diff --git a/DEPS b/DEPS
index 0ba25d1..fca9343 100644
--- a/DEPS
+++ b/DEPS
@@ -40,7 +40,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '1fcd10aae43302be86a0c1c42e7a5f085459640f',
+  'skia_revision': '42102420c02a525f57264c124ef941882d22c5a1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
diff --git a/base/trace_event/trace_event_argument.cc b/base/trace_event/trace_event_argument.cc
index 65965b1..c27a2f9e 100644
--- a/base/trace_event/trace_event_argument.cc
+++ b/base/trace_event/trace_event_argument.cc
@@ -6,11 +6,14 @@
 
 #include <stdint.h>
 
+#include <stack>
 #include <utility>
 
 #include "base/bits.h"
-#include "base/json/json_writer.h"
+#include "base/json/string_escape.h"
 #include "base/memory/ptr_util.h"
+#include "base/trace_event/common/trace_event_common.h"
+#include "base/trace_event/trace_event_impl.h"
 #include "base/trace_event/trace_event_memory_overhead.h"
 #include "base/values.h"
 
@@ -26,7 +29,7 @@
 const char kTypeInt = 'i';
 const char kTypeDouble = 'd';
 const char kTypeString = 's';
-const char kTypeCStr = '*';
+const char kTypeCStr = '*';  // only used for key names
 
 #ifndef NDEBUG
 const bool kStackTypeDict = false;
@@ -454,12 +457,100 @@
   DCHECK_CURRENT_CONTAINER_IS(kStackTypeDict);
   DCHECK_CONTAINER_STACK_DEPTH_EQ(1u);
 
-  // TODO(primiano): this could be smarter, skip the ToBaseValue encoding and
-  // produce the JSON on its own. This will require refactoring JSONWriter
-  // to decouple the base::Value traversal from the JSON writing bits
-  std::string tmp;
-  JSONWriter::Write(*ToBaseValue(), &tmp);
-  *out += tmp;
+  struct State {
+    enum Type { kTypeDict, kTypeArray };
+    Type type;
+    bool needs_comma;
+  };
+
+  auto maybe_append_key_name = [](State current_state, PickleIterator* it,
+                                  std::string* out) {
+    if (current_state.type == State::kTypeDict) {
+      EscapeJSONString(ReadKeyName(*it), true, out);
+      out->append(":");
+    }
+  };
+
+  std::stack<State> state_stack;
+
+  out->append("{");
+  state_stack.push({State::kTypeDict});
+
+  PickleIterator it(pickle_);
+  for (const char* type; it.ReadBytes(&type, 1);) {
+    switch (*type) {
+      case kTypeEndDict:
+        out->append("}");
+        state_stack.pop();
+        continue;
+
+      case kTypeEndArray:
+        out->append("]");
+        state_stack.pop();
+        continue;
+    }
+
+    State& current_state = state_stack.top();
+    if (current_state.needs_comma) {
+      out->append(",");
+    }
+
+    switch (*type) {
+      case kTypeStartDict:
+        maybe_append_key_name(current_state, &it, out);
+        out->append("{");
+        state_stack.push({State::kTypeDict});
+        break;
+
+      case kTypeStartArray:
+        maybe_append_key_name(current_state, &it, out);
+        out->append("[");
+        state_stack.push({State::kTypeArray});
+        break;
+
+      case kTypeBool: {
+        TraceEvent::TraceValue json_value;
+        CHECK(it.ReadBool(&json_value.as_bool));
+        maybe_append_key_name(current_state, &it, out);
+        TraceEvent::AppendValueAsJSON(TRACE_VALUE_TYPE_BOOL, json_value, out);
+      } break;
+
+      case kTypeInt: {
+        int value;
+        CHECK(it.ReadInt(&value));
+        maybe_append_key_name(current_state, &it, out);
+        TraceEvent::TraceValue json_value;
+        json_value.as_int = value;
+        TraceEvent::AppendValueAsJSON(TRACE_VALUE_TYPE_INT, json_value, out);
+      } break;
+
+      case kTypeDouble: {
+        TraceEvent::TraceValue json_value;
+        CHECK(it.ReadDouble(&json_value.as_double));
+        maybe_append_key_name(current_state, &it, out);
+        TraceEvent::AppendValueAsJSON(TRACE_VALUE_TYPE_DOUBLE, json_value, out);
+      } break;
+
+      case kTypeString: {
+        std::string value;
+        CHECK(it.ReadString(&value));
+        maybe_append_key_name(current_state, &it, out);
+        TraceEvent::TraceValue json_value;
+        json_value.as_string = value.c_str();
+        TraceEvent::AppendValueAsJSON(TRACE_VALUE_TYPE_STRING, json_value, out);
+      } break;
+
+      default:
+        NOTREACHED();
+    }
+
+    current_state.needs_comma = true;
+  }
+
+  out->append("}");
+  state_stack.pop();
+
+  DCHECK(state_stack.empty());
 }
 
 void TracedValue::EstimateTraceMemoryOverhead(
diff --git a/base/trace_event/trace_event_argument_unittest.cc b/base/trace_event/trace_event_argument_unittest.cc
index aef8441..e91bede2 100644
--- a/base/trace_event/trace_event_argument_unittest.cc
+++ b/base/trace_event/trace_event_argument_unittest.cc
@@ -17,9 +17,9 @@
 
 TEST(TraceEventArgumentTest, FlatDictionary) {
   std::unique_ptr<TracedValue> value(new TracedValue());
-  value->SetInteger("int", 2014);
-  value->SetDouble("double", 0.0);
   value->SetBoolean("bool", true);
+  value->SetDouble("double", 0.0);
+  value->SetInteger("int", 2014);
   value->SetString("string", "string");
   std::string json = "PREFIX";
   value->AppendAsTraceFormat(&json);
@@ -30,9 +30,9 @@
 
 TEST(TraceEventArgumentTest, NoDotPathExpansion) {
   std::unique_ptr<TracedValue> value(new TracedValue());
-  value->SetInteger("in.t", 2014);
-  value->SetDouble("doub.le", 0.0);
   value->SetBoolean("bo.ol", true);
+  value->SetDouble("doub.le", 0.0);
+  value->SetInteger("in.t", 2014);
   value->SetString("str.ing", "str.ing");
   std::string json;
   value->AppendAsTraceFormat(&json);
@@ -43,16 +43,6 @@
 
 TEST(TraceEventArgumentTest, Hierarchy) {
   std::unique_ptr<TracedValue> value(new TracedValue());
-  value->SetInteger("i0", 2014);
-  value->BeginDictionary("dict1");
-  value->SetInteger("i1", 2014);
-  value->BeginDictionary("dict2");
-  value->SetBoolean("b2", false);
-  value->EndDictionary();
-  value->SetString("s1", "foo");
-  value->EndDictionary();
-  value->SetDouble("d0", 0.0);
-  value->SetBoolean("b0", true);
   value->BeginArray("a1");
   value->AppendInteger(1);
   value->AppendBoolean(true);
@@ -60,6 +50,16 @@
   value->SetInteger("i2", 3);
   value->EndDictionary();
   value->EndArray();
+  value->SetBoolean("b0", true);
+  value->SetDouble("d0", 0.0);
+  value->BeginDictionary("dict1");
+  value->BeginDictionary("dict2");
+  value->SetBoolean("b2", false);
+  value->EndDictionary();
+  value->SetInteger("i1", 2014);
+  value->SetString("s1", "foo");
+  value->EndDictionary();
+  value->SetInteger("i0", 2014);
   value->SetString("s0", "foo");
   std::string json;
   value->AppendAsTraceFormat(&json);
diff --git a/cc/base/filter_operations_unittest.cc b/cc/base/filter_operations_unittest.cc
index 9eb852d..7094a8e 100644
--- a/cc/base/filter_operations_unittest.cc
+++ b/cc/base/filter_operations_unittest.cc
@@ -970,8 +970,8 @@
 
   filters.Append(FilterOperation::CreateSaturateFilter(3.f));
   filters.Append(FilterOperation::CreateBlurFilter(2.f));
-  EXPECT_EQ(std::string("{\"FilterOperations\":[{\"amount\":3.0,\"type\":2},"
-                        "{\"amount\":2.0,\"type\":8}]}"),
+  EXPECT_EQ(std::string("{\"FilterOperations\":[{\"type\":2,\"amount\":3.0},"
+                        "{\"type\":8,\"amount\":2.0}]}"),
             filters.ToString());
 }
 
diff --git a/chrome/browser/chromeos/arc/arc_service_launcher.cc b/chrome/browser/chromeos/arc/arc_service_launcher.cc
index decc9ea..79325b6 100644
--- a/chrome/browser/chromeos/arc/arc_service_launcher.cc
+++ b/chrome/browser/chromeos/arc/arc_service_launcher.cc
@@ -107,8 +107,6 @@
   arc_service_manager_->AddService(
       base::MakeUnique<ArcProcessService>(arc_bridge_service));
   arc_service_manager_->AddService(
-      base::MakeUnique<ArcProvisionNotificationService>(arc_bridge_service));
-  arc_service_manager_->AddService(
       base::MakeUnique<ArcSettingsService>(arc_bridge_service));
   arc_service_manager_->AddService(
       base::MakeUnique<ArcStorageManager>(arc_bridge_service));
@@ -191,6 +189,7 @@
   ArcObbMounterBridge::GetForBrowserContext(profile);
   ArcPowerBridge::GetForBrowserContext(profile);
   ArcPrintService::GetForBrowserContext(profile);
+  ArcProvisionNotificationService::GetForBrowserContext(profile);
 
   arc_service_manager_->AddService(base::MakeUnique<ArcBootPhaseMonitorBridge>(
       arc_service_manager_->arc_bridge_service(),
diff --git a/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.cc b/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.cc
index f0f4ce4..8415acd 100644
--- a/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.cc
+++ b/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.cc
@@ -8,10 +8,12 @@
 
 #include "ash/system/devicetype_utils.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/singleton.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/chromeos/arc/arc_util.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/grit/theme_resources.h"
+#include "components/arc/arc_browser_context_keyed_service_factory_base.h"
 #include "components/signin/core/account_id/account_id.h"
 #include "components/user_manager/user.h"
 #include "components/user_manager/user_manager.h"
@@ -69,36 +71,67 @@
       kManagedProvisionNotificationId, false);
 }
 
+// Singleton factory for ArcProvisionNotificationService.
+class ArcProvisionNotificationServiceFactory
+    : public internal::ArcBrowserContextKeyedServiceFactoryBase<
+          ArcProvisionNotificationService,
+          ArcProvisionNotificationServiceFactory> {
+ public:
+  // Factory name used by ArcBrowserContextKeyedServiceFactoryBase.
+  static constexpr const char* kName = "ArcProvisionNotificationServiceFactory";
+
+  static ArcProvisionNotificationServiceFactory* GetInstance() {
+    return base::Singleton<ArcProvisionNotificationServiceFactory>::get();
+  }
+
+ private:
+  friend base::DefaultSingletonTraits<ArcProvisionNotificationServiceFactory>;
+  ArcProvisionNotificationServiceFactory() = default;
+  ~ArcProvisionNotificationServiceFactory() override = default;
+};
+
 }  // namespace
 
 ArcProvisionNotificationService::Delegate::Delegate() = default;
 
 ArcProvisionNotificationService::Delegate::~Delegate() = default;
 
+// static
+ArcProvisionNotificationService*
+ArcProvisionNotificationService::GetForBrowserContext(
+    content::BrowserContext* context) {
+  return ArcProvisionNotificationServiceFactory::GetForBrowserContext(context);
+}
+
 ArcProvisionNotificationService::ArcProvisionNotificationService(
+    content::BrowserContext* context,
     ArcBridgeService* bridge_service)
-    : ArcProvisionNotificationService(bridge_service,
-                                      base::MakeUnique<DelegateImpl>()) {}
+    : ArcProvisionNotificationService(base::MakeUnique<DelegateImpl>()) {}
 
 ArcProvisionNotificationService::~ArcProvisionNotificationService() {
   // Make sure no notification is left being shown.
   delegate_->RemoveManagedProvisionNotification();
-  ArcSessionManager::Get()->RemoveObserver(this);
+
+  // TODO(hidehiko): Currently, the lifetime of ArcSessionManager and
+  // BrowserContextKeyedService is not nested.
+  // If ArcSessionManager::Get() returns nullptr, it is already destructed,
+  // so do not touch it.
+  auto* arc_session_manager = ArcSessionManager::Get();
+  if (arc_session_manager)
+    arc_session_manager->RemoveObserver(this);
 }
 
 // static
 std::unique_ptr<ArcProvisionNotificationService>
 ArcProvisionNotificationService::CreateForTesting(
-    ArcBridgeService* bridge_service,
     std::unique_ptr<Delegate> delegate) {
   return base::WrapUnique<ArcProvisionNotificationService>(
-      new ArcProvisionNotificationService(bridge_service, std::move(delegate)));
+      new ArcProvisionNotificationService(std::move(delegate)));
 }
 
 ArcProvisionNotificationService::ArcProvisionNotificationService(
-    ArcBridgeService* bridge_service,
     std::unique_ptr<Delegate> delegate)
-    : ArcService(bridge_service), delegate_(std::move(delegate)) {
+    : delegate_(std::move(delegate)) {
   ArcSessionManager::Get()->AddObserver(this);
 }
 
diff --git a/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.h b/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.h
index 2f2aa6fa..698620b8 100644
--- a/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.h
+++ b/chrome/browser/chromeos/arc/notification/arc_provision_notification_service.h
@@ -9,13 +9,17 @@
 
 #include "base/macros.h"
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
-#include "components/arc/arc_service.h"
+#include "components/keyed_service/core/keyed_service.h"
+
+namespace content {
+class BrowserContext;
+}  // namespace content
 
 namespace arc {
 
 // Watches for ARC provisioning status and displays a notification during
 // provision when ARC opt-in flow happens silently due to configured policies.
-class ArcProvisionNotificationService : public ArcService,
+class ArcProvisionNotificationService : public KeyedService,
                                         public ArcSessionManager::Observer {
  public:
   // The delegate whose methods are used by the service for showing/hiding the
@@ -31,21 +35,25 @@
     DISALLOW_COPY_AND_ASSIGN(Delegate);
   };
 
+  // Returns singleton instance for the given BrowserContext,
+  // or nullptr if the browser |context| is not allowed to use ARC.
+  static ArcProvisionNotificationService* GetForBrowserContext(
+      content::BrowserContext* context);
+
   // Constructs with the default delegate implementation that uses message
   // center for showing the notifications.
-  explicit ArcProvisionNotificationService(ArcBridgeService* bridge_service);
+  ArcProvisionNotificationService(content::BrowserContext* context,
+                                  ArcBridgeService* bridge_service);
 
   ~ArcProvisionNotificationService() override;
 
   // Constructs an instance with the supplied delegate.
   static std::unique_ptr<ArcProvisionNotificationService> CreateForTesting(
-      ArcBridgeService* bridge_service,
       std::unique_ptr<Delegate> delegate);
 
  private:
   // Constructs with the supplied delegate.
-  ArcProvisionNotificationService(ArcBridgeService* bridge_service,
-                                  std::unique_ptr<Delegate> delegate);
+  explicit ArcProvisionNotificationService(std::unique_ptr<Delegate> delegate);
 
   // ArcSessionManager::Observer:
   void OnArcPlayStoreEnabledChanged(bool enabled) override;
diff --git a/chrome/browser/chromeos/arc/notification/arc_provision_notification_service_unittest.cc b/chrome/browser/chromeos/arc/notification/arc_provision_notification_service_unittest.cc
index b5bbea1..5fc534c 100644
--- a/chrome/browser/chromeos/arc/notification/arc_provision_notification_service_unittest.cc
+++ b/chrome/browser/chromeos/arc/notification/arc_provision_notification_service_unittest.cc
@@ -21,7 +21,6 @@
 #include "chrome/test/base/testing_profile.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/fake_session_manager_client.h"
-#include "components/arc/arc_bridge_service.h"
 #include "components/arc/arc_service_manager.h"
 #include "components/arc/arc_util.h"
 #include "components/arc/test/fake_arc_session.h"
@@ -79,7 +78,6 @@
         mock_arc_provision_notification_service_delegate.get();
     arc_provision_notification_service_ =
         ArcProvisionNotificationService::CreateForTesting(
-            arc_bridge_service(),
             std::move(mock_arc_provision_notification_service_delegate));
 
     const AccountId account_id(AccountId::FromUserEmailGaiaId(
@@ -104,9 +102,6 @@
   ArcServiceManager* arc_service_manager() {
     return arc_service_manager_.get();
   }
-  ArcBridgeService* arc_bridge_service() {
-    return arc_service_manager_->arc_bridge_service();
-  }
   ArcSessionManager* arc_session_manager() {
     return arc_session_manager_.get();
   }
diff --git a/components/tracing/common/graphics_memory_dump_provider_android_unittest.cc b/components/tracing/common/graphics_memory_dump_provider_android_unittest.cc
index 5416b2c..ab00352 100644
--- a/components/tracing/common/graphics_memory_dump_provider_android_unittest.cc
+++ b/components/tracing/common/graphics_memory_dump_provider_android_unittest.cc
@@ -25,10 +25,10 @@
   std::string json;
   mad->attributes_for_testing()->AppendAsTraceFormat(&json);
   ASSERT_EQ(
-      "{\"memtrack_pss\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
-      "\"22\"},"
-      "\"memtrack_total\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
-      "\"c\"}}",
+      "{\"memtrack_total\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
+      "\"c\"},"
+      "\"memtrack_pss\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
+      "\"22\"}}",
       json);
 
   // Check the "gl" row.
@@ -37,10 +37,10 @@
   json = "";
   mad->attributes_for_testing()->AppendAsTraceFormat(&json);
   ASSERT_EQ(
-      "{\"memtrack_pss\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
-      "\"4e\"},"
-      "\"memtrack_total\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
-      "\"38\"}}",
+      "{\"memtrack_total\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
+      "\"38\"},"
+      "\"memtrack_pss\":{\"type\":\"scalar\",\"units\":\"bytes\",\"value\":"
+      "\"4e\"}}",
       json);
 
   // Test for truncated input.
diff --git a/testing/buildbot/gn_isolate_map.pyl b/testing/buildbot/gn_isolate_map.pyl
index 7ec3ea0..f5c36f8 100644
--- a/testing/buildbot/gn_isolate_map.pyl
+++ b/testing/buildbot/gn_isolate_map.pyl
@@ -873,6 +873,10 @@
     "label": "//android_webview:system_webview_apk",
     "type": "additional_compile_target",
   },
+  "system_webview_shell_layout_test_apk": {
+    "label": "//android_webview/tools/system_webview_shell:system_webview_shell_layout_test_apk",
+    "type": "console_test_launcher",
+  },
   "telemetry_gpu_integration_test": {
     "label": "//chrome/test:telemetry_gpu_integration_test",
     "type": "script",
@@ -1119,6 +1123,10 @@
     "label": "//android_webview/test:webview_instrumentation_test_apk",
     "type": "console_test_launcher",
   },
+  "webview_ui_test_app_test_apk": {
+    "label": "//android_webview/tools/automated_ui_tests:webview_ui_test_app_test_apk",
+    "type": "console_test_launcher",
+  },
   "wm_unittests": {
     "label": "//ui/wm:wm_unittests",
     "type": "windowed_test_launcher",
diff --git a/testing/buildbot/manage.py b/testing/buildbot/manage.py
index ec9c2edf..f8191af59 100755
--- a/testing/buildbot/manage.py
+++ b/testing/buildbot/manage.py
@@ -236,7 +236,8 @@
       raise Error('%s: %s is broken: %s' % (filename, builder, data))
     if ('gtest_tests' not in data and
         'isolated_scripts' not in data and
-        'additional_compile_targets' not in data):
+        'additional_compile_targets' not in data and
+        'instrumentation_tests' not in data):
       continue
 
     for d in data.get('junit_tests', []):
@@ -295,6 +296,15 @@
       elif name in ninja_targets:
         ninja_targets_seen.add(name)
 
+    for d in data.get('instrumentation_tests', []):
+      name = d['test']
+      if (name not in ninja_targets and
+          name not in SKIP_GN_ISOLATE_MAP_TARGETS):
+        raise Error('%s: %s / %s is not listed in gn_isolate_map.pyl.' %
+                    (filename, builder, name))
+      elif name in ninja_targets:
+        ninja_targets_seen.add(name)
+
     # The trick here is that process_builder_remaining() is called before
     # process_builder_convert() so tests_location can be used to know how many
     # tests were converted.