diff --git a/DEPS b/DEPS
index 293977e..5fc8efb 100644
--- a/DEPS
+++ b/DEPS
@@ -39,11 +39,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '6df232d251cefe8f3498a1ae4dad449bafa9ebb3',
+  'skia_revision': '40732b34a1bf94eb44ee4b2327eece8d97735f11',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '3e0e1f19d153dd0408e50d7ad9ce44fd43d3f812',
+  'v8_revision': 'c55f728ca7fa1b668e6f5e37d97bab6caef57b45',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -193,7 +193,7 @@
    Var('chromium_git') + '/chromium/third_party/ffmpeg.git' + '@' + 'd2733b2c43f65f0e779d5d014777fb8ea1e89873',
 
   'src/third_party/libjingle/source/talk':
-    Var('chromium_git') + '/external/webrtc/trunk/talk.git' + '@' + '2e1af43faf9276fe59c3f56bc8ee2cac7abdbd4c', # commit position 10372
+    Var('chromium_git') + '/external/webrtc/trunk/talk.git' + '@' + 'bd0ab966d73f41dcf0a5321762e8346df7ff05c3', # commit position 10394
 
   'src/third_party/usrsctp/usrsctplib':
     Var('chromium_git') + '/external/usrsctplib.git' + '@' + '36444a999739e9e408f8f587cb4c3ffeef2e50ac', # from svn revision 9215
@@ -217,7 +217,7 @@
    Var('chromium_git') + '/native_client/src/third_party/scons-2.0.1.git' + '@' + '1c1550e17fc26355d08627fbdec13d8291227067',
 
   'src/third_party/webrtc':
-    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + '4418cf5bb0a42f7bd314742cabd752ce44ee165d', # commit position 10371
+    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + 'bbfbf12a6e0515c893e5497d05b53eec64a0949a', # commit position 10391
 
   'src/third_party/openmax_dl':
     Var('chromium_git') + '/external/webrtc/deps/third_party/openmax.git' + '@' +  Var('openmax_dl_revision'),
diff --git a/chrome/browser/search/suggestions/image_fetcher_impl_browsertest.cc b/chrome/browser/search/suggestions/image_fetcher_impl_browsertest.cc
index 904a637d..8e79336c 100644
--- a/chrome/browser/search/suggestions/image_fetcher_impl_browsertest.cc
+++ b/chrome/browser/search/suggestions/image_fetcher_impl_browsertest.cc
@@ -120,7 +120,13 @@
   EXPECT_EQ(0, delegate_.num_delegate_null_called());
 }
 
-IN_PROC_BROWSER_TEST_F(ImageFetcherImplBrowserTest, MultipleFetch) {
+#if defined(OS_MACOSX)
+// TODO(thakis): Investigate and turn this back on, http://crbug.com/547387
+#define MAYBE_MultipleFetch DISABLED_MultipleFetch
+#else
+#define MAYBE_MultipleFetch MultipleFetch
+#endif
+IN_PROC_BROWSER_TEST_F(ImageFetcherImplBrowserTest, MAYBE_MultipleFetch) {
   GURL image_url(test_server_.GetURL(kTestImagePath).spec());
 
   for (int i = 0; i < 5; i++) {
diff --git a/content/renderer/pepper/video_encoder_shim.cc b/content/renderer/pepper/video_encoder_shim.cc
index 8db98d8..0789ee3 100644
--- a/content/renderer/pepper/video_encoder_shim.cc
+++ b/content/renderer/pepper/video_encoder_shim.cc
@@ -12,6 +12,7 @@
 #include "base/bind_helpers.h"
 #include "base/location.h"
 #include "base/single_thread_task_runner.h"
+#include "base/sys_info.h"
 #include "base/thread_task_runner_handle.h"
 #include "content/renderer/pepper/pepper_video_encoder_host.h"
 #include "content/renderer/render_thread_impl.h"
@@ -36,6 +37,9 @@
 // Number of frames needs at any given time.
 const uint32_t kInputFrameCount = 1;
 
+// Maximal number or threads used for encoding.
+const int32_t kMaxNumThreads = 8;
+
 // Default speed for the encoder. Increases the CPU usage as the value
 // is more negative (VP8 valid range: -16..16, VP9 valid range:
 // -8..8), using the same value as WebRTC.
@@ -45,6 +49,9 @@
 const int32_t kVp8DefaultMinQuantizer = 2;
 const int32_t kVp8DefaultMaxQuantizer = 52;
 
+// Maximum bitrate in CQ mode (same value as ffmpeg).
+const int32_t kVp8MaxCQBitrate = 1000000;
+
 // For VP9, the following 3 values are the same values as remoting.
 const int32_t kVp9DefaultCpuUsed = 6;
 
@@ -180,6 +187,22 @@
   config_.rc_target_bitrate = initial_bitrate / 1000;
   config_.rc_min_quantizer = min_quantizer;
   config_.rc_max_quantizer = max_quantizer;
+  // Do not saturate CPU utilization just for encoding. On a lower-end system
+  // with only 1 or 2 cores, use only one thread for encoding. On systems with
+  // more cores, allow half of the cores to be used for encoding.
+  config_.g_threads =
+      std::min(kMaxNumThreads, (base::SysInfo::NumberOfProcessors() + 1) / 2);
+
+  // Use Q/CQ mode if no target bitrate is given. Note that in the VP8/CQ case
+  // the meaning of rc_target_bitrate changes to target maximum rate.
+  if (initial_bitrate == 0) {
+    if (output_profile == media::VP9PROFILE_ANY) {
+      config_.rc_end_usage = VPX_Q;
+    } else if (output_profile == media::VP8PROFILE_ANY) {
+      config_.rc_end_usage = VPX_CQ;
+      config_.rc_target_bitrate = kVp8MaxCQBitrate;
+    }
+  }
 
   vpx_codec_flags_t flags = 0;
   if (vpx_codec_enc_init(&encoder_, vpx_codec, &config_, flags) !=
diff --git a/third_party/WebKit/LayoutTests/LeakExpectations b/third_party/WebKit/LayoutTests/LeakExpectations
index 22bda09..7fb78fe 100644
--- a/third_party/WebKit/LayoutTests/LeakExpectations
+++ b/third_party/WebKit/LayoutTests/LeakExpectations
@@ -57,6 +57,7 @@
 crbug.com/364417 fast/events/touch/gesture/context-menu-on-long-tap.html [ Leak ]
 crbug.com/364417 fast/repaint/japanese-rl-selection-clear.html [ Leak ]
 crbug.com/364417 virtual/spv2/fast/repaint/japanese-rl-selection-clear.html [ Leak ]
+crbug.com/364417 virtual/syncpaint/fast/repaint/japanese-rl-selection-clear.html [ Leak ]
 crbug.com/364417 fast/text/international/hebrew-selection.html [ Leak ]
 
 crbug.com/455369 fast/html/marquee-destroyed-without-removed-from-crash.html [ Leak Pass ]
@@ -84,6 +85,8 @@
 
 crbug.com/482050 fast/repaint/fixed-move-after-keyboard-scroll.html [ Leak ]
 crbug.com/482050 fast/repaint/repaint-tile-clipped.html [ Leak ]
+crbug.com/482050 virtual/syncpaint/fast/repaint/fixed-move-after-keyboard-scroll.html [ Leak ]
+crbug.com/482050 virtual/syncpaint/fast/repaint/repaint-tile-clipped.html [ Leak ]
 crbug.com/482050 svg/as-object/nested-embedded-svg-size-changes.html [ Leak ]
 crbug.com/482050 svg/custom/hit-test-unclosed-subpaths.svg [ Leak ]
 crbug.com/482050 svg/custom/hit-test-with-br.xhtml [ Leak ]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 899ce0b6..924232e 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -1,5 +1,6 @@
 # Run these tests with under virtual/spv2 only.
 crbug.com/524134 paint/invalidation/spv2 [ Skip ]
+crbug.com/524134 virtual/syncpaint/paint/invalidation/spv2 [ Skip ]
 
 # TODO(wangxianzhu): Triage the failures
 crbug.com/524134 virtual/spv2/paint/invalidation/invalidate-after-composited-scroll.html [ Failure ]
@@ -33,12 +34,15 @@
 crbug.com/527242 virtual/spv2/paint/invalidation/spv2/cached-change-table-border-width.html [ Failure ]
 crbug.com/527242 virtual/spv2/paint/invalidation/spv2/cached-change-tbody-border-width.html [ Failure ]
 
+crbug.com/546730 virtual/syncpaint/paint/invalidation/composited-table-cell-container-background.html [ Failure ]
+
 crbug.com/536138 virtual/spv2/paint/invalidation/repaint-subsequence-on-ancestor-clip-change.html [ Failure ]
 
 crbug.com/537172 [ SnowLeopard XP Win10 ] virtual/spv2/paint/invalidation/spv2/background-image-paint-invalidation.html [ Failure ]
 
 crbug.com/504613 crbug.com/524248 paint/images/image-backgrounds-not-antialiased.html [ Skip ]
 crbug.com/504613 crbug.com/524248 virtual/spv2/paint/images/image-backgrounds-not-antialiased.html [ Skip ]
+crbug.com/504613 crbug.com/524248 virtual/syncpaint/paint/images/image-backgrounds-not-antialiased.html [ Skip ]
 crbug.com/502531 fast/borders/border-antialiasing.html [ Failure ]
 
 crbug.com/538697 [ Win7 Debug ] virtual/threaded/printing/webgl-oversized-printing.html [ Crash ]
@@ -136,6 +140,10 @@
 crbug.com/448461 http/tests/loading/simple-subframe.html [ Failure Pass Timeout ]
 crbug.com/339597 http/tests/navigation/back-to-redirect-with-frame.php [ Pass Timeout ]
 crbug.com/473718 http/tests/navigation/beacon-cross-origin-redirect.html [ Failure Pass ]
+crbug.com/432795 fast/forms/color/input-appearance-color.html [ NeedsRebaseline ]
+crbug.com/432795 fast/forms/select/menulist-appearance-basic.html [ NeedsRebaseline ]
+crbug.com/432795 fast/forms/select/popup-menu-appearance-zoom.html [ NeedsRebaseline ]
+crbug.com/432795 transforms/2d/zoom-menulist.html [ NeedsRebaseline ]
 
 crbug.com/410974 fast/scroll-behavior/scroll-customization/scrollstate-basic.html [ Pass Failure ]
 crbug.com/410974 fast/scroll-behavior/scroll-customization/scrollstate-consume-deltas.html [ Pass Failure ]
@@ -185,6 +193,7 @@
 crbug.com/469657 virtual/pointerevent/fast/events/mouse-event-buttons-attribute.html [ Failure Pass ]
 crbug.com/432129 fast/html/marquee-scroll.html [ Failure Pass ]
 crbug.com/320139 fast/repaint/block-layout-inline-children-replaced.html [ Failure Pass ]
+crbug.com/320139 virtual/syncpaint/fast/repaint/block-layout-inline-children-replaced.html [ Skip ]
 crbug.com/518929 [ Precise Debug ] http/tests/appcache/obsolete-error-events.html [ Failure Pass Timeout ]
 crbug.com/518929 [ Precise Debug ] http/tests/appcache/remove-cache.html [ Failure Pass ]
 crbug.com/518929 [ Win10 ] http/tests/appcache/remove-cache.html [ Failure Pass ]
@@ -455,6 +464,7 @@
 crbug.com/505364 crbug.com/520616 imported/web-platform-tests/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-009.html [ Failure ]
 
 crbug.com/539623 [ SnowLeopard ] fast/repaint/selection-change-in-iframe-with-relative-parent.html [ Pass Failure ]
+crbug.com/539623 [ SnowLeopard ] virtual/syncpaint/fast/repaint/selection-change-in-iframe-with-relative-parent.html [ Skip ]
 
 crbug.com/387740 imported/web-platform-tests/mediacapture-streams/stream-api/introduction/disabled-audio-silence.html [ Skip ]
 crbug.com/387740 imported/web-platform-tests/mediacapture-streams/stream-api/introduction/disabled-video-black.html [ Skip ]
@@ -820,6 +830,7 @@
 crbug.com/467477 fast/multicol/vertical-rl/nested-columns.html [ Failure ]
 
 crbug.com/506525 [ XP ] paint/masks/fieldset-mask.html [ Failure ]
+crbug.com/506525 [ XP ] virtual/syncpaint/paint/masks/fieldset-mask.html [ Skip ]
 
 crbug.com/400841 media/video-canvas-draw.html [ Failure ]
 crbug.com/400829 media/video-object-fit.html [ Failure ]
@@ -913,6 +924,9 @@
 crbug.com/524596 paint/invalidation/fixed-position-descendant-paint-offset-indirect.html [ Failure ]
 crbug.com/524596 virtual/spv2/paint/invalidation/composited-non-stacking-context-descendant-move.html [ Skip ]
 crbug.com/524596 virtual/spv2/paint/invalidation/fixed-position-descendant-paint-offset-indirect.html [ Skip ]
+crbug.com/524596 virtual/syncpaint/paint/invalidation/composited-non-stacking-context-descendant-change-color.html [ Skip ]
+crbug.com/524596 virtual/syncpaint/paint/invalidation/composited-non-stacking-context-descendant-move.html [ Skip ]
+crbug.com/524596 virtual/syncpaint/paint/invalidation/fixed-position-descendant-paint-offset-indirect.html [ Skip ]
 
 crbug.com/546538 svg/clip-path/clip-path-child-clipped.svg [ NeedsManualRebaseline ]
 crbug.com/546538 svg/clip-path/clip-path-nonzero.svg [ NeedsManualRebaseline ]
@@ -1003,8 +1017,10 @@
 crbug.com/491764 http/tests/inspector/service-workers/user-agent-override.html [ Timeout ]
 crbug.com/474798 fast/repaint/align-self-change-keeping-geometry-grid.html [ Failure ]
 crbug.com/474798 fast/repaint/justify-self-change-keeping-geometry.html [ Failure ]
-crbug.com/474798 virtual/spv2/paint/invalidation/spv2/align-self-change-keeping-geometry-grid-as-text.html [ Failure ]
-crbug.com/474798 virtual/spv2/paint/invalidation/spv2/justify-self-change-keeping-geometry-as-text.html [ Failure ]
+crbug.com/474798 virtual/spv2/paint/invalidation/spv2/align-self-change-keeping-geometry-grid-as-text.html [ Skip ]
+crbug.com/474798 virtual/spv2/paint/invalidation/spv2/justify-self-change-keeping-geometry-as-text.html [ Skip ]
+crbug.com/474798 virtual/syncpaint/fast/repaint/align-self-change-keeping-geometry-grid.html [ Skip ]
+crbug.com/474798 virtual/syncpaint/fast/repaint/justify-self-change-keeping-geometry.html [ Skip ]
 
 
 # Temporarily disabled after chromium change
@@ -1112,6 +1128,9 @@
 
 crbug.com/443596 media/sources-fallback-codecs.html [ Pass Failure ]
 
+crbug.com/536999 fast/repaint/line-flow-with-floats-7.html [ NeedsRebaseline ]
+crbug.com/536999 virtual/syncpaint/fast/repaint/line-flow-with-floats-7.html [ NeedsRebaseline ]
+
 crbug.com/464736 http/tests/xmlhttprequest/ontimeout-event-override-after-failure.html [ Pass Failure ]
 
 # Unclear semantics of ToString (actually ToPrimitive) across iframes.
@@ -1277,6 +1296,7 @@
 crbug.com/521730 [ Win10 ] fast/preloader/noscript.html [ Failure Pass ]
 crbug.com/521730 [ Win10 ] fast/preloader/script.html [ Failure Pass ]
 crbug.com/521730 [ Win10 ] fast/repaint/stacking-context-lost.html [ Pass Timeout ]
+crbug.com/521730 [ Win10 ] virtual/syncpaint/fast/repaint/stacking-context-lost.html [ Skip ]
 crbug.com/521730 [ Win10 ] fast/scroll-behavior/overflow-scroll-animates.html [ Failure Pass ]
 crbug.com/521730 [ Win10 ] fast/table/cell-change-baseline-then-border.html [ Pass Timeout ]
 crbug.com/521730 [ Win10 ] http/tests/history/back-to-post.html [ Failure Pass Timeout ]
@@ -1294,6 +1314,7 @@
 crbug.com/521730 [ Win10 ] inspector/sources/debugger-step/debugger-step-out-document-write.html [ Pass Timeout ]
 crbug.com/521730 [ Win10 ] media/W3C/audio/error/error_onerror_called_on_bogus_source.html [ Pass Timeout ]
 crbug.com/521730 [ Win10 ] paint/inline/outline-offset.html [ Failure Timeout ]
+crbug.com/521730 [ Win10 ] virtual/syncpaint/paint/inline/outline-offset.html [ Skip ]
 crbug.com/521730 [ Win10 ] svg/as-image/svg-object-intrinsic-size.html [ Missing Timeout ]
 #crbug.com/521730 [ Win10 ] svg/as-object/nested-embedded-svg-size-changes.html [ Pass Timeout ]
 crbug.com/521730 [ Win10 ] svg/custom/rounded-rect-update-to-empty.html [ Pass Timeout ]
@@ -1333,6 +1354,7 @@
 crbug.com/521764 [ Win10 ] fast/preloader/scan-body-from-head-script.html [ Failure Pass ]
 crbug.com/521764 [ Win10 ] fast/preloader/understands-base-tag.html [ Failure Pass ]
 crbug.com/521764 [ Win10 ] fast/repaint/fixed-element-repaint-after-compositing-update.html [ Pass Timeout ]
+crbug.com/521764 [ Win10 ] virtual/syncpaint/fast/repaint/fixed-element-repaint-after-compositing-update.html [ Skip ]
 crbug.com/521764 [ Win10 ] fast/ruby/nested-ruby.html [ Failure Timeout ]
 crbug.com/521764 [ Win10 ] fast/text-autosizing/cluster-inline-block-or-table.html [ Pass Timeout ]
 crbug.com/521764 [ Win10 ] fast/text-autosizing/cluster-inline-grid-flex-box.html [ Pass Timeout ]
@@ -1493,6 +1515,8 @@
 crbug.com/474759 fast/block/line-layout/selection-highlight-overlap.html [ Failure ]
 crbug.com/502927 [ XP ] paint/frames/frameset-with-stacking-context-and-not-stacking-context-children.html [ Failure ]
 crbug.com/502927 [ XP ] paint/frames/frameset-with-stacking-contexts.html [ Failure ]
+crbug.com/502927 [ XP ] virtual/syncpaint/paint/frames/frameset-with-stacking-context-and-not-stacking-context-children.html [ Skip ]
+crbug.com/502927 [ XP ] virtual/syncpaint/paint/frames/frameset-with-stacking-contexts.html [ Skip ]
 
 crbug.com/353746 virtual/android/fullscreen/video-specified-size.html [ Failure Pass ]
 
@@ -1579,6 +1603,7 @@
 crbug.com/538526 [ Win7 Win10 ] virtual/spv2/paint/invalidation/spv2/fixed-img-src-change-after-scroll.html [ Failure ]
 
 crbug.com/527743 [ Win10 ] paint/masks/table-cell-masks.html [ Pass Timeout ]
+crbug.com/527743 [ Win10 ] virtual/syncpaint/paint/masks/table-cell-masks.html [ Skip ]
 
 crbug.com/531286 virtual/gpu/fast/canvas/yuv-video-on-accelerated-canvas.html [ Failure ]
 
diff --git a/third_party/WebKit/LayoutTests/VirtualTestSuites b/third_party/WebKit/LayoutTests/VirtualTestSuites
index 94c314dd..3849d90 100644
--- a/third_party/WebKit/LayoutTests/VirtualTestSuites
+++ b/third_party/WebKit/LayoutTests/VirtualTestSuites
@@ -189,5 +189,23 @@
     "prefix": "spv2",
     "base": "paint",
     "args": ["--enable-slimming-paint-v2"]
+  },
+  {
+    "prefix": "syncpaint",
+    "base": "compositing/repaint",
+    "args": ["--enable-blink-features=SlimmingPaintSynchronizedPainting"],
+    "references_use_default_args": true
+  },
+  {
+    "prefix": "syncpaint",
+    "base": "fast/repaint",
+    "args": ["--enable-blink-features=SlimmingPaintSynchronizedPainting"],
+    "references_use_default_args": true
+  },
+  {
+    "prefix": "syncpaint",
+    "base": "paint",
+    "args": ["--enable-blink-features=SlimmingPaintSynchronizedPainting"],
+    "references_use_default_args": true
   }
 ]
diff --git a/third_party/WebKit/LayoutTests/fast/forms/select/menulist-appearance-basic.html b/third_party/WebKit/LayoutTests/fast/forms/select/menulist-appearance-basic.html
index cc66d17c..1ab46af 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/select/menulist-appearance-basic.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/select/menulist-appearance-basic.html
@@ -35,7 +35,7 @@
 <select style="border-radius: 6px;"><option>foo</option></select> <br>
 
 <!-- background -->
-<select style="background: linear-gradient(to bottom, #dea 0%,#9c7 44%,#494 100%);"><option>foo</option></select>
+<select style="background: linear-gradient(to bottom, #bc7 0%,#7a5 44%,#242 100%); color:white"><option>foo</option></select>
 <div class="wrapper"><select><option>bar</option></select></div>
 <br>
 
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt
index 9ae8990..b5815912 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt
@@ -9,8 +9,8 @@
         [185, 100, 15, 200]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "LayoutBlockFlow (positioned) DIV"
+        "LayoutBlockFlow (positioned) DIV",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt
index 0b4aaa4..0fb1fe7c 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt
@@ -12,8 +12,6 @@
       "paintInvalidationClients": [
         "LayoutBlockFlow (positioned) DIV",
         "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
         "LayoutBlockFlow (positioned) DIV id='q'"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt
index a2fa11a..9b67d0c8 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt
@@ -10,13 +10,9 @@
         [8, 108, 100, 100]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
+        "LayoutBlockFlow DIV id='div'",
         "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutBlockFlow DIV id='div'"
+        "HorizontalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt
index eecea68..4e83dc5a 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt
@@ -8,6 +8,10 @@
       "repaintRects": [
         [101, 51, 101, 201],
         [1, 236, 185, 15]
+      ],
+      "paintInvalidationClients": [
+        "HorizontalScrollbar",
+        "LayoutBlockFlow DIV id='child'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt
index a2d79b93..6c9a2ed 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt
@@ -10,12 +10,9 @@
         [8, 50, 100, 100]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
+        "LayoutBlockFlow (positioned) DIV id='scrollable'",
         "VerticalScrollbar",
-        "VerticalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutBlockFlow (positioned) DIV id='scrollable'"
+        "HorizontalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt
index 9464c24..05ee1f8 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt
@@ -10,12 +10,9 @@
         [8, 50, 120, 120]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
+        "LayoutBlockFlow (positioned) DIV id='scrollable'",
         "VerticalScrollbar",
-        "VerticalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutBlockFlow (positioned) DIV id='scrollable'"
+        "HorizontalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt
index ec3dad8..5e1c8db 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt
@@ -8,6 +8,10 @@
       "repaintRects": [
         [93, 8, 15, 85],
         [8, 93, 85, 15]
+      ],
+      "paintInvalidationClients": [
+        "VerticalScrollbar",
+        "HorizontalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scrollbar-parts-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scrollbar-parts-expected.txt
index d05e80c..2a23159e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scrollbar-parts-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scrollbar-parts-expected.txt
@@ -10,12 +10,8 @@
         [8, 93, 55, 15]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
         "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar"
+        "HorizontalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt
deleted file mode 100644
index bfe9ad9..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "bounds": [1000, 600],
-  "children": [
-    {
-      "bounds": [1000, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [101, 51, 101, 201],
-        [1, 236, 185, 15]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutBlockFlow DIV id='child'"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scrollbar-parts-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scrollbar-parts-expected.txt
deleted file mode 100644
index 19d80dd..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scrollbar-parts-expected.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [93, 8, 15, 85],
-        [8, 93, 85, 15]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt
deleted file mode 100644
index 9e83eb4..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scrollbar-damage-and-full-viewport-repaint-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "bounds": [1000, 600],
-  "children": [
-    {
-      "bounds": [1000, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [101, 51, 101, 201],
-        [1, 236, 185, 15]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutBlockFlow DIV id='child'"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scrollbar-parts-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scrollbar-parts-expected.txt
deleted file mode 100644
index d0fb028..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scrollbar-parts-expected.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [93, 8, 15, 85],
-        [8, 93, 85, 15]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "VerticalScrollbar"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/virtual/spv2/paint/invalidation/invalidate-descendants-when-receiving-paint-layer-expected.txt b/third_party/WebKit/LayoutTests/virtual/spv2/paint/invalidation/invalidate-descendants-when-receiving-paint-layer-expected.txt
index 1b0274b..886f9f6 100644
--- a/third_party/WebKit/LayoutTests/virtual/spv2/paint/invalidation/invalidate-descendants-when-receiving-paint-layer-expected.txt
+++ b/third_party/WebKit/LayoutTests/virtual/spv2/paint/invalidation/invalidate-descendants-when-receiving-paint-layer-expected.txt
@@ -8,8 +8,7 @@
       "repaintRects": [
         [9, 9, 100, 100],
         [9, 9, 100, 100],
-        [8, 8, 784, 101],
-        [8, 8, 784, 52]
+        [8, 60, 784, 49]
       ],
       "paintInvalidationClients": [
         "LayoutBlockFlow (relative positioned) DIV",
diff --git a/third_party/WebKit/LayoutTests/virtual/syncpaint/compositing/repaint/README.txt b/third_party/WebKit/LayoutTests/virtual/syncpaint/compositing/repaint/README.txt
new file mode 100644
index 0000000..11388682
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/virtual/syncpaint/compositing/repaint/README.txt
@@ -0,0 +1 @@
+# This suite runs tests with SlimmingPaintSynchronizedPainting enabled.
diff --git a/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/README.txt b/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/README.txt
new file mode 100644
index 0000000..11388682
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/README.txt
@@ -0,0 +1 @@
+# This suite runs tests with SlimmingPaintSynchronizedPainting enabled.
diff --git a/third_party/WebKit/LayoutTests/virtual/syncpaint/paint/README.txt b/third_party/WebKit/LayoutTests/virtual/syncpaint/paint/README.txt
new file mode 100644
index 0000000..11388682
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/virtual/syncpaint/paint/README.txt
@@ -0,0 +1 @@
+# This suite runs tests with SlimmingPaintSynchronizedPainting enabled.
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 3ccd0fb..8b43865 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -2518,7 +2518,7 @@
         graphicsLayer->paintIfNeeded(context);
 
     if (!RuntimeEnabledFeatures::slimmingPaintV2Enabled())
-        graphicsLayer->paintController()->commitNewDisplayItems(graphicsLayer);
+        graphicsLayer->paintController()->commitNewDisplayItems();
 
     for (auto& child : graphicsLayer->children())
         synchronizedPaintRecursively(child, interestRect);
@@ -2533,7 +2533,7 @@
 
     // Detached frames can have no root graphics layer.
     if (GraphicsLayer* rootGraphicsLayer = layoutView()->layer()->graphicsLayerBacking())
-        rootGraphicsLayer->paintController()->commitNewDisplayItems(rootGraphicsLayer);
+        rootGraphicsLayer->paintController()->commitNewDisplayItems();
 
     forAllFrameViews([](FrameView& frameView) { frameView.lifecycle().advanceTo(DocumentLifecycle::CompositingForSlimmingPaintV2Clean); });
 }
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
index 75fabad..b45dcda 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
@@ -363,9 +363,9 @@
         startOfContinuations->invalidateDisplayItemClient(*startOfContinuations);
 }
 
-void LayoutBlock::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const
+void LayoutBlock::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect* paintInvalidationRect) const
 {
-    LayoutBox::invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+    LayoutBox::invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, paintInvalidationRect);
     invalidateDisplayItemClientForStartOfContinuationsIfNeeded(*this);
 }
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.h b/third_party/WebKit/Source/core/layout/LayoutBlock.h
index aee3feab..eb344ca 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.h
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.h
@@ -355,7 +355,7 @@
     bool isInlineBlockOrInlineTable() const final { return isInline() && isReplaced(); }
 
     void invalidatePaintOfSubtreesIfNeeded(PaintInvalidationState& childPaintInvalidationState) override;
-    void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const override;
+    void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect* paintInvalidationRect) const override;
 
 private:
     LayoutObjectChildList* virtualChildren() final { return children(); }
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 9cd0882..5dc2dbb 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -1427,21 +1427,25 @@
 
     PaintInvalidationReason reason = LayoutBoxModelObject::invalidatePaintIfNeeded(paintInvalidationState, newPaintInvalidationContainer);
 
-    // If we are set to do a full paint invalidation that means the LayoutView will be
-    // issue paint invalidations. We can then skip issuing of paint invalidations for the child
-    // layoutObjects as they'll be covered by the LayoutView.
-    if (!view()->doingFullPaintInvalidation() && !isFullPaintInvalidationReason(reason)) {
+    bool willDoFullInvalidation = view()->doingFullPaintInvalidation() || isFullPaintInvalidationReason(reason);
+    if (!willDoFullInvalidation)
         invalidatePaintForOverflowIfNeeded();
 
-        // Issue paint invalidations for any scrollbars if there is a scrollable area for this layoutObject.
-        if (ScrollableArea* area = scrollableArea()) {
-            // In slimming paint mode, we already invalidated the display item clients of the scrollbars
-            // during PaintLayerScrollableArea::invalidateScrollbarRect(). However, for now we still need to
-            // invalidate the rectangles to trigger repaints.
-            if (area->hasVerticalBarDamage())
+    // Issue paint invalidations for any scrollbars if there is a scrollable area for this layoutObject.
+    if (ScrollableArea* area = scrollableArea()) {
+        if (area->hasVerticalBarDamage()) {
+            if (!willDoFullInvalidation)
                 invalidatePaintRectangleNotInvalidatingDisplayItemClients(LayoutRect(area->verticalBarDamage()));
-            if (area->hasHorizontalBarDamage())
+            // TODO(wangxianzhu): Pass current bounds of the scrollbar to PaintController. crbug.com/547119.
+            if (Scrollbar* verticalScrollbar = area->verticalScrollbar())
+                invalidateDisplayItemClient(*verticalScrollbar);
+        }
+        if (area->hasHorizontalBarDamage()) {
+            if (!willDoFullInvalidation)
                 invalidatePaintRectangleNotInvalidatingDisplayItemClients(LayoutRect(area->horizontalBarDamage()));
+            // TODO(wangxianzhu): Pass current bounds of the scrollbar to PaintController. crbug.com/547119.
+            if (Scrollbar* horizontalScrollbar = area->horizontalScrollbar())
+                invalidateDisplayItemClient(*horizontalScrollbar);
         }
     }
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
index aefc555..f04e9d6da 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
@@ -384,7 +384,8 @@
 
 void LayoutBoxModelObject::setBackingNeedsPaintInvalidationInRect(const LayoutRect& r, PaintInvalidationReason invalidationReason) const
 {
-    ASSERT(!RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled());
+    // TODO(wangxianzhu): Enable the following assert after paint invalidation for spv2 is ready.
+    // ASSERT(!RuntimeEnabledFeatures::slimmingPaintV2Enabled());
 
     // https://bugs.webkit.org/show_bug.cgi?id=61159 describes an unreproducible crash here,
     // so assert but check that the layer is composited.
@@ -402,18 +403,23 @@
     }
 }
 
-void LayoutBoxModelObject::invalidateDisplayItemClientOnBacking(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason invalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const
+void LayoutBoxModelObject::invalidateDisplayItemClientOnBacking(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason invalidationReason, const LayoutRect* paintInvalidationRect) const
 {
     if (layer()->groupedMapping()) {
-        if (GraphicsLayer* squashingLayer = layer()->groupedMapping()->squashingLayer())
-            squashingLayer->invalidateDisplayItemClient(displayItemClient, invalidationReason, enclosingIntRect(previousPaintInvalidationRect), enclosingIntRect(newPaintInvalidationRect));
+        if (GraphicsLayer* squashingLayer = layer()->groupedMapping()->squashingLayer()) {
+            // Note: the subpixel accumulation of layer() does not need to be added here. It is already taken into account.
+            IntRect paintInvalidationRectOnSquashingLayer;
+            if (paintInvalidationRect)
+                paintInvalidationRectOnSquashingLayer = enclosingIntRect(*paintInvalidationRect);
+            squashingLayer->invalidateDisplayItemClient(displayItemClient, invalidationReason, paintInvalidationRect ? &paintInvalidationRectOnSquashingLayer : nullptr);
+        }
     } else if (CompositedLayerMapping* compositedLayerMapping = layer()->compositedLayerMapping()) {
         if (this->displayItemClient() != displayItemClient.displayItemClient() && isBox() && toLayoutBox(this)->usesCompositedScrolling()) {
             // This paint invalidation container is using composited scrolling, and we are invalidating a scrolling content,
             // so we should invalidate on the scrolling contents layer only.
-            compositedLayerMapping->invalidateDisplayItemClientOnScrollingContentsLayer(displayItemClient, invalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+            compositedLayerMapping->invalidateDisplayItemClientOnScrollingContentsLayer(displayItemClient, invalidationReason, paintInvalidationRect);
         } else {
-            compositedLayerMapping->invalidateDisplayItemClient(displayItemClient, invalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+            compositedLayerMapping->invalidateDisplayItemClient(displayItemClient, invalidationReason, paintInvalidationRect);
         }
     }
 }
diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h
index 04a47f3..4eb8613 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h
@@ -274,7 +274,7 @@
     // Indicate that the contents of this layoutObject need to be repainted. Only has an effect if compositing is being used,
     void setBackingNeedsPaintInvalidationInRect(const LayoutRect&, PaintInvalidationReason) const; // r is in the coordinate space of this layout object
 
-    void invalidateDisplayItemClientOnBacking(const DisplayItemClientWrapper&, PaintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const;
+    void invalidateDisplayItemClientOnBacking(const DisplayItemClientWrapper&, PaintInvalidationReason, const LayoutRect* paintInvalidationRect) const;
 
     // http://www.w3.org/TR/css3-background/#body-background
     // <html> root element with no background steals background from its first <body> child.
diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
index 4ca3a45..5c281878 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
@@ -1404,11 +1404,12 @@
     regions.append(region);
 }
 
-void LayoutInline::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const
+void LayoutInline::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect* paintInvalidationRect) const
 {
-    LayoutBoxModelObject::invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+    LayoutBoxModelObject::invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, paintInvalidationRect);
+    // TODO(wangxianzhu): Pass current bounds of lineboxes to PaintController. crbug.com/547119.
     for (InlineFlowBox* box = firstLineBox(); box; box = box->nextLineBox())
-        paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*box, invalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+        paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*box, invalidationReason, nullptr);
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.h b/third_party/WebKit/Source/core/layout/LayoutInline.h
index 2082a643..945a4f5 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.h
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.h
@@ -188,7 +188,7 @@
 
     void computeSelfHitTestRects(Vector<LayoutRect>& rects, const LayoutPoint& layerOffset) const override;
 
-    void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const override;
+    void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect* paintInvalidationRect) const override;
 
 private:
     LayoutObjectChildList* virtualChildren() final { return children(); }
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 5f23ed7..4199514 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -1204,8 +1204,8 @@
 
 void LayoutObject::invalidatePaintUsingContainer(const LayoutBoxModelObject& paintInvalidationContainer, const LayoutRect& dirtyRect, PaintInvalidationReason invalidationReason) const
 {
-    if (RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled())
-        return;
+    // TODO(wangxianzhu): Enable the following assert after paint invalidation for spv2 is ready.
+    // ASSERT(!RuntimeEnabledFeatures::slimmingPaintV2Enabled());
 
     if (paintInvalidationContainer.frameView()->shouldThrottleRendering())
         return;
@@ -1237,22 +1237,20 @@
 
 void LayoutObject::invalidateDisplayItemClient(const DisplayItemClientWrapper& displayItemClient) const
 {
+    // TODO(wangxianzhu): Ensure correct bounds for the client will be or has been passed to PaintController. crbug.com/547119.
     // Not using enclosingCompositedContainer() directly because this object may be in an orphaned subtree.
     if (PaintLayer* enclosingLayer = this->enclosingLayer()) {
         // This is valid because we want to invalidate the client in the display item list of the current backing.
         DisableCompositingQueryAsserts disabler;
-        // Only the object needs to be invalidated, so use an empty invalidation rect.
-        LayoutRect invalidationRect;
         if (const PaintLayer* paintInvalidationLayer = enclosingLayer->enclosingLayerForPaintInvalidationCrossingFrameBoundaries())
-            paintInvalidationLayer->layoutObject()->invalidateDisplayItemClientOnBacking(displayItemClient, PaintInvalidationFull, invalidationRect, invalidationRect);
-
+            paintInvalidationLayer->layoutObject()->invalidateDisplayItemClientOnBacking(displayItemClient, PaintInvalidationFull, nullptr);
         enclosingLayer->setNeedsRepaint();
     }
 }
 
-void LayoutObject::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const
+void LayoutObject::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect* paintInvalidationRect) const
 { 
-    paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*this, invalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+    paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*this, invalidationReason, paintInvalidationRect);
 
     if (PaintLayer* enclosingLayer = this->enclosingLayer())
         enclosingLayer->setNeedsRepaint();
@@ -1265,7 +1263,7 @@
     return PaintLayer::computePaintInvalidationRect(this, paintInvalidationContainer->layer(), paintInvalidationState);
 }
 
-const LayoutBoxModelObject* LayoutObject::invalidatePaintRectangleInternal(LayoutRect& dirtyRect) const
+const LayoutBoxModelObject* LayoutObject::invalidatePaintRectangleInternal(const LayoutRect& dirtyRect) const
 {
     RELEASE_ASSERT(isRooted());
 
@@ -1276,24 +1274,24 @@
         return nullptr; // Don't invalidate paints if we're printing.
 
     const LayoutBoxModelObject& paintInvalidationContainer = containerForPaintInvalidationOnRootedTree();
-    PaintLayer::mapRectToPaintInvalidationBacking(this, &paintInvalidationContainer, dirtyRect);
-    invalidatePaintUsingContainer(paintInvalidationContainer, dirtyRect, PaintInvalidationRectangle);
+    LayoutRect dirtyRectOnBacking = dirtyRect;
+    PaintLayer::mapRectToPaintInvalidationBacking(this, &paintInvalidationContainer, dirtyRectOnBacking);
+    invalidatePaintUsingContainer(paintInvalidationContainer, dirtyRectOnBacking, PaintInvalidationRectangle);
     return &paintInvalidationContainer;
 }
 
 void LayoutObject::invalidatePaintRectangle(const LayoutRect& rect) const
 {
-    LayoutRect dirtyRect(rect);
-    const LayoutBoxModelObject* paintInvalidationContainer = invalidatePaintRectangleInternal(dirtyRect);
+    const LayoutBoxModelObject* paintInvalidationContainer = invalidatePaintRectangleInternal(rect);
     if (paintInvalidationContainer) {
-        invalidateDisplayItemClients(*paintInvalidationContainer, PaintInvalidationRectangle, dirtyRect, dirtyRect);
+        // Don't need to change the paint invalidation bounds of the client, so pass nullptr.
+        invalidateDisplayItemClients(*paintInvalidationContainer, PaintInvalidationRectangle, nullptr);
     }
 }
 
 void LayoutObject::invalidatePaintRectangleNotInvalidatingDisplayItemClients(const LayoutRect& r) const
 {
-    LayoutRect dirtyRect(r);
-    invalidatePaintRectangleInternal(dirtyRect);
+    invalidatePaintRectangleInternal(r);
 }
 
 void LayoutObject::invalidateTreeIfNeeded(PaintInvalidationState& paintInvalidationState)
@@ -1381,7 +1379,7 @@
     setPreviousSelectionRectForPaintInvalidation(newSelectionRect);
 
     if (shouldInvalidateSelection())
-        invalidateDisplayItemClients(paintInvalidationContainer, PaintInvalidationSelection, oldSelectionRect, newSelectionRect);
+        invalidateDisplayItemClients(paintInvalidationContainer, PaintInvalidationSelection, nullptr);
 
     if (fullInvalidation)
         return;
@@ -1439,12 +1437,12 @@
         // invalidation is issued. See crbug.com/508383 and crbug.com/515977.
         // This is a workaround to force display items to update paint offset.
         if (!RuntimeEnabledFeatures::slimmingPaintOffsetCachingEnabled() && paintInvalidationState.forcedSubtreeInvalidationWithinContainer())
-            invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, oldBounds, newBounds);
+            invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, &newBounds);
 
         return invalidationReason;
     }
 
-    invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, oldBounds, newBounds);
+    invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, &newBounds);
 
     if (invalidationReason == PaintInvalidationIncremental) {
         incrementallyInvalidatePaint(paintInvalidationContainer, oldBounds, newBounds, newLocation);
@@ -1456,29 +1454,6 @@
     return invalidationReason;
 }
 
-void LayoutObject::invalidatePaintIfNeededForSynchronizedPainting(const PaintInfo& paintInfo)
-{
-    ASSERT(RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled());
-    ASSERT(document().lifecycle().state() == DocumentLifecycle::InPaint);
-    ASSERT(paintInfo.paintInvalidationState);
-    ASSERT(paintInfo.paintContainer());
-
-    PaintController& paintController = paintInfo.context->paintController();
-    if (paintController.clientHasCheckedPaintInvalidation(displayItemClient())) {
-        ASSERT(paintController.clientCacheIsValid(displayItemClient())
-            == (invalidatePaintIfNeeded(*paintInfo.paintInvalidationState, *paintInfo.paintContainer()) == PaintInvalidationNone));
-        return;
-    }
-
-    PaintInvalidationReason reason = invalidatePaintIfNeeded(*paintInfo.paintInvalidationState, *paintInfo.paintContainer());
-    clearPaintInvalidationState(*paintInfo.paintInvalidationState);
-
-    if (reason == PaintInvalidationDelayedFull)
-        paintInfo.paintInvalidationState->pushDelayedPaintInvalidationTarget(*this);
-
-    paintController.setClientHasCheckedPaintInvalidation(displayItemClient());
-}
-
 PaintInvalidationReason LayoutObject::paintInvalidationReason(const LayoutBoxModelObject& paintInvalidationContainer,
     const LayoutRect& oldBounds, const LayoutPoint& oldPositionFromPaintInvalidationBacking,
     const LayoutRect& newBounds, const LayoutPoint& newPositionFromPaintInvalidationBacking) const
@@ -3380,10 +3355,14 @@
 void LayoutObject::invalidateDisplayItemClientForNonCompositingDescendantsOf(const LayoutObject& object) const
 {
     // Not using enclosingCompositedContainer() directly because this object may be in an orphaned subtree.
-    const PaintLayer* enclosingLayer = this->enclosingLayer();
+    PaintLayer* enclosingLayer = this->enclosingLayer();
     if (!enclosingLayer)
         return;
 
+    // TODO(wangxianzhu): This is a workaround for invalidation of detached custom scrollbar parts which can't find
+    // their own enclosing layers. May remove this when fixing crbug.com/547119 for scrollbars.
+    enclosingLayer->setNeedsRepaint();
+
     // This is valid because we want to invalidate the client in the display item list of the current backing.
     DisableCompositingQueryAsserts disabler;
     const PaintLayer* paintInvalidationLayer = enclosingLayer->enclosingLayerForPaintInvalidationCrossingFrameBoundaries();
@@ -3395,9 +3374,8 @@
         explicit Functor(const LayoutBoxModelObject& paintInvalidationContainer) : m_paintInvalidationContainer(paintInvalidationContainer) { }
         void operator()(LayoutObject& object) const override
         {
-            // Only the objects need to be invalidated, not any paint rectangles.
-            LayoutRect invalidationRect;
-            object.invalidateDisplayItemClients(m_paintInvalidationContainer, PaintInvalidationFull, invalidationRect, invalidationRect);
+            // TODO(wangxianzhu): Ensure correct bounds for the client will be or has been passed to PaintController. crbug.com/547119.
+            object.invalidateDisplayItemClients(m_paintInvalidationContainer, PaintInvalidationFull, nullptr);
         }
     private:
         const LayoutBoxModelObject& m_paintInvalidationContainer;
@@ -3416,7 +3394,10 @@
     LayoutRect invalidationRect = previousPaintInvalidationRect();
     adjustInvalidationRectForCompositedScrolling(invalidationRect, paintInvalidationContainer);
     invalidatePaintUsingContainer(paintInvalidationContainer, invalidationRect, PaintInvalidationLayer);
-    invalidateDisplayItemClients(paintInvalidationContainer, PaintInvalidationLayer, invalidationRect, invalidationRect);
+
+    // The PaintController may have changed. Pass the previous paint invalidation rect to the new PaintController.
+    // The rect will be updated if it changes during the next paint invalidation.
+    invalidateDisplayItemClients(paintInvalidationContainer, PaintInvalidationLayer, &invalidationRect);
 }
 
 void LayoutObject::invalidatePaintIncludingNonCompositingDescendants()
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index 9b5fc43..8e95488 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h
@@ -1055,7 +1055,7 @@
     // as the local coordinate space of |paintInvalidationContainer| in the presence of layer squashing.
     void invalidatePaintUsingContainer(const LayoutBoxModelObject& paintInvalidationContainer, const LayoutRect&, PaintInvalidationReason) const;
 
-    // Invalidate the paint of a specific subrectangle within a given object. The rect |r| is in the object's coordinate space.
+    // Invalidate the paint of a specific subrectangle within a given object. The rect is in the object's coordinate space.
     void invalidatePaintRectangle(const LayoutRect&) const;
     void invalidatePaintRectangleNotInvalidatingDisplayItemClients(const LayoutRect&) const;
 
@@ -1309,7 +1309,6 @@
     class MutableForPainting {
     public:
         void setPreviousPaintOffset(const LayoutPoint& paintOffset) { m_layoutObject.setPreviousPaintOffset(paintOffset); }
-        void invalidatePaintIfNeeded(const PaintInfo& paintInfo) { m_layoutObject.invalidatePaintIfNeededForSynchronizedPainting(paintInfo); }
 
     private:
         friend class LayoutObject;
@@ -1450,13 +1449,14 @@
 
     virtual void invalidatePaintOfSubtreesIfNeeded(PaintInvalidationState& childPaintInvalidationState);
     virtual PaintInvalidationReason invalidatePaintIfNeeded(PaintInvalidationState&, const LayoutBoxModelObject& paintInvalidationContainer);
-    void invalidatePaintIfNeededForSynchronizedPainting(const PaintInfo&);
 
     // When this object is invalidated for paint, this method is called to invalidate any DisplayItemClients
     // owned by this object, including the object itself, LayoutText/LayoutInline line boxes, etc.,
     // not including children which will be invalidated normally during invalidateTreeIfNeeded() and
     // parts which are invalidated separately (e.g. scrollbars).
-    virtual void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const;
+    // |paintInvalidationRect| can be nullptr if we know it's unchanged and PaintController has cached the
+    // previous value; otherwise we must pass a correct value.
+    virtual void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect* paintInvalidationRect) const;
 
     void setIsBackgroundAttachmentFixedObject(bool);
 
@@ -1532,7 +1532,7 @@
     static bool isAllowedToModifyLayoutTreeStructure(Document&);
 
     // The passed rect is mutated into the coordinate space of the paint invalidation container.
-    const LayoutBoxModelObject* invalidatePaintRectangleInternal(LayoutRect&) const;
+    const LayoutBoxModelObject* invalidatePaintRectangleInternal(const LayoutRect&) const;
 
     static LayoutPoint uninitializedPaintOffset() { return LayoutPoint(LayoutUnit::max(), LayoutUnit::max()); }
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutText.cpp b/third_party/WebKit/Source/core/layout/LayoutText.cpp
index b09ce12..10b8909 100644
--- a/third_party/WebKit/Source/core/layout/LayoutText.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutText.cpp
@@ -1873,16 +1873,16 @@
     return AbstractInlineTextBox::getOrCreate(this, m_firstTextBox);
 }
 
-void LayoutText::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const
+void LayoutText::invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason invalidationReason, const LayoutRect* paintInvalidationRect) const
 {
-    LayoutObject::invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+    LayoutObject::invalidateDisplayItemClients(paintInvalidationContainer, invalidationReason, paintInvalidationRect);
 
-    LayoutRect emptyInvalidationRect;
+    // TODO(wangxianzhu): Pass current bounds of text boxes to PaintController. crbug.com/547119.
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
-        paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*box, invalidationReason, emptyInvalidationRect, emptyInvalidationRect);
+        paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*box, invalidationReason, nullptr);
         if (box->truncation() != cNoTruncation) {
             if (EllipsisBox* ellipsisBox = box->root().ellipsisBox())
-                paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*ellipsisBox, invalidationReason, emptyInvalidationRect, emptyInvalidationRect);
+                paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*ellipsisBox, invalidationReason, nullptr);
         }
     }
 }
diff --git a/third_party/WebKit/Source/core/layout/LayoutText.h b/third_party/WebKit/Source/core/layout/LayoutText.h
index ac8a721..f7a2b20c 100644
--- a/third_party/WebKit/Source/core/layout/LayoutText.h
+++ b/third_party/WebKit/Source/core/layout/LayoutText.h
@@ -194,7 +194,7 @@
 
     virtual InlineTextBox* createTextBox(int start, unsigned short length); // Subclassed by SVG.
 
-    void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect) const override;
+    void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason, const LayoutRect* paintInvalidationRect) const override;
 
 private:
     void computePreferredLogicalWidths(float leadWidth);
diff --git a/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp b/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp
index 219fa18..baf129d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp
@@ -409,7 +409,7 @@
     if (paddingType == barType && style.appearance() != NoControlPart)
         padding += menuListArrowPadding();
 
-    return padding;
+    return padding * style.effectiveZoom();
 }
 
 //
diff --git a/third_party/WebKit/Source/core/layout/LayoutView.cpp b/third_party/WebKit/Source/core/layout/LayoutView.cpp
index 00c4e10..3056632 100644
--- a/third_party/WebKit/Source/core/layout/LayoutView.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutView.cpp
@@ -390,7 +390,7 @@
         const LayoutBoxModelObject& paintInvalidationContainer = paintInvalidationState.paintInvalidationContainer();
         PaintLayer::mapRectToPaintInvalidationBacking(this, &paintInvalidationContainer, dirtyRect, &paintInvalidationState);
         invalidatePaintUsingContainer(paintInvalidationContainer, dirtyRect, PaintInvalidationFull);
-        invalidateDisplayItemClients(paintInvalidationContainer, PaintInvalidationFull, dirtyRect, dirtyRect);
+        invalidateDisplayItemClients(paintInvalidationContainer, PaintInvalidationFull, &dirtyRect);
     }
     LayoutBlock::invalidateTreeIfNeeded(paintInvalidationState);
 }
diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
index 9187b0b..819945a 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
@@ -2030,7 +2030,9 @@
 // r is in the coordinate space of the layer's layout object
 void CompositedLayerMapping::setContentsNeedDisplayInRect(const LayoutRect& r, PaintInvalidationReason invalidationReason)
 {
-    ASSERT(!RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled());
+    // TODO(wangxianzhu): Enable the following assert after paint invalidation for spv2 is ready.
+    // ASSERT(!RuntimeEnabledFeatures::slimmingPaintV2Enabled());
+
     SetContentsNeedsDisplayInRectFunctor functor = {
         enclosingIntRect(LayoutRect(r.location() + m_owningLayer.subpixelAccumulation(), r.size())),
         invalidationReason
@@ -2038,18 +2040,33 @@
     ApplyToGraphicsLayers(this, functor, ApplyToContentLayers);
 }
 
-void CompositedLayerMapping::invalidateDisplayItemClient(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason paintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect)
+struct InvalidateDisplayItemClientFunctor {
+    void operator() (GraphicsLayer* layer) const
+    {
+        IntRect visualRectOnLayer;
+        if (visualRect) {
+            visualRectOnLayer = enclosingIntRect(LayoutRect(visualRect->location() + subpixelAccumulation, visualRect->size()));
+            visualRectOnLayer.move(-layer->offsetFromLayoutObject());
+        }
+        layer->invalidateDisplayItemClient(displayItemClient, invalidationReason, visualRect ? &visualRectOnLayer : nullptr);
+    }
+
+    const DisplayItemClientWrapper& displayItemClient;
+    PaintInvalidationReason invalidationReason;
+    const LayoutRect* visualRect;
+    LayoutSize subpixelAccumulation;
+};
+
+void CompositedLayerMapping::invalidateDisplayItemClient(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason paintInvalidationReason, const LayoutRect* visualRect)
 {
-    ApplyToGraphicsLayers(this, [&displayItemClient, paintInvalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect](GraphicsLayer* layer) {
-        layer->invalidateDisplayItemClient(displayItemClient, paintInvalidationReason, enclosingIntRect(previousPaintInvalidationRect), enclosingIntRect(newPaintInvalidationRect));
-    }, ApplyToContentLayers);
+    InvalidateDisplayItemClientFunctor functor = { displayItemClient, paintInvalidationReason, visualRect, m_owningLayer.subpixelAccumulation() };
+    ApplyToGraphicsLayers(this, functor, ApplyToContentLayers);
 }
 
-void CompositedLayerMapping::invalidateDisplayItemClientOnScrollingContentsLayer(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason paintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect)
+void CompositedLayerMapping::invalidateDisplayItemClientOnScrollingContentsLayer(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason paintInvalidationReason, const LayoutRect* visualRect)
 {
-    ApplyToGraphicsLayers(this, [&displayItemClient, paintInvalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect](GraphicsLayer* layer) {
-        layer->invalidateDisplayItemClient(displayItemClient, paintInvalidationReason, enclosingIntRect(previousPaintInvalidationRect), enclosingIntRect(newPaintInvalidationRect));
-    }, ApplyToScrollingContentsLayer);
+    InvalidateDisplayItemClientFunctor functor = { displayItemClient, paintInvalidationReason, visualRect, m_owningLayer.subpixelAccumulation() };
+    ApplyToGraphicsLayers(this, functor, ApplyToScrollingContentsLayer);
 }
 
 const GraphicsLayerPaintInfo* CompositedLayerMapping::containingSquashedLayer(const LayoutObject* layoutObject, const Vector<GraphicsLayerPaintInfo>& layers, unsigned maxSquashedLayerIndex)
diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h
index 95e1a6565..4a666509 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h
@@ -123,8 +123,11 @@
     // LayoutRect is in the coordinate space of the layer's layout object.
     void setContentsNeedDisplayInRect(const LayoutRect&, PaintInvalidationReason);
 
-    void invalidateDisplayItemClient(const DisplayItemClientWrapper&, PaintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect);
-    void invalidateDisplayItemClientOnScrollingContentsLayer(const DisplayItemClientWrapper&, PaintInvalidationReason, const LayoutRect& previousPaintInvalidationRect, const LayoutRect& newPaintInvalidationRect);
+    // If |visualRect| is not nullptr, it contains all pixels that might be painted by the display item client,
+    // in coordinate space of the layer's layout object.
+    // |visualRect| can be nullptr if we know it's unchanged and PaintController has cached the previous value.
+    void invalidateDisplayItemClient(const DisplayItemClientWrapper&, PaintInvalidationReason, const LayoutRect* visualRect);
+    void invalidateDisplayItemClientOnScrollingContentsLayer(const DisplayItemClientWrapper&, PaintInvalidationReason, const LayoutRect* visualRect);
 
     // Notification from the layoutObject that its content changed.
     void contentChanged(ContentChangeType);
diff --git a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
index b888a3e..22118089 100644
--- a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
@@ -888,9 +888,10 @@
     FrameView* view = m_layoutView.frameView();
     if (RuntimeEnabledFeatures::slimmingPaintV2Enabled()) {
         ASSERT(lifecycle().state() == DocumentLifecycle::CompositingForSlimmingPaintV2Clean
-            // TODO(wangxianzhu): Remove this when we remove the old path for spv2.
-            || lifecycle().state() == DocumentLifecycle::PaintInvalidationClean
             || view->shouldThrottleRendering());
+    } else if (RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled()) {
+        ASSERT(lifecycle().state() == DocumentLifecycle::PaintClean
+            || (view && view->shouldThrottleRendering()));
     } else {
         ASSERT(lifecycle().state() == DocumentLifecycle::PaintInvalidationClean
             || (view && view->shouldThrottleRendering()));
diff --git a/third_party/WebKit/Source/core/page/NetworkStateNotifier.h b/third_party/WebKit/Source/core/page/NetworkStateNotifier.h
index 16aac60..de4517ff 100644
--- a/third_party/WebKit/Source/core/page/NetworkStateNotifier.h
+++ b/third_party/WebKit/Source/core/page/NetworkStateNotifier.h
@@ -112,7 +112,10 @@
     void setWebConnectionImpl(WebConnectionType, double maxBandwidthMbps);
     void setMaxBandwidthImpl(double maxBandwidthMbps);
 
-    using ObserverListMap = WillBePersistentHeapHashMap<RawPtrWillBeWeakMember<ExecutionContext>, OwnPtr<ObserverList>>;
+    // The ObserverListMap is cross-thread accessed, adding/removing Observers running
+    // within an ExecutionContext. Kept off-heap to ease cross-thread allocation and use;
+    // the observers are (already) responsible for explicitly unregistering while finalizing.
+    using ObserverListMap = HashMap<RawPtrWillBeUntracedMember<ExecutionContext>, OwnPtr<ObserverList>>;
 
     void notifyObserversOfConnectionChangeOnContext(WebConnectionType, double maxBandwidthMbps, ExecutionContext*);
 
diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.cpp b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
index 0893dc5..03faeed 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
@@ -2692,11 +2692,15 @@
     // Need to access compositingState(). We've ensured correct flag setting when compositingState() changes.
     DisableCompositingQueryAsserts disabler;
 
-    if (compositingState() != NotComposited)
-        return;
-
     PaintLayer* layer = this;
     while (true) {
+        if (layer->compositingState() == PaintsIntoOwnBacking)
+            return;
+        if (CompositedLayerMapping* groupedMapping = layer->groupedMapping()) {
+            groupedMapping->owningLayer().setNeedsRepaint();
+            return;
+        }
+
         PaintLayer* container = layer->parent();
         if (!container) {
             LayoutObject* owner = layer->layoutObject()->frame()->ownerLayoutObject();
@@ -2709,8 +2713,6 @@
                 break;
             container->m_needsRepaint = true;
         }
-        if (container->compositingState() != NotComposited)
-            break;
         layer = container;
     }
 }
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
index e2b56bff..71dc557 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
@@ -220,8 +220,6 @@
     if (scrollRect.isEmpty())
         return;
 
-    box().invalidateDisplayItemClient(*scrollbar);
-
     LayoutRect paintInvalidationRect = LayoutRect(scrollRect);
     box().flipForWritingMode(paintInvalidationRect);
 
@@ -235,6 +233,7 @@
         // We have invalidated the displayItemClient of the scrollbar, but for now we still need to
         // invalidate the rectangles to trigger repaints.
         box().invalidatePaintRectangleNotInvalidatingDisplayItemClients(LayoutRect(intRect));
+        box().invalidateDisplayItemClient(*scrollbar);
     }
 }
 
@@ -1567,8 +1566,10 @@
     if (!scrollbar)
         return;
 
-    if (invalidate)
+    if (invalidate) {
+        m_scrollableArea->box().invalidateDisplayItemClient(*scrollbar);
         scrollbar->invalidate();
+    }
     if (!scrollbar->isCustomScrollbar())
         m_scrollableArea->willRemoveScrollbar(scrollbar.get(), orientation);
 
diff --git a/third_party/WebKit/Source/core/paint/ThemePainterDefault.cpp b/third_party/WebKit/Source/core/paint/ThemePainterDefault.cpp
index f8c44d4..b9b1a28 100644
--- a/third_party/WebKit/Source/core/paint/ThemePainterDefault.cpp
+++ b/third_party/WebKit/Source/core/paint/ThemePainterDefault.cpp
@@ -267,8 +267,10 @@
         // TODO(tkent): arrowSize should be zoom-aware. crbug.com/432795.
         const int arrowSize = 6;
         const int arrowPadding = 7;
-        extraParams.menuList.arrowX = (box.styleRef().direction() == RTL) ? rect.x() + arrowPadding : right - arrowSize - arrowPadding;
-        extraParams.menuList.arrowSize = arrowSize;
+        extraParams.menuList.arrowX = (box.styleRef().direction() == RTL)
+            ? rect.x() + arrowPadding * box.styleRef().effectiveZoom()
+            : right - (arrowSize + arrowPadding) * box.styleRef().effectiveZoom();
+        extraParams.menuList.arrowSize = arrowSize * box.styleRef().effectiveZoom();
     }
 }
 
diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 677a037..b6731f78 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
@@ -158,7 +158,7 @@
 SharedArrayBuffer
 SharedWorker status=stable
 SlimmingPaintV2
-SlimmingPaintOffsetCaching implied_by=SlimmingPaintV2, implied_by=SlimmingPaintSynchronizedPainting
+SlimmingPaintOffsetCaching implied_by=SlimmingPaintV2
 SlimmingPaintStrictCullRectClipping
 SlimmingPaintSynchronizedPainting implied_by=SlimmingPaintV2
 SlimmingPaintUnderInvalidationChecking
diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
index 20e0e4a..2b2ec9c4 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
@@ -1011,9 +1011,9 @@
         m_linkHighlights[i]->invalidate();
 }
 
-void GraphicsLayer::invalidateDisplayItemClient(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason paintInvalidationReason, const IntRect& previousPaintInvalidationRect, const IntRect& newPaintInvalidationRect)
+void GraphicsLayer::invalidateDisplayItemClient(const DisplayItemClientWrapper& displayItemClient, PaintInvalidationReason paintInvalidationReason, const IntRect* visualRect)
 {
-    paintController()->invalidate(displayItemClient, paintInvalidationReason, previousPaintInvalidationRect, newPaintInvalidationRect);
+    paintController()->invalidate(displayItemClient, paintInvalidationReason, visualRect);
     if (isTrackingPaintInvalidations())
         trackPaintInvalidationObject(displayItemClient.debugName());
 }
diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.h b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.h
index 0702e3d..89eb7e9 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.h
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.h
@@ -192,7 +192,10 @@
 
     void setContentsNeedsDisplay();
 
-    void invalidateDisplayItemClient(const DisplayItemClientWrapper&, PaintInvalidationReason, const IntRect& previousPaintInvalidationRect, const IntRect& newPaintInvalidationRect);
+    // If |visualRect| is not nullptr, it contains all pixels within the GraphicsLayer which might be painted into by
+    // the display item client, in coordinate space of the GraphicsLayer.
+    // |visualRect| can be nullptr if we know it's unchanged and PaintController has cached the previous value.
+    void invalidateDisplayItemClient(const DisplayItemClientWrapper&, PaintInvalidationReason, const IntRect* visualRect);
 
     // Set that the position/size of the contents (image or video).
     void setContentsRect(const IntRect&);
diff --git a/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp b/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
index e6c10a95..da51921 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
@@ -112,23 +112,21 @@
     endSkippingCache();
 }
 
-void PaintController::invalidate(const DisplayItemClientWrapper& client, PaintInvalidationReason paintInvalidationReason, const IntRect& previousPaintInvalidationRect, const IntRect& newPaintInvalidationRect)
+void PaintController::invalidate(const DisplayItemClientWrapper& client, PaintInvalidationReason paintInvalidationReason, const IntRect* visualRect)
 {
     invalidateClient(client);
 
-    if (RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled()) {
-        Invalidation invalidation = { previousPaintInvalidationRect, paintInvalidationReason };
-        if (!previousPaintInvalidationRect.isEmpty())
-            m_invalidations.append(invalidation);
-        if (newPaintInvalidationRect != previousPaintInvalidationRect && !newPaintInvalidationRect.isEmpty()) {
-            invalidation.rect = newPaintInvalidationRect;
-            m_invalidations.append(invalidation);
-        }
+    if (visualRect) {
+        // TODO(wkorman): cache visualRect for the client.
     }
 }
 
 void PaintController::invalidateClient(const DisplayItemClientWrapper& client)
 {
+#if ENABLE(ASSERT)
+    m_invalidations.append(client.debugName());
+#endif
+
     invalidateUntracked(client.displayItemClient());
     if (RuntimeEnabledFeatures::slimmingPaintV2Enabled() && m_trackedPaintInvalidationObjects)
         m_trackedPaintInvalidationObjects->append(client.debugName());
@@ -269,28 +267,26 @@
 // Coefficients are related to the ratio of out-of-order CachedDisplayItems
 // and the average number of (Drawing|Subsequence)DisplayItems per client.
 //
-void PaintController::commitNewDisplayItems(GraphicsLayer* graphicsLayer)
+void PaintController::commitNewDisplayItems()
 {
     TRACE_EVENT2("blink,benchmark", "PaintController::commitNewDisplayItems",
         "current_display_list_size", (int)m_currentPaintArtifact.displayItemList().size(),
         "num_non_cached_new_items", (int)m_newDisplayItemList.size() - m_numCachedItems);
 
-    if (RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled()) {
-        if (!m_newDisplayItemList.isEmpty() && m_newDisplayItemList.last().type() == DisplayItem::CachedDisplayItemList) {
-            // The whole display item list is cached.
-            ASSERT(m_newDisplayItemList.size() == 1
-                || (m_newDisplayItemList.size() == 2 && m_newDisplayItemList[0].type() == DisplayItem::DebugRedFill));
-            ASSERT(m_invalidations.isEmpty());
-            ASSERT(m_clientsCheckedPaintInvalidation.isEmpty());
-            m_newDisplayItemList.clear();
-            m_newPaintChunks.clear();
-            return;
-        }
-        for (const auto& invalidation : m_invalidations)
-            graphicsLayer->setNeedsDisplayInRect(invalidation.rect, invalidation.invalidationReason);
-        m_invalidations.clear();
-        m_clientsCheckedPaintInvalidation.clear();
+    if (RuntimeEnabledFeatures::slimmingPaintSynchronizedPaintingEnabled()
+        && !m_newDisplayItemList.isEmpty()
+        && m_newDisplayItemList.last().type() == DisplayItem::CachedDisplayItemList) {
+        // The whole display item list is cached.
+        ASSERT(m_newDisplayItemList.size() == 1
+            || (m_newDisplayItemList.size() == 2 && m_newDisplayItemList[0].type() == DisplayItem::DebugRedFill));
+        ASSERT(m_invalidations.isEmpty());
+        ASSERT(m_clientsCheckedPaintInvalidation.isEmpty());
+        m_newDisplayItemList.clear();
+        m_newPaintChunks.clear();
+        return;
     }
+    if (RuntimeEnabledFeatures::slimmingPaintV2Enabled())
+        m_clientsCheckedPaintInvalidation.clear();
 
     // These data structures are used during painting only.
     ASSERT(m_scopeStack.isEmpty());
@@ -300,6 +296,7 @@
 #if ENABLE(ASSERT)
     m_newDisplayItemIndicesByClient.clear();
     m_clientsWithPaintOffsetInvalidations.clear();
+    m_invalidations.clear();
 #endif
 
     if (m_currentPaintArtifact.isEmpty()) {
diff --git a/third_party/WebKit/Source/platform/graphics/paint/PaintController.h b/third_party/WebKit/Source/platform/graphics/paint/PaintController.h
index 3623262..849fa4c 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/PaintController.h
+++ b/third_party/WebKit/Source/platform/graphics/paint/PaintController.h
@@ -25,7 +25,6 @@
 
 namespace blink {
 
-class GraphicsLayer;
 class GraphicsContext;
 
 static const size_t kInitialDisplayItemListCapacityBytes = 512;
@@ -42,8 +41,13 @@
         return adoptPtr(new PaintController());
     }
 
-    // These methods are called during paint invalidation (or paint if SlimmingPaintSynchronizedPainting is on).
-    void invalidate(const DisplayItemClientWrapper&, PaintInvalidationReason, const IntRect& previousPaintInvalidationRect, const IntRect& newPaintInvalidationRect);
+    // These methods are called during paint invalidation (or paint if SlimmingPaintV2 is on).
+
+    // If |visualRect| is not nullptr, for slimming paint v1, it contains all pixels within the GraphicsLayer
+    // which might be painted into by the display item client, in coordinate space of the GraphicsLayer.
+    // TODO(pdr): define it for spv2.
+    // |visualRect| can be nullptr if we know it's unchanged and PaintController has cached the previous value.
+    void invalidate(const DisplayItemClientWrapper&, PaintInvalidationReason, const IntRect* visualRect);
     void invalidateUntracked(DisplayItemClient);
     void invalidateAll();
 
@@ -103,9 +107,8 @@
     void endSkippingCache() { ASSERT(m_skippingCacheCount > 0); --m_skippingCacheCount; }
     bool skippingCache() const { return m_skippingCacheCount; }
 
-    // Must be called when a painting is finished. If passed, invalidations are recorded on the given
-    // GraphicsLayer.
-    void commitNewDisplayItems(GraphicsLayer* = nullptr);
+    // Must be called when a painting is finished.
+    void commitNewDisplayItems();
 
     // Returns the approximate memory usage, excluding memory likely to be
     // shared with the embedder after copying to WebPaintController.
@@ -242,14 +245,10 @@
     unsigned m_nextScope;
     Vector<unsigned> m_scopeStack;
 
-    struct Invalidation {
-        IntRect rect;
-        PaintInvalidationReason invalidationReason;
-    };
-
-    Vector<Invalidation> m_invalidations;
-
 #if ENABLE(ASSERT)
+    // Record the debug names of invalidated clients for assertion and debugging.
+    Vector<String> m_invalidations;
+
     // This is used to check duplicated ids during add(). We could also check
     // during commitNewDisplayItems(), but checking during add() helps developer
     // easily find where the duplicated ids are from.
diff --git a/third_party/WebKit/Source/platform/graphics/paint/PaintControllerTest.cpp b/third_party/WebKit/Source/platform/graphics/paint/PaintControllerTest.cpp
index 459aba9..7cc74dc 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/PaintControllerTest.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/PaintControllerTest.cpp
@@ -134,7 +134,7 @@
         TestDisplayItem(second, backgroundDrawingType),
         TestDisplayItem(first, foregroundDrawingType));
 
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 300, 300));
     drawRect(context, first, foregroundDrawingType, FloatRect(100, 100, 300, 300));
     paintController().commitNewDisplayItems();
@@ -161,7 +161,7 @@
         TestDisplayItem(second, backgroundDrawingType),
         TestDisplayItem(unaffected, backgroundDrawingType));
 
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, second, backgroundDrawingType, FloatRect(100, 100, 50, 200));
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 100, 100));
     drawRect(context, unaffected, backgroundDrawingType, FloatRect(300, 300, 10, 10));
@@ -222,7 +222,7 @@
         TestDisplayItem(second, foregroundDrawingType),
         TestDisplayItem(third, foregroundDrawingType));
 
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 100, 100));
     drawRect(context, second, backgroundDrawingType, FloatRect(100, 100, 50, 200));
     drawRect(context, third, backgroundDrawingType, FloatRect(300, 100, 50, 50));
@@ -254,8 +254,8 @@
         TestDisplayItem(second, backgroundDrawingType),
         TestDisplayItem(second, foregroundDrawingType));
 
-    paintController().invalidate(first, PaintInvalidationFull, IntRect(), IntRect());
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(first, PaintInvalidationFull, nullptr);
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 150, 150));
     drawRect(context, first, foregroundDrawingType, FloatRect(100, 100, 150, 150));
     drawRect(context, second, backgroundDrawingType, FloatRect(200, 200, 50, 50));
@@ -268,7 +268,7 @@
         TestDisplayItem(second, backgroundDrawingType),
         TestDisplayItem(second, foregroundDrawingType));
 
-    paintController().invalidate(first, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(first, PaintInvalidationFull, nullptr);
     drawRect(context, second, backgroundDrawingType, FloatRect(200, 200, 50, 50));
     drawRect(context, second, foregroundDrawingType, FloatRect(200, 200, 50, 50));
     paintController().commitNewDisplayItems();
@@ -292,8 +292,8 @@
         TestDisplayItem(first, backgroundDrawingType),
         TestDisplayItem(first, foregroundDrawingType));
 
-    paintController().invalidate(first, PaintInvalidationFull, IntRect(), IntRect());
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(first, PaintInvalidationFull, nullptr);
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 150, 150));
     drawRect(context, first, foregroundDrawingType, FloatRect(100, 100, 150, 150));
     drawRect(context, second, backgroundDrawingType, FloatRect(200, 200, 50, 50));
@@ -306,8 +306,8 @@
         TestDisplayItem(second, backgroundDrawingType),
         TestDisplayItem(second, foregroundDrawingType));
 
-    paintController().invalidate(first, PaintInvalidationFull, IntRect(), IntRect());
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(first, PaintInvalidationFull, nullptr);
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 150, 150));
     drawRect(context, first, foregroundDrawingType, FloatRect(100, 100, 150, 150));
     paintController().commitNewDisplayItems();
@@ -336,7 +336,7 @@
         TestDisplayItem(second, backgroundDrawingType),
         TestDisplayItem(first, DisplayItem::clipTypeToEndClipType(clipType)));
 
-    paintController().invalidate(first, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(first, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 150, 150));
     drawRect(context, second, backgroundDrawingType, FloatRect(100, 100, 150, 150));
     paintController().commitNewDisplayItems();
@@ -345,7 +345,7 @@
         TestDisplayItem(first, backgroundDrawingType),
         TestDisplayItem(second, backgroundDrawingType));
 
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(100, 100, 150, 150));
     {
         ClipRecorder clipRecorder(context, second, clipType, LayoutRect(1, 1, 2, 2));
@@ -378,7 +378,7 @@
     const SkPicture* firstPicture = static_cast<const DrawingDisplayItem&>(paintController().displayItemList()[0]).picture();
     const SkPicture* secondPicture = static_cast<const DrawingDisplayItem&>(paintController().displayItemList()[1]).picture();
 
-    paintController().invalidate(first, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(first, PaintInvalidationFull, nullptr);
     EXPECT_FALSE(paintController().clientCacheIsValid(first.displayItemClient()));
     EXPECT_TRUE(paintController().clientCacheIsValid(second.displayItemClient()));
 
@@ -430,7 +430,7 @@
         TestDisplayItem(container2, foregroundDrawingType));
 
     // Simulate the situation when container1 e.g. gets a z-index that is now greater than container2.
-    paintController().invalidate(container1, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(container1, PaintInvalidationFull, nullptr);
     drawRect(context, container2, backgroundDrawingType, FloatRect(100, 200, 100, 100));
     drawRect(context, content2, backgroundDrawingType, FloatRect(100, 200, 50, 200));
     drawRect(context, content2, foregroundDrawingType, FloatRect(100, 200, 50, 200));
@@ -592,13 +592,13 @@
         TestDisplayItem(container2, endSubsequenceType));
 
     // Invalidate container1 but not content1.
-    paintController().invalidate(container1, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(container1, PaintInvalidationFull, nullptr);
 
     // Container2 itself now becomes empty (but still has the 'content2' child),
     // and chooses not to output subsequence info.
 
-    paintController().invalidate(container2, PaintInvalidationFull, IntRect(), IntRect());
-    paintController().invalidate(content2, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(container2, PaintInvalidationFull, nullptr);
+    paintController().invalidate(content2, PaintInvalidationFull, nullptr);
     EXPECT_FALSE(SubsequenceRecorder::useCachedSubsequenceIfPossible(context, container2, subsequenceType));
     EXPECT_FALSE(SubsequenceRecorder::useCachedSubsequenceIfPossible(context, content2, subsequenceType));
     // Content2 now outputs foreground only.
@@ -694,7 +694,7 @@
     EXPECT_NE(picture2, static_cast<const DrawingDisplayItem&>(paintController().displayItemList()[2]).picture());
 
     // Now the multicol becomes 3 columns and repaints.
-    paintController().invalidate(multicol, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(multicol, PaintInvalidationFull, nullptr);
     drawRect(context, multicol, backgroundDrawingType, FloatRect(100, 100, 100, 100));
 
     paintController().beginScope();
@@ -743,7 +743,7 @@
         TestDisplayItem(second, DisplayItem::EndClipPath),
         TestDisplayItem(third, backgroundDrawingType));
 
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(0, 0, 100, 100));
     {
         ClipRecorder clipRecorder(context, second, clipType, LayoutRect(1, 1, 2, 2));
@@ -757,7 +757,7 @@
         TestDisplayItem(first, backgroundDrawingType),
         TestDisplayItem(third, backgroundDrawingType));
 
-    paintController().invalidate(second, PaintInvalidationFull, IntRect(), IntRect());
+    paintController().invalidate(second, PaintInvalidationFull, nullptr);
     drawRect(context, first, backgroundDrawingType, FloatRect(0, 0, 100, 100));
     {
         ClipRecorder clipRecorder(context, second, clipType, LayoutRect(1, 1, 2, 2));
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline.py b/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
index fd94a5f..927c4b3 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
@@ -678,7 +678,6 @@
             self.no_optimize_option,
             # FIXME: Remove this option.
             self.results_directory_option,
-            optparse.make_option("--auth-refresh-token-json", help="Rietveld auth refresh JSON token."),
             ])
 
     def bot_revision_data(self):
@@ -796,9 +795,6 @@
         subprocess_command = ['git', 'cl'] + command
         if options.verbose:
             subprocess_command.append('--verbose')
-        if options.auth_refresh_token_json:
-            subprocess_command.append('--auth-refresh-token-json')
-            subprocess_command.append(options.auth_refresh_token_json)
 
         process = self._tool.executive.popen(subprocess_command, stdout=self._tool.executive.PIPE, stderr=self._tool.executive.STDOUT)
         last_output_time = time.time()
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
index 8318e9e..00b51f32 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
@@ -1073,12 +1073,12 @@
             }
 
             self.command.tree_status = lambda: 'closed'
-            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False, auth_refresh_token_json=None), [], self.tool)
+            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False), [], self.tool)
             self.assertEqual(self.tool.executive.calls, [])
 
             self.command.tree_status = lambda: 'open'
             self.tool.executive.calls = []
-            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False, auth_refresh_token_json=None), [], self.tool)
+            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False), [], self.tool)
 
             self.assertEqual(self.tool.executive.calls, [
                 [
@@ -1162,7 +1162,7 @@
             self.command.tree_status = lambda: 'open'
             self.tool.executive = MockExecutive()
             self.tool.executive.calls = []
-            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False, auth_refresh_token_json=None), [], self.tool)
+            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False), [], self.tool)
 
             self.assertEqual(self.tool.executive.calls, [
                 [
@@ -1222,7 +1222,7 @@
             }
 
             self.command.tree_status = lambda: 'open'
-            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False, auth_refresh_token_json=None), [], self.tool)
+            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False), [], self.tool)
             self.assertEqual(self.tool.executive.calls, [
                 [['python', 'echo', 'optimize-baselines', '--no-modify-scm', '--suffixes', '', 'fast/dom/prototype-taco.html']],
                 ['git', 'cl', 'upload', '-f'],
@@ -1283,7 +1283,7 @@
 
             self.command.tree_status = lambda: 'open'
             webkitpy.tool.commands.rebaseline._get_branch_name_or_ref = lambda x: 'auto-rebaseline-temporary-branch'
-            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False, auth_refresh_token_json=None), [], self.tool)
+            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False), [], self.tool)
             self.assertEqual(self.tool.executive.calls, [
                 [['python', 'echo', 'optimize-baselines', '--no-modify-scm', '--suffixes', '', 'fast/dom/prototype-taco.html']],
                 ['git', 'cl', 'upload', '-f'],
@@ -1343,7 +1343,7 @@
 
             self.command.tree_status = lambda: 'open'
             webkitpy.tool.commands.rebaseline._get_branch_name_or_ref = lambda x: 'auto-rebaseline-alt-temporary-branch'
-            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False, auth_refresh_token_json=None), [], self.tool)
+            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False), [], self.tool)
             self.assertEqual(self.tool.executive.calls, [
                 [['python', 'echo', 'optimize-baselines', '--no-modify-scm', '--suffixes', '', 'fast/dom/prototype-taco.html']],
                 ['git', 'cl', 'upload', '-f'],
@@ -1358,69 +1358,6 @@
         finally:
             builders._exact_matches = old_exact_matches
 
-    def test_execute_with_rietveld_auth_refresh_token(self):
-        RIETVELD_REFRESH_TOKEN = '/creds/refresh_tokens/test_rietveld_token'
-
-        def blame(path):
-            return """
-6469e754a1 path/to/TestExpectations                   (<foobarbaz1@chromium.org> 2013-04-28 04:52:41 +0000   13) Bug(foo) fast/dom/prototype-taco.html [ NeedsRebaseline ]
-"""
-        self.tool.scm().blame = blame
-
-        test_port = self._setup_test_port()
-
-        old_builder_data = self.command.builder_data
-
-        def builder_data():
-            self.command._builder_data['MOCK Leopard'] = self.command._builder_data['MOCK SnowLeopard'] = LayoutTestResults.results_from_string("""ADD_RESULTS({
-    "tests": {
-        "fast": {
-            "dom": {
-                "prototype-taco.html": {
-                    "expected": "FAIL",
-                    "actual": "PASS",
-                    "is_unexpected": true
-                }
-            }
-        }
-    }
-});""")
-            return self.command._builder_data
-
-        self.command.builder_data = builder_data
-
-        self.tool.filesystem.write_text_file(test_port.path_to_generic_test_expectations_file(), """
-Bug(foo) fast/dom/prototype-taco.html [ NeedsRebaseline ]
-""")
-
-        self._write_test_file(test_port, 'fast/dom/prototype-taco.html', "Dummy test contents")
-
-        self.tool.executive = MockLineRemovingExecutive()
-
-        old_exact_matches = builders._exact_matches
-        try:
-            builders._exact_matches = {
-                "MOCK Leopard": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-                "MOCK SnowLeopard": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier"])},
-            }
-
-            self.command.tree_status = lambda: 'open'
-            self.command.execute(MockOptions(optimize=True, verbose=False, results_directory=False, auth_refresh_token_json=RIETVELD_REFRESH_TOKEN), [], self.tool)
-            self.assertEqual(self.tool.executive.calls, [
-                [['python', 'echo', 'optimize-baselines', '--no-modify-scm', '--suffixes', '', 'fast/dom/prototype-taco.html']],
-                ['git', 'cl', 'upload', '-f', '--auth-refresh-token-json', RIETVELD_REFRESH_TOKEN],
-                ['git', 'pull'],
-                ['git', 'cl', 'land', '-f', '-v', '--auth-refresh-token-json', RIETVELD_REFRESH_TOKEN],
-                ['git', 'config', 'branch.auto-rebaseline-temporary-branch.rietveldissue'],
-            ])
-
-            # The mac ports should both be removed since they're the only ones in builders._exact_matches.
-            self.assertEqual(self.tool.filesystem.read_text_file(test_port.path_to_generic_test_expectations_file()), """
-Bug(foo) [ Linux Win ] fast/dom/prototype-taco.html [ NeedsRebaseline ]
-""")
-        finally:
-            builders._exact_matches = old_exact_matches
-
 
 class TestRebaselineOMatic(_BaseTestCase):
     command_constructor = RebaselineOMatic
diff --git a/third_party/libjingle/README.chromium b/third_party/libjingle/README.chromium
index 92c49c6..115f69b95 100644
--- a/third_party/libjingle/README.chromium
+++ b/third_party/libjingle/README.chromium
@@ -1,7 +1,7 @@
 Name: libjingle
 URL: http://code.google.com/p/webrtc/
 Version: unknown
-Revision: 10372
+Revision: 10394
 License: BSD
 License File: source/talk/COPYING
 Security Critical: yes
diff --git a/tools/telemetry/telemetry/internal/backends/chrome_inspector/devtools_client_backend.py b/tools/telemetry/telemetry/internal/backends/chrome_inspector/devtools_client_backend.py
index 82953a2..6c80d22 100644
--- a/tools/telemetry/telemetry/internal/backends/chrome_inspector/devtools_client_backend.py
+++ b/tools/telemetry/telemetry/internal/backends/chrome_inspector/devtools_client_backend.py
@@ -173,12 +173,17 @@
     if self._memory_backend:
       self._memory_backend.Close()
       self._memory_backend = None
+
+    if self._devtools_context_map_backend:
+      self._devtools_context_map_backend.Clear()
+
     # Close the browser inspector socket last (in case the backend needs to
     # interact with it before closing).
     if self._browser_inspector_websocket:
       self._browser_inspector_websocket.Disconnect()
       self._browser_inspector_websocket = None
 
+
   @decorators.Cache
   def GetChromeBranchNumber(self):
     # Detect version information.
@@ -457,3 +462,9 @@
           continue
       valid_contexts.append(context)
     self._contexts = valid_contexts
+
+  def Clear(self):
+    for backend in self._inspector_backends_dict.values():
+      backend.Disconnect()
+    self._inspector_backends_dict = {}
+    self._contexts = None
diff --git a/tools/valgrind/memcheck/suppressions.txt b/tools/valgrind/memcheck/suppressions.txt
index 7b857127..d89435e9 100644
--- a/tools/valgrind/memcheck/suppressions.txt
+++ b/tools/valgrind/memcheck/suppressions.txt
@@ -792,7 +792,6 @@
    fun:_ZN7testing*PrintBytesInObjectTo*
    fun:_ZN7testing9internal220PrintBytesInObjectToEPKh*
    fun:_ZN7testing9internal220TypeWithoutFormatter*
-   fun:_ZN7testing9internal2lsIcSt11char_traitsIcE*
 }
 {
    bug_64887_b