);
   int num = 0;
   while (ptr + size <= limit) {
-    *tail = ptr;
-    tail = reinterpret_cast<void**>(ptr);
+    FL_Push(&list, ptr);
     ptr += size;
     num++;
   }
   ASSERT(ptr <= limit);
-  *tail = NULL;
+  span->objects = list;
   span->refcount = 0; // No sub-object in use yet
 
   // Add span to list of non-empty spans

diff --git a/third_party/tcmalloc/chromium/src/common.cc b/third_party/tcmalloc/chromium/src/common.cc
index 203afdf9..7c05a8b4 100644
--- a/third_party/tcmalloc/chromium/src/common.cc
+++ b/third_party/tcmalloc/chromium/src/common.cc

@@ -136,7 +136,7 @@
   int sc = 1;   // Next size class to assign
   int alignment = kAlignment;
   CHECK_CONDITION(kAlignment <= kMinAlign);
-  for (size_t size = kAlignment; size <= kMaxSize; size += alignment) {
+  for (size_t size = kMinClassSize; size <= kMaxSize; size += alignment) {
     alignment = AlignmentForSize(size);
     CHECK_CONDITION((size % alignment) == 0);
 

diff --git a/third_party/tcmalloc/chromium/src/common.h b/third_party/tcmalloc/chromium/src/common.h
index 8ebba53..7738694 100644
--- a/third_party/tcmalloc/chromium/src/common.h
+++ b/third_party/tcmalloc/chromium/src/common.h

@@ -41,8 +41,9 @@
 #ifdef HAVE_STDINT_H
 #include <stdint.h>                     // for uintptr_t, uint64_t
 #endif
-#include "internal_logging.h"  // for ASSERT, etc
 #include "base/basictypes.h"   // for LIKELY, etc
+#include "free_list.h"         // for SIZE_CLASS macros
+#include "internal_logging.h"  // for ASSERT, etc
 
 // Type that can hold a page number
 typedef uintptr_t PageID;
@@ -72,6 +73,19 @@
 // the thread cache allowance to avoid passing more free ranges to and from
 // central lists.  Also, larger pages are less likely to get freed.
 // These two factors cause a bounded increase in memory use.
+
+static const size_t kAlignment = 8;
+
+// Constants dependent on tcmalloc configuration and architecture.  Chromium
+// tunes these constants.
+// We need to guarantee the smallest class size is big enough to hold the
+// pointers that form the free list.
+static const size_t kNumFreeListPointers =
+    (tcmalloc::kSupportsDoublyLinkedList ? 2 : 1);
+static const size_t kLinkSize = kNumFreeListPointers * sizeof(void*);
+static const size_t kMinClassSize =
+    (kLinkSize > kAlignment ? kLinkSize : kAlignment);
+
 #if defined(TCMALLOC_32K_PAGES)
 static const size_t kPageShift  = 15;
 #elif defined(TCMALLOC_64K_PAGES)
@@ -90,7 +104,6 @@
 // Original TCMalloc code used kMaxSize == 256 * 1024.  In Chromium, we
 // changed this to 32K.
 static const size_t kMaxSize = 32u * 1024;
-static const size_t kAlignment  = 8;
 // For all span-lengths <= kMaxPages we keep an exact-size list in PageHeap.
 static const size_t kMaxPages = 1 << (20 - kPageShift);
 

diff --git a/third_party/tcmalloc/chromium/src/free_list.cc b/third_party/tcmalloc/chromium/src/free_list.cc
new file mode 100644
index 0000000..a486ae6
--- /dev/null
+++ b/third_party/tcmalloc/chromium/src/free_list.cc

@@ -0,0 +1,145 @@
+// Copyright (c) 2011, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// ---
+// Author: Rebecca Shapiro <bxx@google.com>
+//
+// This file contains functions that implement doubly linked and
+// singly linked lists.  The singly linked lists are null terminated,
+// use raw pointers to link neighboring elements, and these pointers
+// are stored at the start of each element, independently of the
+// elements's size.  Because pointers are stored within each element,
+// each element must be large enough to store two raw pointers if
+// doubly linked lists are employed, or one raw pointer if singly
+// linked lists are employed.  On machines with 64 bit pointers, this
+// means elements must be at least 16 bytes in size for doubly linked
+// list support, and 8 bytes for singly linked list support.  No
+// attempts are made to preserve the data in elements stored in the
+// list.
+//
+// Given a machine with pointers of size N (on a 64bit machine N=8, on
+// a 32bit machine, N=4), the list pointers are stored in the
+// following manner:
+// -In doubly linked lists, the |next| pointer is stored in the first N
+// bytes of the node and the |previous| pointer is writtend into the
+// second N bytes.
+// -In singly linked lists, the |next| pointer is stored in the first N
+// bytes of the node.
+//
+// For both types of lists: when a pop operation is performed on a non
+// empty list, the new list head becomes that which is pointed to by
+// the former head's |next| pointer.  If the list is doubly linked, the
+// new head |previous| pointer gets changed from pointing to the former
+// head to NULL.
+
+#include "free_list.h"
+#include <stddef.h>
+#include <limits>
+
+#if defined(TCMALLOC_USE_DOUBLYLINKED_FREELIST)
+
+namespace tcmalloc {
+
+// Remove |n| elements from linked list at whose first element is at
+// |*head|.  |head| will be modified to point to the new head.
+// |start| will point to the first node of the range, |end| will point
+// to the last node in the range. |n| must be <= FL_Size(|*head|)
+// If |n| > 0, |head| must not be NULL.
+void FL_PopRange(void** head, int n, void** start, void** end) {
+  if (n == 0) {
+    *start = NULL;
+    *end = NULL;
+    return;
+  }
+
+  *start = *head;  // Remember the first node in the range.
+  void* tmp = *head;
+  for (int i = 1; i < n; ++i) {  // Find end of range.
+    tmp = FL_Next(tmp);
+  }
+  *end = tmp;  // |end| now set to point to last node in range.
+  *head = FL_Next(*end);
+  FL_SetNext(*end, NULL);  // Unlink range from list.
+
+  if (*head) {  // Fixup popped list.
+    FL_SetPrevious(*head, NULL);
+  }
+}
+
+// Pushes the nodes in the list beginning at |start| whose last node
+// is |end| into the linked list at |*head|. |*head| is updated to
+// point be the new head of the list.  |head| must not be NULL.
+void FL_PushRange(void** head, void* start, void* end) {
+  if (!start)
+    return;
+
+  // Sanity checking of ends of list to push is done by calling
+  // FL_Next and FL_Previous.
+  FL_Next(start);
+  FL_Previous(end);
+  ASSERT(FL_Previous_No_Check(start) == NULL);
+  ASSERT(FL_Next_No_Check(end) == NULL);
+
+  if (*head) {
+    FL_EqualityCheck(FL_Previous_No_Check(*head), (void*)NULL, __FILE__,
+                     __LINE__);
+    FL_SetNext(end, *head);
+    FL_SetPrevious(*head, end);
+  }
+  *head = start;
+}
+
+// Calculates the size of the list that begins at |head|.
+size_t FL_Size(void* head) {
+  int count = 0;
+  if (head) {
+    FL_EqualityCheck(FL_Previous_No_Check(head), (void*)NULL, __FILE__,
+                     __LINE__);
+  }
+  while (head) {
+    count++;
+    head = FL_Next(head);
+  }
+  return count;
+}
+
+}  // namespace tcmalloc
+
+#else
+#include "linked_list.h"  // for SLL_SetNext
+
+namespace {
+
+inline void FL_SetNext(void* t, void* n) {
+  tcmalloc::SLL_SetNext(t, n);
+}
+
+}  // namespace
+
+#endif  // TCMALLOC_USE_DOUBLYLINKED_FREELIST

diff --git a/third_party/tcmalloc/chromium/src/free_list.h b/third_party/tcmalloc/chromium/src/free_list.h
new file mode 100644
index 0000000..05b5128
--- /dev/null
+++ b/third_party/tcmalloc/chromium/src/free_list.h

@@ -0,0 +1,205 @@
+// Copyright (c) 2011, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// ---
+// Author: Rebecca Shapiro <bxx@google.com>
+//
+// This file contains declarations of functions that implement doubly
+// linked lists and definitions of functions that implement singly
+// linked lists.  It also contains macros to tell the SizeMap class
+// how much space a node in the freelist needs so that SizeMap can
+// create large enough size classes.
+
+#ifndef TCMALLOC_FREE_LIST_H_
+#define TCMALLOC_FREE_LIST_H_
+
+#include <stddef.h>
+#include "internal_logging.h"
+#include "linked_list.h"
+#include "system-alloc.h"
+
+// Remove to enable singly linked lists (the default for open source tcmalloc).
+#define TCMALLOC_USE_DOUBLYLINKED_FREELIST
+
+namespace tcmalloc {
+
+#if defined(TCMALLOC_USE_DOUBLYLINKED_FREELIST)
+
+// size class information for common.h.
+static const bool kSupportsDoublyLinkedList = true;
+
+void FL_PopRange(void** head, int n, void** start, void** end);
+void FL_PushRange(void** head, void* start, void* end);
+size_t FL_Size(void* head);
+
+template <typename T>
+inline void FL_EqualityCheck(const T& v0,
+                             const T& v1,
+                             const char* file,
+                             int line) {
+  if (v0 != v1)
+    Log(kCrash, file, line, "Memory corruption detected.");
+}
+
+inline void EnsureNonLoop(void* node, void* next) {
+  // We only have time to do minimal checking.  We don't traverse the list, but
+  // only look for an immediate loop (cycle back to ourself).
+  if (node != next)
+    return;
+  Log(kCrash, __FILE__, __LINE__, "Circular loop in list detected: ", next);
+}
+
+inline void* MaskPtr(void* p) {
+  // Maximize ASLR entropy and guarantee the result is an invalid address.
+  const uintptr_t mask =
+      ~(reinterpret_cast<uintptr_t>(TCMalloc_SystemAlloc) >> 13);
+  return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(p) ^ mask);
+}
+
+inline void* UnmaskPtr(void* p) {
+  return MaskPtr(p);
+}
+
+// Returns value of the |previous| pointer w/out running a sanity
+// check.
+inline void* FL_Previous_No_Check(void* t) {
+  return UnmaskPtr(reinterpret_cast<void**>(t)[1]);
+}
+
+// Returns value of the |next| pointer w/out running a sanity check.
+inline void* FL_Next_No_Check(void* t) {
+  return UnmaskPtr(reinterpret_cast<void**>(t)[0]);
+}
+
+inline void* FL_Previous(void* t) {
+  void* previous = FL_Previous_No_Check(t);
+  if (previous) {
+    FL_EqualityCheck(FL_Next_No_Check(previous), t, __FILE__, __LINE__);
+  }
+  return previous;
+}
+
+inline void FL_SetPrevious(void* t, void* n) {
+  EnsureNonLoop(t, n);
+  reinterpret_cast<void**>(t)[1] = MaskPtr(n);
+}
+
+inline void FL_SetNext(void* t, void* n) {
+  EnsureNonLoop(t, n);
+  reinterpret_cast<void**>(t)[0] = MaskPtr(n);
+}
+
+inline void* FL_Next(void* t) {
+  void* next = FL_Next_No_Check(t);
+  if (next) {
+    FL_EqualityCheck(FL_Previous_No_Check(next), t, __FILE__, __LINE__);
+  }
+  return next;
+}
+
+// Pops the top element off the linked list whose first element is at
+// |*list|, and updates |*list| to point to the next element in the
+// list.  Returns the address of the element that was removed from the
+// linked list.  |list| must not be NULL.
+inline void* FL_Pop(void** list) {
+  void* result = *list;
+  ASSERT(FL_Previous_No_Check(result) == NULL);
+  *list = FL_Next(result);
+  if (*list != NULL) {
+    FL_SetPrevious(*list, NULL);
+  }
+  return result;
+}
+
+// Makes the element at |t| a singleton doubly linked list.
+inline void FL_Init(void* t) {
+  FL_SetPrevious(t, NULL);
+  FL_SetNext(t, NULL);
+}
+
+// Pushes element to a linked list whose first element is at
+// |*list|. When this call returns, |list| will point to the new head
+// of the linked list.
+inline void FL_Push(void** list, void* element) {
+  void* old = *list;
+  if (old == NULL) {  // Builds singleton list.
+    FL_Init(element);
+  } else {
+    ASSERT(FL_Previous_No_Check(old) == NULL);
+    FL_SetNext(element, old);
+    FL_SetPrevious(old, element);
+    FL_SetPrevious(element, NULL);
+  }
+  *list = element;
+}
+
+#else  // TCMALLOC_USE_DOUBLYLINKED_FREELIST not defined
+static const bool kSupportsDoublyLinkedList = false;
+
+inline void* FL_Next(void* t) {
+  return SLL_Next(t);
+}
+
+inline void FL_Init(void* t) {
+  SLL_SetNext(t, NULL);
+}
+
+inline void FL_Push(void** list, void* element) {
+  if (*list != element) {
+    SLL_Push(list, element);
+    return;
+  }
+  Log(kCrash, __FILE__, __LINE__, "Double Free of %p detected", element);
+}
+
+inline void* FL_Pop(void** list) {
+  return SLL_Pop(list);
+}
+
+// Removes |N| elements from a linked list to which |head| points.
+// |head| will be modified to point to the new |head|.  |start| and
+// |end| will point to the first and last nodes of the range.  Note
+// that |end| will point to NULL after this function is called.
+inline void FL_PopRange(void** head, int n, void** start, void** end) {
+  SLL_PopRange(head, n, start, end);
+}
+
+inline void FL_PushRange(void** head, void* start, void* end) {
+  SLL_PushRange(head, start, end);
+}
+
+inline size_t FL_Size(void* head) {
+  return SLL_Size(head);
+}
+
+#endif  // TCMALLOC_USE_DOUBLYLINKED_FREELIST
+
+}  // namespace tcmalloc
+
+#endif  // TCMALLOC_FREE_LIST_H_

diff --git a/third_party/tcmalloc/chromium/src/page_heap_allocator.h b/third_party/tcmalloc/chromium/src/page_heap_allocator.h
index 3fecabde..ad7e1c9 100644
--- a/third_party/tcmalloc/chromium/src/page_heap_allocator.h
+++ b/third_party/tcmalloc/chromium/src/page_heap_allocator.h

@@ -37,6 +37,7 @@
 #include <stddef.h>                     // for NULL, size_t
 
 #include "common.h"            // for MetaDataAlloc
+#include "free_list.h"         // for FL_Push/FL_Pop
 #include "internal_logging.h"  // for ASSERT
 
 namespace tcmalloc {
@@ -63,8 +64,7 @@
     // Consult free list
     void* result;
     if (free_list_ != NULL) {
-      result = free_list_;
-      free_list_ = *(reinterpret_cast<void**>(result));
+      result = FL_Pop(&free_list_);
     } else {
       if (free_avail_ < sizeof(T)) {
         // Need more room. We assume that MetaDataAlloc returns
@@ -87,8 +87,7 @@
   }
 
   void Delete(T* p) {
-    *(reinterpret_cast<void**>(p)) = free_list_;
-    free_list_ = p;
+    FL_Push(&free_list_, p);
     inuse_--;
   }
 

diff --git a/third_party/tcmalloc/chromium/src/tcmalloc.cc b/third_party/tcmalloc/chromium/src/tcmalloc.cc
index 7b18ddbc..53b611ec 100644
--- a/third_party/tcmalloc/chromium/src/tcmalloc.cc
+++ b/third_party/tcmalloc/chromium/src/tcmalloc.cc

@@ -121,8 +121,8 @@
 #include "base/spinlock.h"              // for SpinLockHolder
 #include "central_freelist.h"  // for CentralFreeListPadded
 #include "common.h"            // for StackTrace, kPageShift, etc
+#include "free_list.h"         // for FL_Init
 #include "internal_logging.h"  // for ASSERT, TCMalloc_Printer, etc
-#include "linked_list.h"       // for SLL_SetNext
 #include "malloc_hook-inl.h"       // for MallocHook::InvokeNewHook, etc
 #include "page_heap.h"         // for PageHeap, PageHeap::Stats
 #include "page_heap_allocator.h"  // for PageHeapAllocator
@@ -1480,7 +1480,7 @@
   }
 
   // Otherwise, delete directly into central cache
-  tcmalloc::SLL_SetNext(ptr, NULL);
+  tcmalloc::FL_Init(ptr);
   Static::central_cache()[cl].InsertRange(ptr, ptr, 1);
 }
 

diff --git a/third_party/tcmalloc/chromium/src/thread_cache.cc b/third_party/tcmalloc/chromium/src/thread_cache.cc
index 6d2f832..229a15aa 100644
--- a/third_party/tcmalloc/chromium/src/thread_cache.cc
+++ b/third_party/tcmalloc/chromium/src/thread_cache.cc

@@ -133,7 +133,10 @@
 
   if (--fetch_count >= 0) {
     size_ += byte_size * fetch_count;
-    list->PushRange(fetch_count, SLL_Next(start), end);
+    // Pop the top of the list and add the rest to the freelist.
+    void* second = start;
+    start = FL_Pop(&second);
+    list->PushRange(fetch_count, second, end);
   }
 
   // Increase max length slowly up to batch_size.  After that,

diff --git a/third_party/tcmalloc/chromium/src/thread_cache.h b/third_party/tcmalloc/chromium/src/thread_cache.h
index f8be1526..0fbbdc2e 100644
--- a/third_party/tcmalloc/chromium/src/thread_cache.h
+++ b/third_party/tcmalloc/chromium/src/thread_cache.h

@@ -42,21 +42,16 @@
 #ifdef HAVE_STDINT_H
 #include <stdint.h>                     // for uint32_t, uint64_t
 #endif
-#include <sys/types.h>                  // for ssize_t
+#include <sys/types.h>  // for ssize_t
 #include "base/commandlineflags.h"
 #include "common.h"
+#include "free_list.h"         // for FL_Pop, FL_PopRange, etc
+#include "internal_logging.h"  // for ASSERT, etc
 #include "linked_list.h"
 #include "maybe_threads.h"
-#include "page_heap_allocator.h"
-#include "sampler.h"
-#include "static_vars.h"
-
-#include "common.h"            // for SizeMap, kMaxSize, etc
-#include "internal_logging.h"  // for ASSERT, etc
-#include "linked_list.h"       // for SLL_Pop, SLL_PopRange, etc
 #include "page_heap_allocator.h"  // for PageHeapAllocator
-#include "sampler.h"           // for Sampler
-#include "static_vars.h"       // for Static
+#include "sampler.h"              // for Sampler
+#include "static_vars.h"          // for Static
 
 DECLARE_int64(tcmalloc_sample_parameter);
 
@@ -204,7 +199,7 @@
 
     uint32_t Push(void* ptr) {
       uint32_t length = length_ + 1;
-      SLL_Push(&list_, ptr);
+      FL_Push(&list_, ptr);
       length_ = length;
       return length;
     }
@@ -213,29 +208,29 @@
       ASSERT(list_ != NULL);
       length_--;
       if (length_ < lowater_) lowater_ = length_;
-      return SLL_Pop(&list_);
+      return FL_Pop(&list_);
     }
 
     bool TryPop(void **rv) {
-      if (SLL_TryPop(&list_, rv)) {
-        length_--;
-        if (PREDICT_FALSE(length_ < lowater_)) lowater_ = length_;
-        return true;
-      }
-      return false;
+      if (list_ == NULL)
+        return false;
+      *rv = Pop();
+      return true;
     }
 
     void* Next() {
-      return SLL_Next(&list_);
+      if (list_ == NULL)
+        return NULL;
+      return FL_Next(list_);
     }
 
     void PushRange(int N, void *start, void *end) {
-      SLL_PushRange(&list_, start, end);
+      FL_PushRange(&list_, start, end);
       length_ += N;
     }
 
     void PopRange(int N, void **start, void **end) {
-      SLL_PopRange(&list_, N, start, end);
+      FL_PopRange(&list_, N, start, end);
       ASSERT(length_ >= N);
       length_ -= N;
       if (length_ < lowater_) lowater_ = length_;

diff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c
index 7585bd0..471fb19 100644
--- a/third_party/zlib/deflate.c
+++ b/third_party/zlib/deflate.c

@@ -297,11 +297,6 @@
     int wrap = 1;
     static const char my_version[] = ZLIB_VERSION;
 
-    ushf *overlay;
-    /* We overlay pending_buf and d_buf+l_buf. This works since the average
-     * output size for (length,distance) codes is <= 24 bits.
-     */
-
     x86_check_features();
 
     if (version == Z_NULL || version[0] != my_version[0] ||
@@ -380,9 +375,46 @@
 
     s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
 
-    overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2);
-    s->pending_buf = (uchf *) overlay;
-    s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L);
+    /* We overlay pending_buf and sym_buf. This works since the average size
+     * for length/distance pairs over any compressed block is assured to be 31
+     * bits or less.
+     *
+     * Analysis: The longest fixed codes are a length code of 8 bits plus 5
+     * extra bits, for lengths 131 to 257. The longest fixed distance codes are
+     * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
+     * possible fixed-codes length/distance pair is then 31 bits total.
+     *
+     * sym_buf starts one-fourth of the way into pending_buf. So there are
+     * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
+     * in sym_buf is three bytes -- two for the distance and one for the
+     * literal/length. As each symbol is consumed, the pointer to the next
+     * sym_buf value to read moves forward three bytes. From that symbol, up to
+     * 31 bits are written to pending_buf. The closest the written pending_buf
+     * bits gets to the next sym_buf symbol to read is just before the last
+     * code is written. At that time, 31*(n-2) bits have been written, just
+     * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
+     * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
+     * symbols are written.) The closest the writing gets to what is unread is
+     * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
+     * can range from 128 to 32768.
+     *
+     * Therefore, at a minimum, there are 142 bits of space between what is
+     * written and what is read in the overlain buffers, so the symbols cannot
+     * be overwritten by the compressed data. That space is actually 139 bits,
+     * due to the three-bit fixed-code block header.
+     *
+     * That covers the case where either Z_FIXED is specified, forcing fixed
+     * codes, or when the use of fixed codes is chosen, because that choice
+     * results in a smaller compressed block than dynamic codes. That latter
+     * condition then assures that the above analysis also covers all dynamic
+     * blocks. A dynamic-code block will only be chosen to be emitted if it has
+     * fewer bits than a fixed-code block would for the same set of symbols.
+     * Therefore its average symbol length is assured to be less than 31. So
+     * the compressed data for a dynamic block also cannot overwrite the
+     * symbols from which it is being constructed.
+     */
+    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
+    s->pending_buf_size = (ulg)s->lit_bufsize * 4;
 
     if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
         s->pending_buf == Z_NULL) {
@@ -391,8 +423,12 @@
         deflateEnd (strm);
         return Z_MEM_ERROR;
     }
-    s->d_buf = overlay + s->lit_bufsize/sizeof(ush);
-    s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize;
+    s->sym_buf = s->pending_buf + s->lit_bufsize;
+    s->sym_end = (s->lit_bufsize - 1) * 3;
+    /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
+     * on 16 bit machines and because stored blocks are restricted to
+     * 64K-1 bytes.
+     */
 
     s->level = level;
     s->strategy = strategy;
@@ -599,7 +635,7 @@
 
     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
     s = strm->state;
-    if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3))
+    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
         return Z_BUF_ERROR;
     do {
         put = Buf_size - s->bi_valid;
@@ -1159,7 +1195,6 @@
 #else
     deflate_state *ds;
     deflate_state *ss;
-    ushf *overlay;
 
 
     if (deflateStateCheck(source) || dest == Z_NULL) {
@@ -1179,8 +1214,7 @@
     ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
     ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
     ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
-    overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2);
-    ds->pending_buf = (uchf *) overlay;
+    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
 
     if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
         ds->pending_buf == Z_NULL) {
@@ -1194,8 +1228,7 @@
     zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
 
     ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
-    ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush);
-    ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize;
+    ds->sym_buf = ds->pending_buf + ds->lit_bufsize;
 
     ds->l_desc.dyn_tree = ds->dyn_ltree;
     ds->d_desc.dyn_tree = ds->dyn_dtree;
@@ -1976,7 +2009,7 @@
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }
@@ -2107,7 +2140,7 @@
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }
@@ -2182,7 +2215,7 @@
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }
@@ -2221,7 +2254,7 @@
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }

diff --git a/third_party/zlib/deflate.h b/third_party/zlib/deflate.h
index ab56df7..6838296 100644
--- a/third_party/zlib/deflate.h
+++ b/third_party/zlib/deflate.h

@@ -217,7 +217,7 @@
     /* Depth of each subtree used as tie breaker for trees of equal frequency
      */
 
-    uchf *l_buf;          /* buffer for literals or lengths */
+    uchf *sym_buf;        /* buffer for distances and literals/lengths */
 
     uInt  lit_bufsize;
     /* Size of match buffer for literals/lengths.  There are 4 reasons for
@@ -239,13 +239,8 @@
      *   - I can't count above 4
      */
 
-    uInt last_lit;      /* running index in l_buf */
-
-    ushf *d_buf;
-    /* Buffer for distances. To simplify the code, d_buf and l_buf have
-     * the same number of elements. To use different lengths, an extra flag
-     * array would be necessary.
-     */
+    uInt sym_next;      /* running index in sym_buf */
+    uInt sym_end;       /* symbol table full when sym_next reaches this */
 
     ulg opt_len;        /* bit length of current block with optimal trees */
     ulg static_len;     /* bit length of current block with static trees */
@@ -325,20 +320,22 @@
 
 # define _tr_tally_lit(s, c, flush) \
   { uch cc = (c); \
-    s->d_buf[s->last_lit] = 0; \
-    s->l_buf[s->last_lit++] = cc; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = cc; \
     s->dyn_ltree[cc].Freq++; \
-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
    }
 # define _tr_tally_dist(s, distance, length, flush) \
   { uch len = (uch)(length); \
     ush dist = (ush)(distance); \
-    s->d_buf[s->last_lit] = dist; \
-    s->l_buf[s->last_lit++] = len; \
+    s->sym_buf[s->sym_next++] = dist; \
+    s->sym_buf[s->sym_next++] = dist >> 8; \
+    s->sym_buf[s->sym_next++] = len; \
     dist--; \
     s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
     s->dyn_dtree[d_code(dist)].Freq++; \
-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
   }
 #else
 # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)

diff --git a/third_party/zlib/trees.c b/third_party/zlib/trees.c
index 50cf4b4..5f89d05 100644
--- a/third_party/zlib/trees.c
+++ b/third_party/zlib/trees.c

@@ -416,7 +416,7 @@
 
     s->dyn_ltree[END_BLOCK].Freq = 1;
     s->opt_len = s->static_len = 0L;
-    s->last_lit = s->matches = 0;
+    s->sym_next = s->matches = 0;
 }
 
 #define SMALLEST 1
@@ -947,7 +947,7 @@
 
         Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ",
                 opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len,
-                s->last_lit));
+                s->sym_next / 3));
 
         if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
 
@@ -1016,8 +1016,9 @@
     unsigned dist;  /* distance of matched string */
     unsigned lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
 {
-    s->d_buf[s->last_lit] = (ush)dist;
-    s->l_buf[s->last_lit++] = (uch)lc;
+    s->sym_buf[s->sym_next++] = dist;
+    s->sym_buf[s->sym_next++] = dist >> 8;
+    s->sym_buf[s->sym_next++] = lc;
     if (dist == 0) {
         /* lc is the unmatched char */
         s->dyn_ltree[lc].Freq++;
@@ -1032,30 +1033,7 @@
         s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++;
         s->dyn_dtree[d_code(dist)].Freq++;
     }
-
-#ifdef TRUNCATE_BLOCK
-    /* Try to guess if it is profitable to stop the current block here */
-    if ((s->last_lit & 0x1fff) == 0 && s->level > 2) {
-        /* Compute an upper bound for the compressed length */
-        ulg out_length = (ulg)s->last_lit*8L;
-        ulg in_length = (ulg)((long)s->strstart - s->block_start);
-        int dcode;
-        for (dcode = 0; dcode < D_CODES; dcode++) {
-            out_length += (ulg)s->dyn_dtree[dcode].Freq *
-                (5L+extra_dbits[dcode]);
-        }
-        out_length >>= 3;
-        Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ",
-               s->last_lit, in_length, out_length,
-               100L - out_length*100L/in_length));
-        if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1;
-    }
-#endif
-    return (s->last_lit == s->lit_bufsize-1);
-    /* We avoid equality with lit_bufsize because of wraparound at 64K
-     * on 16 bit machines and because stored blocks are restricted to
-     * 64K-1 bytes.
-     */
+    return (s->sym_next == s->sym_end);
 }
 
 /* ===========================================================================
@@ -1068,13 +1046,14 @@
 {
     unsigned dist;      /* distance of matched string */
     int lc;             /* match length or unmatched char (if dist == 0) */
-    unsigned lx = 0;    /* running index in l_buf */
+    unsigned sx = 0;    /* running index in sym_buf */
     unsigned code;      /* the code to send */
     int extra;          /* number of extra bits to send */
 
-    if (s->last_lit != 0) do {
-        dist = s->d_buf[lx];
-        lc = s->l_buf[lx++];
+    if (s->sym_next != 0) do {
+        dist = s->sym_buf[sx++] & 0xff;
+        dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8;
+        lc = s->sym_buf[sx++];
         if (dist == 0) {
             send_code(s, lc, ltree); /* send a literal byte */
             Tracecv(isgraph(lc), (stderr," '%c' ", lc));
@@ -1099,11 +1078,10 @@
             }
         } /* literal or match pair ? */
 
-        /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */
-        Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx,
-               "pendingBuf overflow");
+        /* Check that the overlay between pending_buf and sym_buf is ok: */
+        Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
 
-    } while (lx < s->last_lit);
+    } while (sx < s->sym_next);
 
     send_code(s, END_BLOCK, ltree);
 }

diff --git a/tools/determinism/deterministic_build_whitelist.pyl b/tools/determinism/deterministic_build_whitelist.pyl
index b30818d..47c400d2 100644
--- a/tools/determinism/deterministic_build_whitelist.pyl
+++ b/tools/determinism/deterministic_build_whitelist.pyl

@@ -22,6 +22,10 @@
   # https://crbug.com/330263
   'linux': [
     'ppapi_nacl_tests_pnacl_newlib_x64.nexe',
+
+    # TODO(tikuta): Remove this when crbug.com/870611 is fixed.
+    'remoting-webapp.v2.zip',
+
     'zucchini_apply_fuzzer_seed_corpus.zip',
 
     # TODO(tikuta): Remove this when crbug.com/870584 is fixed.

diff --git a/tools/mb/mb_config.pyl b/tools/mb/mb_config.pyl
index 7e3f777..33d9d97 100644
--- a/tools/mb/mb_config.pyl
+++ b/tools/mb/mb_config.pyl

@@ -592,7 +592,6 @@
       'linux_chromium_compile_rel_ng': 'release_trybot',
       'linux_chromium_dbg_32_ng': 'gpu_tests_debug_trybot_x86',
       'linux_chromium_dbg_ng': 'gpu_tests_debug_trybot',
-      'linux_chromium_gn_upload': 'gn_linux_upload',
       'linux_chromium_headless_rel': 'headless_linux_release_trybot',
 
       # This is intentionally a release_bot and not a release_trybot;
@@ -631,7 +630,6 @@
       'mac_chromium_compile_dbg_ng': 'gpu_tests_debug_trybot',
       'mac_chromium_compile_rel_ng': 'gpu_tests_release_trybot',
       'mac_chromium_dbg_ng': 'gpu_tests_debug_trybot',
-      'mac_chromium_gn_upload': 'release_bot',
       'mac_chromium_rel_ng': 'gpu_tests_release_trybot',
       'mac_nacl_sdk': 'release_bot',
       'mac_nacl_sdk_build': 'release_bot',
@@ -658,8 +656,8 @@
       'win10_chromium_x64_rel_ng': 'gpu_tests_release_trybot',
       'win10_chromium_x64_rel_ng_exp': 'release_trybot',
       'win-annotator-rel': 'release_trybot',
+      'win-asan': 'asan_clang_fuzzer_static_v8_heap_minimal_symbols_release',
       'win-jumbo-rel': 'jumbo_release_bot_minimal_symbols',
-      'win_chromium_gn_upload': 'release_bot_x86_minimal_symbols',
       'win_x64_archive': 'release_trybot',
       'win_archive': 'release_trybot_x86',
       'win_chromium_compile_dbg_ng': 'gpu_tests_debug_trybot_x86_minimal_symbols',

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 55125bd6..bda2dced 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -1691,8 +1691,10 @@
   <summary>Defines the types of ARC SDK version upgrade</summary>
   <int value="0" label="NO_UPGRADE"/>
   <int value="1" label="UNKNOWN_UPGRADE"/>
-  <int value="2" label="N_TO_P"/>
-  <int value="3" label="M_TO_P"/>
+  <int value="2" label="UNKNOWN_DOWNGRADE"/>
+  <int value="3" label="M_TO_N"/>
+  <int value="4" label="M_TO_P"/>
+  <int value="5" label="N_TO_P"/>
 </enum>
 
 <enum name="ArcSupervisionTransitionResult">
@@ -10069,6 +10071,20 @@
   <int value="3" label="Encryption unavailable"/>
 </enum>
 
+<enum name="DemoModeResourcesRemovalReason">
+  <int value="0" label="Low available disk space"/>
+  <int value="1" label="Device enterprise enrolled"/>
+  <int value="2" label="Regular user activity detected"/>
+</enum>
+
+<enum name="DemoModeResourcesRemovalResult">
+  <int value="0" label="Successfully removed"/>
+  <int value="1" label="Not found on disk"/>
+  <int value="2" label="Removal not allowed (should not be reported)"/>
+  <int value="3" label="Resources already removed (should not be reported)"/>
+  <int value="4" label="Removal failed"/>
+</enum>
+
 <enum name="DeprecatedAcceleratorUsage">
   <int value="0" label="Deprecated key accelerator is used"/>
   <int value="1" label="New key accelerator is used"/>
@@ -28314,6 +28330,7 @@
   <int value="-1268836676" label="disable-out-of-process-pdf"/>
   <int value="-1267958145" label="disable-pdf-material-ui"/>
   <int value="-1262152606" label="disable-lock-screen-apps"/>
+  <int value="-1261972671" label="OmniboxDocumentProvider:disabled"/>
   <int value="-1261263046"
       label="RemoveUsageOfDeprecatedGaiaSigninEndpoint:disabled"/>
   <int value="-1259901957" label="VrBrowserKeyboard:disabled"/>
@@ -29163,6 +29180,7 @@
   <int value="535131384" label="OmniboxTailSuggestions:enabled"/>
   <int value="535976218" label="enable-plugin-power-saver"/>
   <int value="538468149" label="OfflinePagesCT:enabled"/>
+  <int value="538600423" label="OmniboxDocumentProvider:enabled"/>
   <int value="546520086" label="enable-data-reduction-proxy-savings-promo"/>
   <int value="546710806" label="disable-easy-signin"/>
   <int value="549483647" label="EnableUnifiedMultiDeviceSettings:disabled"/>

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index e4c7e87..3bc19a65 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -17845,6 +17845,35 @@
   </summary>
 </histogram>
 
+<histogram name="DemoMode.ResourcesRemoval.Reason"
+    enum="DemoModeResourcesRemovalReason" expires_after="M73">
+  <owner>michaelpg@chromium.org</owner>
+  <owner>ovanieva@chromium.org</owner>
+  <owner>tbarzic@chromium.org</owner>
+  <summary>
+    Tracks the reason for removal of pre-install demo resources. To support
+    offline demo mode, factory Chrome OS devices will have a set of offline
+    enabled demo mode apps pre-installed. These resources are removed once they
+    are not needed anymore.
+  </summary>
+</histogram>
+
+<histogram name="DemoMode.ResourcesRemoval.Result"
+    enum="DemoModeResourcesRemovalResult" expires_after="M73">
+  <owner>michaelpg@chromium.org</owner>
+  <owner>ovanieva@chromium.org</owner>
+  <owner>tbarzic@chromium.org</owner>
+  <summary>
+    Tracks the result of requests to remove pre-installed demo resources. To
+    support offline demo mode, factory Chrome OS devices will have a set of
+    offline enabled demo mode apps pre-installed. These resources are removed
+    once they are not needed anymore. This will record only requests that
+    attempted deleting pre-installed resources from disk. Requests that fail
+    early will be ignored. For example, a request will fail early if the device
+    is in demo mode, or the resources have already been removed.
+  </summary>
+</histogram>
+
 <histogram name="DesktopIOSPromotion.DismissalReason"
     enum="DesktopIOSPromotionDismissalReason">
   <owner>mrefaat@chromium.org</owner>
@@ -54487,6 +54516,15 @@
   </summary>
 </histogram>
 
+<histogram name="Net.QuicSession.ActiveStreamsOnGoAwayAfterPathDegrading"
+    units="Streams">
+  <owner>renjietang@chromium.org</owner>
+  <summary>
+    The number of active streams when the quic session decides to go away on
+    path degrading.
+  </summary>
+</histogram>
+
 <histogram name="Net.QuicSession.AsyncRead" enum="Boolean">
   <owner>rch@chromium.org</owner>
   <summary>
@@ -54725,6 +54763,15 @@
   </summary>
 </histogram>
 
+<histogram name="Net.QuicSession.DrainingStreamsOnGoAwayAfterPathDegrading"
+    units="Streams">
+  <owner>renjietang@chromium.org</owner>
+  <summary>
+    The number of draining streams when the quic session decides to go away on
+    path degrading.
+  </summary>
+</histogram>
+
 <histogram name="Net.QuicSession.DuplicatePacketsReceived">
   <owner>rch@chromium.org</owner>
   <summary>

diff --git a/tools/metrics/ukm/builders_template.py b/tools/metrics/ukm/builders_template.py
index 56001f2c..a94edc3f 100644
--- a/tools/metrics/ukm/builders_template.py
+++ b/tools/metrics/ukm/builders_template.py

@@ -32,7 +32,8 @@
 event_template="""
 class {event.name} final : public ::ukm::internal::UkmEntryBuilderBase {{
  public:
-  {event.name}(ukm::SourceId source_id);
+  explicit {event.name}(ukm::SourceId source_id);
+  explicit {event.name}(base::UkmSourceId source_id);
   ~{event.name}() override;
 
   static const char kEntryName[];
@@ -70,6 +71,10 @@
   ::ukm::internal::UkmEntryBuilderBase(source_id, kEntryNameHash) {{
 }}
 
+{event.name}::{event.name}(base::UkmSourceId source_id) :
+  ::ukm::internal::UkmEntryBuilderBase(source_id, kEntryNameHash) {{
+}}
+
 {event.name}::~{event.name}() = default;
 
 {metric_code}

diff --git a/tools/perf/expectations.config b/tools/perf/expectations.config
index d7fa8c66..fb0976d 100644
--- a/tools/perf/expectations.config
+++ b/tools/perf/expectations.config

@@ -252,6 +252,7 @@
 crbug.com/839470 [ Win ] v8.browsing_desktop/browse:social:twitter_infinite_scroll [ Skip ]
 crbug.com/854239 [ Linux ] v8.browsing_desktop/browse:social:twitter_infinite_scroll [ Skip ]
 crbug.com/864718 [ Linux ] v8.browsing_desktop/browse:news:flipboard [ Skip ]
+crbug.com/875159 [ Win_10 ] v8.browsing_desktop/browse:social:facebook_infinite_scroll [ Skip ]
 
 # Benchmark: v8.browsing_desktop-future
 crbug.com/773084 [ Mac ] v8.browsing_desktop-future/browse:tools:maps [ Skip ]
@@ -288,6 +289,7 @@
 crbug.com/803465 [ Nexus_5 ] v8.browsing_mobile-future/browse:chrome:newtab [ Skip ]
 crbug.com/799080 [ Nexus_5X Android_Webview ] v8.browsing_mobile-future/browse:social:facebook [ Skip ]
 crbug.com/799080 [ Nexus_5X Android_Webview ] v8.browsing_mobile-future/browse:social:facebook [ Skip ]
+crbug.com/875159 [ Win_10 ] v8.browsing_desktop-future/browse:social:facebook_infinite_scroll [ Skip ]
 
 # Benchmark: v8.detached_context_age_in_gc
 crbug.com/770982 [ Win ] v8.detached_context_age_in_gc/Docs_(1_open_document_tab) [ Skip ]

diff --git a/tools/perf/page_sets/data/rendering_desktop.json b/tools/perf/page_sets/data/rendering_desktop.json
index f3ca1cb..8054c9a7f 100644
--- a/tools/perf/page_sets/data/rendering_desktop.json
+++ b/tools/perf/page_sets/data/rendering_desktop.json

@@ -16,16 +16,16 @@
             "DEFAULT": "rendering_desktop_002.wprgo"
         },
         "animometer_webgl": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "aquarium": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "aquarium_20k": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "blob": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "blogspot_2018": {
             "DEFAULT": "rendering_desktop_000.wprgo"
@@ -39,6 +39,9 @@
         "booking_pinch_2018": {
             "DEFAULT": "rendering_desktop_007.wprgo"
         },
+        "camera_to_webgl": {
+            "DEFAULT": "rendering_desktop_011.wprgo"
+        },
         "cats_unscaled": {
             "DEFAULT": "rendering_desktop_008.wprgo"
         },
@@ -67,10 +70,10 @@
             "DEFAULT": "rendering_desktop_004.wprgo"
         },
         "dynamic_cube_map": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "earth": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "ebay_2018": {
             "DEFAULT": "rendering_desktop_000.wprgo"
@@ -172,7 +175,7 @@
             "DEFAULT": "rendering_desktop_004.wprgo"
         },
         "many_planets_deep": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "maps_move_2018": {
             "DEFAULT": "rendering_desktop_001.wprgo"
@@ -223,10 +226,10 @@
             "DEFAULT": "rendering_desktop_010.wprgo"
         },
         "nvidia_vertex_buffer_object": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "particles": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "pinterest_2018": {
             "DEFAULT": "rendering_desktop_000.wprgo"
@@ -235,7 +238,7 @@
             "DEFAULT": "rendering_desktop_004.wprgo"
         },
         "san_angeles": {
-            "DEFAULT": "rendering_desktop_006.wprgo"
+            "DEFAULT": "rendering_desktop_011.wprgo"
         },
         "smash_cat": {
             "DEFAULT": "rendering_desktop_004.wprgo"

diff --git a/tools/perf/page_sets/data/rendering_desktop_006.wprgo.sha1 b/tools/perf/page_sets/data/rendering_desktop_006.wprgo.sha1
deleted file mode 100644
index e7cf7a5..0000000
--- a/tools/perf/page_sets/data/rendering_desktop_006.wprgo.sha1
+++ /dev/null

@@ -1 +0,0 @@
-7fcc3ca13fa01e90d62be4ffe5568c680a61b9c0
\ No newline at end of file

diff --git a/tools/perf/page_sets/data/rendering_desktop_011.wprgo.sha1 b/tools/perf/page_sets/data/rendering_desktop_011.wprgo.sha1
new file mode 100644
index 0000000..b179bec
--- /dev/null
+++ b/tools/perf/page_sets/data/rendering_desktop_011.wprgo.sha1

@@ -0,0 +1 @@
+cea8e34f634f897f4b06541fd6273c113dfdf6aa
\ No newline at end of file

diff --git a/tools/perf/page_sets/data/rendering_mobile.json b/tools/perf/page_sets/data/rendering_mobile.json
index 0a2ea0a..a70fba8 100644
--- a/tools/perf/page_sets/data/rendering_mobile.json
+++ b/tools/perf/page_sets/data/rendering_mobile.json

@@ -28,13 +28,13 @@
             "DEFAULT": "rendering_mobile_011.wprgo"
         },
         "animometer_webgl": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "aquarium": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "aquarium_20k": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "baidu_mobile_2018": {
             "DEFAULT": "rendering_mobile_011.wprgo"
@@ -52,7 +52,7 @@
             "DEFAULT": "rendering_mobile_011.wprgo"
         },
         "blob": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "blogspot_2018": {
             "DEFAULT": "rendering_mobile_000.wprgo"
@@ -84,6 +84,9 @@
         "booking.com_mobile_sync_scroll_2018": {
             "DEFAULT": "rendering_mobile_011.wprgo"
         },
+        "camera_to_webgl": {
+            "DEFAULT": "rendering_mobile_026.wprgo"
+        },
         "capitolvolkswagen_mobile_2018": {
             "DEFAULT": "rendering_mobile_011.wprgo"
         },
@@ -163,10 +166,10 @@
             "DEFAULT": "rendering_mobile_011.wprgo"
         },
         "dynamic_cube_map": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "earth": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "ebay_2018": {
             "DEFAULT": "rendering_mobile_000.wprgo"
@@ -367,7 +370,7 @@
             "DEFAULT": "rendering_mobile_004.wprgo"
         },
         "many_planets_deep": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "mask_transition_animation": {
             "DEFAULT": "rendering_mobile_020.wprgo"
@@ -427,7 +430,7 @@
             "DEFAULT": "rendering_mobile_010.wprgo"
         },
         "nvidia_vertex_buffer_object": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "nyc_gov_scroll_2018": {
             "DEFAULT": "rendering_mobile_016.wprgo"
@@ -469,7 +472,7 @@
             "DEFAULT": "rendering_mobile_020.wprgo"
         },
         "particles": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "pbs_pathological_2018": {
             "DEFAULT": "rendering_mobile_025.wprgo"
@@ -505,7 +508,7 @@
             "DEFAULT": "rendering_mobile_004.wprgo"
         },
         "san_angeles": {
-            "DEFAULT": "rendering_mobile_006.wprgo"
+            "DEFAULT": "rendering_mobile_026.wprgo"
         },
         "sfgate_mobile_2018": {
             "DEFAULT": "rendering_mobile_011.wprgo"

diff --git a/tools/perf/page_sets/data/rendering_mobile_006.wprgo.sha1 b/tools/perf/page_sets/data/rendering_mobile_006.wprgo.sha1
deleted file mode 100644
index e7cf7a5..0000000
--- a/tools/perf/page_sets/data/rendering_mobile_006.wprgo.sha1
+++ /dev/null

@@ -1 +0,0 @@
-7fcc3ca13fa01e90d62be4ffe5568c680a61b9c0
\ No newline at end of file

diff --git a/tools/perf/page_sets/data/rendering_mobile_026.wprgo.sha1 b/tools/perf/page_sets/data/rendering_mobile_026.wprgo.sha1
new file mode 100644
index 0000000..96d1ef2
--- /dev/null
+++ b/tools/perf/page_sets/data/rendering_mobile_026.wprgo.sha1

@@ -0,0 +1 @@
+35ec13d127d4f6bcd4a05da4e8f34745cd66a6fb
\ No newline at end of file

diff --git a/tools/perf/page_sets/rendering/rendering_stories.py b/tools/perf/page_sets/rendering/rendering_stories.py
index ee7f2c3..fada5cb 100644
--- a/tools/perf/page_sets/rendering/rendering_stories.py
+++ b/tools/perf/page_sets/rendering/rendering_stories.py

@@ -40,9 +40,21 @@
           platform not in story_class.SUPPORTED_PLATFORMS):
         continue
 
+      required_args = []
+      if (story_class.TAGS and
+          story_tags.USE_FAKE_CAMERA_DEVICE in story_class.TAGS):
+        required_args += [
+            # Use a fake camera showing a placeholder video.
+            '--use-fake-device-for-media-stream',
+            # Don't prompt for camera access. (Conveniently,
+            # this takes precedent over --deny-permission-prompts.)
+            '--use-fake-ui-for-media-stream',
+        ]
+
       self.AddStory(story_class(
           page_set=self,
-          shared_page_state_class=shared_page_state_class))
+          shared_page_state_class=shared_page_state_class,
+          extra_browser_args=required_args))
 
       if (platform == platforms.MOBILE and
           story_class.TAGS and
@@ -51,7 +63,9 @@
             page_set=self,
             shared_page_state_class=shared_page_state_class,
             name_suffix='_desktop_gpu_raster',
-            extra_browser_args=['--force-gpu-rasterization']))
+            extra_browser_args=required_args + [
+                '--force-gpu-rasterization',
+            ]))
 
       if (platform == platforms.MOBILE and
           story_class.TAGS and
@@ -60,7 +74,9 @@
             page_set=self,
             shared_page_state_class=shared_page_state_class,
             name_suffix='_sync_scroll',
-            extra_browser_args=['--disable-threaded-scrolling']))
+            extra_browser_args=required_args + [
+                '--disable-threaded-scrolling',
+            ]))
 
       if (platform == platforms.MOBILE and
           story_class.TAGS and
@@ -69,8 +85,10 @@
             page_set=self,
             shared_page_state_class=shared_page_state_class,
             name_suffix='_gpu_rasterization_and_decoding',
-            extra_browser_args=['--force-gpu-rasterization',
-                                '--enable-accelerated-jpeg-decoding']))
+            extra_browser_args=required_args + [
+                '--force-gpu-rasterization',
+                '--enable-accelerated-jpeg-decoding',
+            ]))
 
 
 class DesktopRenderingStorySet(RenderingStorySet):

diff --git a/tools/perf/page_sets/rendering/story_tags.py b/tools/perf/page_sets/rendering/story_tags.py
index c1767dc3..55f7ea1dd 100644
--- a/tools/perf/page_sets/rendering/story_tags.py
+++ b/tools/perf/page_sets/rendering/story_tags.py

@@ -19,6 +19,8 @@
     'fastpath', 'Fast path stories.')
 REQUIRED_WEBGL = Tag(
     'required_webgl', 'Stories that are skipped if no webgl support')
+USE_FAKE_CAMERA_DEVICE = Tag(
+    'use_fake_camera_device', 'Story requires a camera device for media')
 
 # Below are tags for filtering by page sets
 

diff --git a/tools/perf/page_sets/rendering/tough_webgl_cases.py b/tools/perf/page_sets/rendering/tough_webgl_cases.py
index 80e554e..2d9e6f34 100644
--- a/tools/perf/page_sets/rendering/tough_webgl_cases.py
+++ b/tools/perf/page_sets/rendering/tough_webgl_cases.py

@@ -91,3 +91,10 @@
   BASE_NAME = 'animometer_webgl'
   # pylint: disable=line-too-long
   URL = 'http://kenrussell.github.io/webgl-animometer/Animometer/tests/3d/webgl.html'
+
+
+class CameraToWebGLPage(ToughWebglPage):
+  TAGS = ToughWebglPage.TAGS + [story_tags.USE_FAKE_CAMERA_DEVICE]
+  BASE_NAME = 'camera_to_webgl'
+  # pylint: disable=line-too-long
+  URL = 'https://www.khronos.org/registry/webgl/sdk/tests/extra/texture-from-camera-stress.html?uploadsPerFrame=200'

diff --git a/ui/base/material_design/material_design_controller.cc b/ui/base/material_design/material_design_controller.cc
index eae6b7f..caf62d0 100644
--- a/ui/base/material_design/material_design_controller.cc
+++ b/ui/base/material_design/material_design_controller.cc

@@ -54,10 +54,10 @@
 
 #if defined(OS_CHROMEOS)
 
-// Whether to use MATERIAL_TOUCH_OPTIMIZED when a touch device is detected.
-// Enabled by default on ChromeOS.
+// Whether to use touchable UI.
+// http://crbug.com/875122 - Disabled by default on ChromeOS except on tablets.
 const base::Feature kTouchOptimizedUi = {"TouchOptimizedUi",
-                                         base::FEATURE_ENABLED_BY_DEFAULT};
+                                         base::FEATURE_DISABLED_BY_DEFAULT};
 
 MaterialDesignController::Mode GetDefaultTouchDeviceMode() {
   bool material_refresh_enabled = IsMaterialRefreshEnabled();

diff --git a/ui/file_manager/gallery/js/BUILD.gn b/ui/file_manager/gallery/js/BUILD.gn
index 6d7dcb1..24b9c98 100644
--- a/ui/file_manager/gallery/js/BUILD.gn
+++ b/ui/file_manager/gallery/js/BUILD.gn

@@ -180,6 +180,15 @@
     "image_editor:viewport",
     "//third_party/polymer/v1_0/components-chromium/paper-progress:paper-progress-extracted",
   ]
+  externs_list = [ "../../externs/gallery_foreground.js" ]
+}
+
+js_library("slide_mode_unittest") {
+  deps = [
+    ":slide_mode",
+    "../../file_manager/common/js:unittest_util",
+    "//ui/webui/resources/js:webui_resource_test",
+  ]
 }
 
 js_library("thumbnail_mode") {
@@ -201,6 +210,7 @@
     ":gallery_data_model_unittest",
     ":gallery_util_unittest",
     ":ribbon_unittest",
+    ":slide_mode_unittest",
   ]
 }
 

diff --git a/ui/file_manager/gallery/js/slide_mode_unittest.html b/ui/file_manager/gallery/js/slide_mode_unittest.html
deleted file mode 100644
index b5810b6..0000000
--- a/ui/file_manager/gallery/js/slide_mode_unittest.html
+++ /dev/null

@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<!-- Copyright 2015 The Chromium Authors. All rights reserved.
-  -- Use of this source code is governed by a BSD-style license that can be
-  -- found in the LICENSE file.
-  -->
-
-<script>
-// These variables are referenced in the definition of EDITOR_MODES const
-// variable of slide mode.
-var ImageEditorMode = {
-  InstantAutofix: function() {},
-  Crop: function() {},
-  Resize: function() {},
-  Exposure: function() {},
-  OneClick: function() {}
-};
-
-var Command = {
-  Rotate: function() {}
-};
-</script>
-<script src="../../../webui/resources/js/assert.js"></script>
-<script src="../../../webui/resources/js/cr.js"></script>
-<script src="../../../webui/resources/js/cr/event_target.js"></script>
-<script src="../../file_manager/common/js/unittest_util.js"></script>
-<script src="slide_mode.js"></script>
-
-<script src="slide_mode_unittest.js"></script>

diff --git a/ui/file_manager/gallery/js/slide_mode_unittest.js b/ui/file_manager/gallery/js/slide_mode_unittest.js
index a45af3a..2626c0f 100644
--- a/ui/file_manager/gallery/js/slide_mode_unittest.js
+++ b/ui/file_manager/gallery/js/slide_mode_unittest.js

@@ -9,17 +9,13 @@
   return `${id}-${Array.from(arguments).slice(1).join("-")}`;
 }
 
-var fallbackDir = {
-  fullPath: '/fallback'
-};
+const fallbackDir = /** @type{!DirectoryEntry} */ ({fullPath: '/fallback'});
 
 /**
  * Test case for writable format and writable volume.
  */
 function testGetEditorWarningMessageWritableFormatAndVolumeCase(callback) {
-  var item = {
-    isWritableFormat: () => true
-  };
+  const item = /** @type{!GalleryItem} */ ({isWritableFormat: () => true});
 
   reportPromise(SlideMode.getEditorWarningMessage(
       item, '', fallbackDir).then(function(message) {
@@ -31,9 +27,7 @@
  * Test case for writable format and read only volume.
  */
 function testGetEditorWarningMessageWritableFormatReadOnlyCase(callback) {
-  var item = {
-    isWritableFormat: () => true
-  };
+  const item = /** @type{!GalleryItem} */ ({isWritableFormat: () => true});
 
   reportPromise(SlideMode.getEditorWarningMessage(
       item, 'NON_WRITABLE_VOLUME', fallbackDir).then(function(message) {
@@ -46,7 +40,7 @@
  */
 function testGetEditorWarningMessageNonWritableFormatAndWritableVolumeCase(
     callback) {
-  var item = {
+  const item = /** @type{!GalleryItem} */ ({
     isWritableFormat: function() {
       return false;
     },
@@ -56,13 +50,13 @@
         getParent: function(callback) {
           callback({ fullPath: '/parent' });
         }
-      }
+      };
     },
     getCopyName: function(dirEntry) {
       assertEquals(dirEntry.fullPath, '/parent');
       return Promise.resolve('test - Edited.png');
     }
-  };
+  });
 
   reportPromise(SlideMode.getEditorWarningMessage(
       item, '', fallbackDir).then(function(message) {
@@ -75,7 +69,7 @@
  * Test case for non-writable format and read only volume.
  */
 function testGetEditorWarningMessageNonWritableFormatAndReadOnlyCase(callback) {
-  var item = {
+  const item = /** @type{!GalleryItem} */ ({
     isWritableFormat: function() {
       return false;
     },
@@ -83,7 +77,7 @@
       assertEquals(dirEntry.fullPath, '/fallback');
       return Promise.resolve('test - Edited.png');
     }
-  };
+  });
 
   reportPromise(SlideMode.getEditorWarningMessage(
       item, 'NON_WRITABLE_VOLUME', fallbackDir).then(function(message) {

diff --git a/ui/gfx/geometry/mojo/geometry_struct_traits.h b/ui/gfx/geometry/mojo/geometry_struct_traits.h
index 2fdacbe..aa6251e2 100644
--- a/ui/gfx/geometry/mojo/geometry_struct_traits.h
+++ b/ui/gfx/geometry/mojo/geometry_struct_traits.h

@@ -163,7 +163,7 @@
   static bool Read(gfx::mojom::Vector3dFDataView data, gfx::Vector3dF* out) {
     out->set_x(data.x());
     out->set_y(data.y());
-    out->set_y(data.z());
+    out->set_z(data.z());
     return true;
   }
 };

diff --git a/ui/gfx/geometry/mojo/geometry_struct_traits_unittest.cc b/ui/gfx/geometry/mojo/geometry_struct_traits_unittest.cc
index 2be935b..4dd59db 100644
--- a/ui/gfx/geometry/mojo/geometry_struct_traits_unittest.cc
+++ b/ui/gfx/geometry/mojo/geometry_struct_traits_unittest.cc

@@ -36,6 +36,10 @@
     std::move(callback).Run(p);
   }
 
+  void EchoPoint3F(const Point3F& p, EchoPoint3FCallback callback) override {
+    std::move(callback).Run(p);
+  }
+
   void EchoSize(const Size& s, EchoSizeCallback callback) override {
     std::move(callback).Run(s);
   }
@@ -69,6 +73,11 @@
     std::move(callback).Run(v);
   }
 
+  void EchoVector3dF(const Vector3dF& v,
+                     EchoVector3dFCallback callback) override {
+    std::move(callback).Run(v);
+  }
+
   base::MessageLoop loop_;
   mojo::BindingSet<GeometryTraitsTestService> traits_test_bindings_;
 
@@ -99,6 +108,19 @@
   EXPECT_EQ(y, output.y());
 }
 
+TEST_F(GeometryStructTraitsTest, Point3F) {
+  const float x = 1234.5f;
+  const float y = 6789.6f;
+  const float z = 5432.1f;
+  gfx::Point3F input(x, y, z);
+  mojom::GeometryTraitsTestServicePtr proxy = GetTraitsTestProxy();
+  gfx::Point3F output;
+  proxy->EchoPoint3F(input, &output);
+  EXPECT_EQ(x, output.x());
+  EXPECT_EQ(y, output.y());
+  EXPECT_EQ(z, output.z());
+}
+
 TEST_F(GeometryStructTraitsTest, Size) {
   const int32_t width = 1234;
   const int32_t height = 5678;
@@ -203,4 +225,17 @@
   EXPECT_EQ(y, output.y());
 }
 
+TEST_F(GeometryStructTraitsTest, Vector3dF) {
+  const float x = 1234.5f;
+  const float y = 6789.6f;
+  const float z = 5432.1f;
+  gfx::Vector3dF input(x, y, z);
+  mojom::GeometryTraitsTestServicePtr proxy = GetTraitsTestProxy();
+  gfx::Vector3dF output;
+  proxy->EchoVector3dF(input, &output);
+  EXPECT_EQ(x, output.x());
+  EXPECT_EQ(y, output.y());
+  EXPECT_EQ(z, output.z());
+}
+
 }  // namespace gfx

diff --git a/ui/gfx/geometry/mojo/geometry_traits_test_service.mojom b/ui/gfx/geometry/mojo/geometry_traits_test_service.mojom
index 8d4fb94..1be6ae9cb 100644
--- a/ui/gfx/geometry/mojo/geometry_traits_test_service.mojom
+++ b/ui/gfx/geometry/mojo/geometry_traits_test_service.mojom

@@ -16,6 +16,9 @@
   EchoPointF(PointF p) => (PointF pass);
 
   [Sync]
+  EchoPoint3F(Point3F p) => (Point3F pass);
+
+  [Sync]
   EchoSize(Size s) => (Size pass);
 
   [Sync]
@@ -38,4 +41,7 @@
 
   [Sync]
   EchoVector2dF(Vector2dF v) => (Vector2dF pass);
+
+  [Sync]
+  EchoVector3dF(Vector3dF v) => (Vector3dF pass);
 };

diff --git a/ui/message_center/views/message_popup_collection.cc b/ui/message_center/views/message_popup_collection.cc
index f68c257..636b50f5 100644
--- a/ui/message_center/views/message_popup_collection.cc
+++ b/ui/message_center/views/message_popup_collection.cc

@@ -170,6 +170,10 @@
   Update();
 }
 
+void MessagePopupCollection::OnCenterVisibilityChanged(Visibility visibility) {
+  Update();
+}
+
 void MessagePopupCollection::AnimationEnded(const gfx::Animation* animation) {
   Update();
 }
@@ -412,6 +416,12 @@
 }
 
 void MessagePopupCollection::MarkRemovedPopup() {
+  if (MessageCenter::Get()->IsMessageCenterVisible()) {
+    for (auto& item : popup_items_)
+      item.is_animating = true;
+    return;
+  }
+
   std::set<std::string> existing_ids;
   for (Notification* notification :
        MessageCenter::Get()->GetPopupNotifications()) {
@@ -524,6 +534,9 @@
 }
 
 bool MessagePopupCollection::HasAddedPopup() const {
+  if (MessageCenter::Get()->IsMessageCenterVisible())
+    return false;
+
   std::set<std::string> existing_ids;
   for (const auto& item : popup_items_)
     existing_ids.insert(item.id);
@@ -543,6 +556,9 @@
     existing_ids.insert(notification->id());
   }
 
+  if (MessageCenter::Get()->IsMessageCenterVisible())
+    return !popup_items_.empty();
+
   for (const auto& item : popup_items_) {
     if (!existing_ids.count(item.id))
       return true;

diff --git a/ui/message_center/views/message_popup_collection.h b/ui/message_center/views/message_popup_collection.h
index 36337a57..6640c9e 100644
--- a/ui/message_center/views/message_popup_collection.h
+++ b/ui/message_center/views/message_popup_collection.h

@@ -53,6 +53,7 @@
   void OnNotificationRemoved(const std::string& notification_id,
                              bool by_user) override;
   void OnNotificationUpdated(const std::string& notification_id) override;
+  void OnCenterVisibilityChanged(Visibility visibility) override;
 
   // AnimationDelegate:
   void AnimationEnded(const gfx::Animation* animation) override;

diff --git a/ui/message_center/views/message_popup_collection_unittest.cc b/ui/message_center/views/message_popup_collection_unittest.cc
index b5046bd..c641506 100644
--- a/ui/message_center/views/message_popup_collection_unittest.cc
+++ b/ui/message_center/views/message_popup_collection_unittest.cc

@@ -917,4 +917,34 @@
   EXPECT_FALSE(IsAnimating());
 }
 
+TEST_F(MessagePopupCollectionTest, HighPriorityNotificationShownAgain) {
+  // It only applies to a platform with MessageCenterView i.e. Chrome OS.
+  MessageCenter::Get()->SetHasMessageCenterView(true);
+
+  // Create a notification with system priority.
+  auto notification = CreateNotification("id");
+  notification->SetSystemPriority();
+  MessageCenter::Get()->AddNotification(std::move(notification));
+  AnimateUntilIdle();
+  EXPECT_EQ(1u, GetPopupCounts());
+
+  // The notification with system priority should not be dismissed by
+  // MarkAllPopupsShown.
+  popup_collection()->MarkAllPopupsShown();
+  EXPECT_FALSE(IsAnimating());
+  EXPECT_EQ(1u, GetPopupCounts());
+
+  // The notification should be hidden when MessageCenterView is visible.
+  MessageCenter::Get()->SetVisibility(Visibility::VISIBILITY_MESSAGE_CENTER);
+  EXPECT_TRUE(IsAnimating());
+  AnimateUntilIdle();
+  EXPECT_EQ(0u, GetPopupCounts());
+
+  // The notification should be shown again when MessageCenterView is hidden.
+  MessageCenter::Get()->SetVisibility(Visibility::VISIBILITY_TRANSIENT);
+  EXPECT_TRUE(IsAnimating());
+  AnimateUntilIdle();
+  EXPECT_EQ(1u, GetPopupCounts());
+}
+
 }  // namespace message_center

diff --git a/ui/webui/resources/cr_elements/chromeos/fingerprint/BUILD.gn b/ui/webui/resources/cr_elements/chromeos/fingerprint/BUILD.gn
new file mode 100644
index 0000000..999c12e
--- /dev/null
+++ b/ui/webui/resources/cr_elements/chromeos/fingerprint/BUILD.gn

@@ -0,0 +1,14 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//third_party/closure_compiler/compile_js.gni")
+
+js_type_check("closure_compile") {
+  deps = [
+    ":cr_fingerprint_progress_arc",
+  ]
+}
+
+js_library("cr_fingerprint_progress_arc") {
+}

diff --git a/ui/webui/resources/cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.html b/ui/webui/resources/cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.html
new file mode 100644
index 0000000..34012df
--- /dev/null
+++ b/ui/webui/resources/cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.html

@@ -0,0 +1,73 @@
+<link rel="import" href="chrome://resources/html/polymer.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/iron-iconset-svg/iron-iconset-svg.html">
+
+<iron-iconset-svg name="cr-fingerprint-icon" size="32">
+  <svg>
+    <defs>
+      <g id="enrollment-done" viewBox="0 0 93 104">
+        <path fill="#3E82F1" d="M75.346031,12.4513714 C65.426031,7.33637143 56.8487739,5.16637143 46.5674024,5.16637143 C36.3374024,5.16637143 26.6237739,7.595 17.7896596,12.4513714 C16.5487739,13.1227429 14.9987739,12.6577429 14.276031,11.4177429 C13.6046596,10.1777429 14.0696596,8.57637143 15.3096596,7.905 C24.9196596,2.68637143 35.4596596,0 46.5674024,0 C57.5732882,0 67.1824024,2.42774286 77.7232882,7.85274286 C79.0146596,8.525 79.4796596,10.075 78.8074024,11.315 C78.3424024,12.245 77.4646596,12.7613714 76.5346596,12.7613714 C76.121031,12.7613714 75.7074024,12.6577429 75.346031,12.4513714 Z">
+        </path>
+        <path fill="#32A753" d="M1.10147387,39.4213714 C-0.0871547017,38.595 -0.344897559,36.9927429 0.480588155,35.805 C5.59647387,28.5713714 12.1055882,22.8877429 19.8555882,18.91 C36.0801024,10.54 56.8492167,10.4877429 73.1242167,18.8577429 C80.8742167,22.8363714 87.3851024,28.4677429 92.4992167,35.65 C93.3264739,36.7863714 93.0678453,38.44 91.8801024,39.2663714 C90.6914739,40.0927429 89.0892167,39.835 88.2628453,38.6463714 C83.6128453,32.1363714 77.7228453,27.0213714 70.7478453,23.4563714 C55.9192167,15.8613714 36.9578453,15.8613714 22.1805882,23.5077429 C15.1551024,27.125 9.26421673,32.2913714 4.61421673,38.8013714 C4.20147387,39.525 3.42647387,39.8863714 2.59921673,39.8863714 C2.0828453,39.8863714 1.56647387,39.7313714 1.10147387,39.4213714 Z">
+        </path>
+        <path fill="#F9BB00" d="M33.0827567,101.473097 C28.5877567,96.9780971 26.1600139,94.0844686 22.6977567,87.8330971 C19.1327567,81.4780971 17.2727567,73.7280971 17.2727567,65.4094686 C17.2727567,50.0644686 30.3963853,37.5617257 46.5163853,37.5617257 C62.6354996,37.5617257 75.7600139,50.0644686 75.7600139,65.4094686 C75.7600139,66.8567257 74.6227567,67.9930971 73.1763853,67.9930971 C71.7300139,67.9930971 70.5927567,66.8567257 70.5927567,65.4094686 C70.5927567,52.9067257 59.7941282,42.7280971 46.5163853,42.7280971 C33.2377567,42.7280971 22.4391282,52.9067257 22.4391282,65.4094686 C22.4391282,72.8494686 24.0927567,79.7217257 27.2441282,85.3017257 C30.5513853,91.2430971 32.8241282,93.7744686 36.8027567,97.8044686 C37.7850139,98.8380971 37.7850139,100.439469 36.8027567,101.473097 C36.2350139,101.989469 35.5627567,102.248097 34.8913853,102.248097 C34.2191282,102.248097 33.5477567,101.989469 33.0827567,101.473097 Z">
+        </path>
+        <path fill="#E74133" d="M55.9193939,88.0911057 C48.221651,82.8733629 43.6230224,74.3997343 43.6230224,65.4097343 C43.6230224,63.9633629 44.7593939,62.8261057 46.2057653,62.8261057 C47.6530224,62.8261057 48.7893939,63.9633629 48.7893939,65.4097343 C48.7893939,72.6947343 52.5093939,79.5661057 58.8130224,83.8033629 C62.4807653,86.2833629 66.7693939,87.4711057 71.9357653,87.4711057 C73.1757653,87.4711057 75.2421367,87.3161057 77.3093939,86.9547343 C78.7052796,86.6961057 80.0480224,87.6261057 80.3057653,89.0733629 C80.5643939,90.4683629 79.6343939,91.8111057 78.1880224,92.0697343 C75.2421367,92.6383629 72.6593939,92.6897343 71.9357653,92.6897343 C65.7880224,92.6897343 60.3630224,91.1397343 55.9193939,88.0911057 Z">
+        </path>
+        <path fill="#3E82F1" d="M60.8797482,103.229557 C52.6647482,100.955929 47.2911196,97.9081857 41.6597482,92.3795571 C34.4261196,85.1981857 30.4483767,75.6395571 30.4483767,65.4095571 C30.4483767,57.0395571 37.5783767,50.2195571 46.3611196,50.2195571 C55.1447482,50.2195571 62.2738624,57.0395571 62.2738624,65.4095571 C62.2738624,70.9381857 67.0797482,75.4331857 73.0211196,75.4331857 C78.962491,75.4331857 83.767491,70.9381857 83.767491,65.4095571 C83.767491,45.9309286 66.9761196,30.1218143 46.3097482,30.1218143 C31.6361196,30.1218143 18.2033767,38.2845571 12.157491,50.9431857 C10.142491,55.1281857 9.10974816,60.0359286 9.10974816,65.4095571 C9.10974816,69.4395571 9.47111958,75.7945571 12.5711196,84.0609286 C13.087491,85.4045571 12.4161196,86.9031857 11.0733767,87.3681857 C9.72974816,87.8845571 8.23111958,87.1609286 7.76611958,85.8695571 C5.23474816,79.1018143 3.99474816,72.3845571 3.99474816,65.4095571 C3.99474816,59.2095571 5.18249101,53.5781857 7.50749101,48.6695571 C14.3797482,34.2545571 29.6211196,24.9031857 46.3097482,24.9031857 C69.817491,24.9031857 88.9347482,43.0381857 88.9347482,65.3581857 C88.9347482,73.7281857 81.8047482,80.5481857 73.0211196,80.5481857 C64.237491,80.5481857 57.107491,73.7281857 57.107491,65.3581857 C57.107491,59.8295571 52.3033767,55.3345571 46.3611196,55.3345571 C40.4197482,55.3345571 35.6147482,59.8295571 35.6147482,65.3581857 C35.6147482,74.1931857 39.0238624,82.4595571 45.2761196,88.6595571 C50.1847482,93.5168143 54.8861196,96.2031857 62.1711196,98.2181857 C63.5661196,98.5795571 64.3411196,100.026814 63.9797482,101.369557 C63.7211196,102.558186 62.6361196,103.333186 61.5511196,103.333186 C61.3447482,103.333186 61.0861196,103.280929 60.8797482,103.229557 Z">
+        </path>
+      </g>
+    </defs>
+  </svg>
+</iron-iconset-svg>
+
+<dom-module id="cr-fingerprint-progress-arc">
+  <template>
+    <style>
+      :host {
+        user-select: none;
+      }
+
+      #canvasDiv {
+        height: 240px;
+        width:  460px;
+      }
+
+      /* Put the image in a separate div with 0 height, otherwise the div will
+         take the height of the image, leaving us with a row of whitespace when
+         we position the #image to be inside #arc. */
+      #imageDiv {
+        height: 0;
+      }
+
+      #scanningAnimation {
+        opacity: 0.3;
+        position: relative;
+      }
+
+      #enrollmentDone {
+        position: relative;
+      }
+
+      #checkmarkDiv {
+        height: 0;
+      }
+
+      #checkmarkAnimation {
+        position: relative;
+      }
+    </style>
+
+    <div id="canvasDiv">
+      <canvas id="canvas" height="240" width="460"></canvas>
+    </div>
+    <div id="imageDiv">
+      <img id="scanningAnimation" src="chrome://theme/IDR_LOGIN_FINGERPRINT_ICON_ANIMATION">
+      <iron-icon id="enrollmentDone" icon="cr-fingerprint-icon:enrollment-done" hidden>
+      </iron-icon>
+    </div>
+    <div id="checkmarkDiv" hidden>
+      <img id="checkmarkAnimation" src="chrome://theme/IDR_LOGIN_FINGERPRINT_ENROLLMENT_COMPLETE_ANIMATION">
+    </div>
+  </template>
+  <script src="cr_fingerprint_progress_arc.js"></script>
+</dom-module>

diff --git a/ui/webui/resources/cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.js b/ui/webui/resources/cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.js
new file mode 100644
index 0000000..275d2d3f
--- /dev/null
+++ b/ui/webui/resources/cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.js

@@ -0,0 +1,317 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+
+/**
+ * The time in milliseconds of the animation updates.
+ * @type {number}
+ */
+const ANIMATE_TICKS_MS = 20;
+
+/**
+ * The duration in milliseconds of the animation of the progress circle when the
+ * user is touching the scanner.
+ * @type {number}
+ */
+const ANIMATE_DURATION_MS = 200;
+
+/**
+ * The radius of the add fingerprint progress circle.
+ * @type {number}
+ */
+const DEFAULT_CANVAS_CIRCLE_RADIUS = 114;
+
+/**
+ * The default height of the icon located in the center of fingerprint progress
+ * circle.
+ * @type {number}
+ */
+const ICON_HEIGHT = 118;
+
+/**
+ * The default width of the icon located in the center of fingerprint progress
+ * circle.
+ * @type {number}
+ */
+const ICON_WIDTH = 106;
+
+/**
+ * The default size of the checkmark located in the left bottom corner of
+ * fingerprint progress circle.
+ * @type {number}
+ */
+const CHECK_MARK_SIZE = 53;
+
+/**
+ * The time in milliseconds of the fingerprint scan success timeout.
+ * @type {number}
+ */
+const FINGERPRINT_SCAN_SUCCESS_MS = 500;
+
+/**
+ * The thickness of the add fingerprint progress circle.
+ * @type {number}
+ */
+const CANVAS_CIRCLE_STROKE_WIDTH = 4;
+
+/**
+ * The color of the canvas circle background.
+ * @type {string}
+ */
+const CANVAS_CIRCLE_BACKGROUND_COLOR = 'rgba(218, 220, 224, 1.0)';
+
+/**
+ * The color of the arc/circle which indicates setup progress.
+ * @type {string}
+ */
+const CANVAS_CIRCLE_PROGRESS_COLOR = 'rgba(66, 133, 224, 1.0)';
+
+Polymer({
+  is: 'cr-fingerprint-progress-arc',
+
+  properties: {
+    /**
+     * Radius of the add fingerprint progress circle being displayed.
+     * @type {number}
+     */
+    circleRadius: {
+      type: Number,
+      value: DEFAULT_CANVAS_CIRCLE_RADIUS,
+    },
+
+    /**
+     * Scale factor based the configured radius (circleRadius) vs the default
+     * radius (DEFAULT_CANVAS_CIRCLE_RADIUS).
+     * This will affect the size of icons and checkmark.
+     * @type {number}
+     * @private
+     */
+    scale_: {
+      type: Number,
+      value: 1.0,
+    },
+
+    /**
+     * Whether fingerprint enrollment is complete.
+     * @type {boolean}
+     * @private
+     */
+    isComplete_: Boolean,
+  },
+
+  // Also put these values as member values so they can be overridden by tests
+  // and the tests do not need to be changed every time the UI is.
+  /** @private {number} */
+  canvasCircleStrokeWidth_: CANVAS_CIRCLE_STROKE_WIDTH,
+  /** @private {string} */
+  canvasCircleBackgroundColor_: CANVAS_CIRCLE_BACKGROUND_COLOR,
+  /** @private {string} */
+  canvasCircleProgressColor_: CANVAS_CIRCLE_PROGRESS_COLOR,
+
+  /**
+   * Timer ID for fingerprint scan success update.
+   * @type {number|undefined}
+   * @private
+   */
+  updateTimerId_: undefined,
+
+  /** @override */
+  attached: function() {
+    this.scale_ = this.circleRadius / DEFAULT_CANVAS_CIRCLE_RADIUS;
+    this.updateImages_();
+  },
+
+  /**
+   * Draws an arc on the canvas element around the center with radius
+   * |circleRadius|.
+   * @param {number} startAngle The start angle of the arc we want to draw.
+   * @param {number} endAngle The end angle of the arc we want to draw.
+   * @param {string} color The color of the arc we want to draw. The string is
+   *     in the format rgba(r',g',b',a'). r', g', b' are values from [0-255]
+   *     and a' is a value from [0-1].
+   */
+  drawArc: function(startAngle, endAngle, color) {
+    const c = this.$.canvas;
+    const ctx = c.getContext('2d');
+
+    ctx.beginPath();
+    ctx.arc(c.width / 2, c.height / 2, this.circleRadius, startAngle, endAngle);
+    ctx.lineWidth = this.canvasCircleStrokeWidth_;
+    ctx.strokeStyle = color;
+    ctx.stroke();
+  },
+
+  /**
+   * Draws a circle on the canvas element around the center with radius
+   * |circleRadius| and color |CANVAS_CIRCLE_BACKGROUND_COLOR|.
+   */
+  drawBackgroundCircle: function() {
+    this.drawArc(0, 2 * Math.PI, this.canvasCircleBackgroundColor_);
+  },
+
+  /**
+   * Animates the progress circle. Animates an arc that starts at the top of
+   * the circle to prevPercentComplete, to an arc that starts at the top of the
+   * circle to currPercentComplete.
+   * @param {number} prevPercentComplete The previous progress indicates the
+   *                 start angle of the arc we want to draw.
+   * @param {number} currPercentComplete The current progress indicates the end
+   *                 angle of the arc we want to draw.
+   * @param {boolean} isComplete Indicate whether enrollment is complete.
+   */
+  setProgress: function(prevPercentComplete, currPercentComplete, isComplete) {
+    if (this.isComplete_)
+      return;
+    this.isComplete_ = isComplete;
+
+    const slice = 2 * Math.PI / 100;
+    const startAngle = prevPercentComplete * slice;
+    const endAngle = isComplete ?
+        2 * Math.PI :
+        Math.min(2 * Math.PI, currPercentComplete * slice);
+    let currentAngle = startAngle;
+    // The value to update the angle by each tick.
+    const step =
+        (endAngle - startAngle) / (ANIMATE_DURATION_MS / ANIMATE_TICKS_MS);
+    const id = setInterval(doAnimate.bind(this), ANIMATE_TICKS_MS);
+    // Circles on html canvas have 0 radians on the positive x-axis and go in
+    // clockwise direction. We want to start at the top of the circle which is
+    // 3pi/2.
+    const start = 3 * Math.PI / 2;
+
+    // Function that is called every tick of the interval, draws the arc a bit
+    // closer to the final destination each tick, until it reaches the final
+    // destination.
+    function doAnimate() {
+      if (currentAngle >= endAngle) {
+        clearInterval(id);
+        currentAngle = endAngle;
+      }
+
+      // Clears the canvas and draws the new progress circle.
+      this.clearCanvas_();
+      // Drawing two arcs to form a circle gives a nicer look than drawing an
+      // arc on top of a circle. If |currentAngle| is 0, draw from |start| +
+      // |currentAngle| to 7 * Math.PI / 2 (start is 3 * Math.PI / 2) otherwise
+      // the regular draw from |start| to |currentAngle| will draw nothing which
+      // will cause a flicker for one frame.
+      this.drawArc(
+          start, start + currentAngle, this.canvasCircleProgressColor_);
+      this.drawArc(
+          start + currentAngle, currentAngle <= 0 ? 7 * Math.PI / 2 : start,
+          this.canvasCircleBackgroundColor_);
+      currentAngle += step;
+    }
+
+    // Clean up any pending animation update.
+    if (this.updateTimerId_ !== undefined) {
+      window.clearTimeout(this.updateTimerId_);
+      this.updateTimerId_ = undefined;
+    }
+
+    if (isComplete)
+      this.animateScanComplete_();
+    else
+      this.animateScanProgress_();
+  },
+
+  /**
+   * Show animation for enrollment completion.
+   * @private
+   */
+  animateScanComplete_: function() {
+    this.$.checkmarkDiv.hidden = false;
+    this.$.enrollmentDone.hidden = false;
+    this.$.scanningAnimation.hidden = true;
+    this.$.enrollmentDone.style.opacity = 1;
+  },
+
+  /**
+   * Show animation for enrollment in progress.
+   * @private
+   */
+  animateScanProgress_: function() {
+    this.$.enrollmentDone.hidden = false;
+    this.$.enrollmentDone.style.opacity = 0.3;
+    this.$.scanningAnimation.hidden = true;
+    this.updateTimerId_ = window.setTimeout(() => {
+      this.$.enrollmentDone.hidden = true;
+      this.$.enrollmentDone.style.opacity = 1;
+      this.$.scanningAnimation.hidden = false;
+    }, FINGERPRINT_SCAN_SUCCESS_MS);
+  },
+
+  /**
+   * Clear the canvas of any renderings.
+   * @private
+   */
+  clearCanvas_: function() {
+    const c = this.$.canvas;
+    const ctx = c.getContext('2d');
+    ctx.clearRect(0, 0, c.width, c.height);
+  },
+
+  /**
+   * Reset the element to initial state, when the enrollment just starts.
+   */
+  reset: function() {
+    this.clearCanvas_();
+    this.isComplete_ = false;
+    this.drawBackgroundCircle();
+    this.$.enrollmentDone.hidden = true;
+    this.$.scanningAnimation.hidden = false;
+    this.$.checkmarkDiv.hidden = true;
+  },
+
+  /**
+   * Update the size and position of the animation images.
+   * @private
+   */
+  updateImages_: function() {
+    this.resizeAndCenterIcon_(this.$.scanningAnimation);
+    this.resizeAndCenterIcon_(this.$.enrollmentDone);
+    this.resizeCheckMark_(this.$.checkmarkAnimation);
+  },
+
+  /**
+   * Resize the icon based on the scale and place it in the center of the
+   * fingerprint progress circle.
+   * @param {!HTMLElement} target
+   * @private
+   */
+  resizeAndCenterIcon_: function(target) {
+    // Resize icon based on the default width/height and scale.
+    target.style.width = ICON_WIDTH * this.scale_ + 'px';
+    target.style.height = ICON_HEIGHT * this.scale_ + 'px';
+
+    // Place in the center of the canvas.
+    const left = this.$.canvas.width / 2 - ICON_WIDTH * this.scale_ / 2;
+    const top = 0 - ICON_HEIGHT * this.scale_ / 2 - this.$.canvas.height / 2;
+    target.style.left = left + 'px';
+    target.style.top = top + 'px';
+  },
+
+  /**
+   * Resize the checkmark based on the scale and place it in the left bottom
+   * corner of fingerprint progress circle.
+   * @param {!HTMLElement} target
+   * @private
+   */
+  resizeCheckMark_: function(target) {
+    // Resize checkmark based on the default size and scale.
+    target.style.width = CHECK_MARK_SIZE * this.scale_ + 'px';
+    target.style.height = CHECK_MARK_SIZE * this.scale_ + 'px';
+
+    // Place it in the left bottom corner of fingerprint progress circle.
+    const top = 0 -
+        (CHECK_MARK_SIZE * this.scale_ + this.$.canvas.height / 2 -
+         this.circleRadius);
+    const left = this.$.canvas.width / 2 + this.circleRadius -
+        CHECK_MARK_SIZE * this.scale_;
+    target.style.left = left + 'px';
+    target.style.top = top + 'px';
+  },
+});
+})();

diff --git a/ui/webui/resources/cr_elements_resources.grdp b/ui/webui/resources/cr_elements_resources.grdp
index b4aea93..26c46731 100644
--- a/ui/webui/resources/cr_elements_resources.grdp
+++ b/ui/webui/resources/cr_elements_resources.grdp

@@ -228,6 +228,14 @@
                type="chrome_html"
                preprocess="true"
                compress="gzip" />
+     <structure name="IDR_CR_ELEMENTS_CHROMEOS_CR_FINGERPRINT_PROGRESS_ARC_HTML"
+               file="cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.html"
+               type="chrome_html"
+               compress="gzip" />
+    <structure name="IDR_CR_ELEMENTS_CHROMEOS_CR_FINGERPRINT_PROGRESS_ARC_JS"
+               file="cr_elements/chromeos/fingerprint/cr_fingerprint_progress_arc.js"
+               type="chrome_html"
+               compress="gzip" />
   </if>
   <structure name="IDR_CR_ELEMENTS_CR_POLICY_INDICATOR_HTML"
              file="cr_elements/policy/cr_policy_indicator.html"