diff --git a/base/bind_unittest.nc b/base/bind_unittest.nc
index 24a345d2..e6b2534 100644
--- a/base/bind_unittest.nc
+++ b/base/bind_unittest.nc
@@ -203,7 +203,7 @@
   Closure callback_mismatches_bind_type = Bind(&VoidPolymorphic1<int>);
 }
 
-#elif defined(NCTEST_DISALLOW_CAPTURING_LAMBDA)  // [r"fatal error: implicit instantiation of undefined template 'base::internal::FunctorTraits<\(lambda at ../../base/bind_unittest.nc:[0-9]+:[0-9]+\), void>'"]
+#elif defined(NCTEST_DISALLOW_CAPTURING_LAMBDA)  // [r"fatal error: implicit instantiation of undefined template 'base::internal::FunctorTraits<\(lambda at (\.\./)+base/bind_unittest.nc:[0-9]+:[0-9]+\), void>'"]
 
 void WontCompile() {
   int i = 0;
diff --git a/base/numerics/safe_conversions_impl.h b/base/numerics/safe_conversions_impl.h
index 270d5916..75676e1 100644
--- a/base/numerics/safe_conversions_impl.h
+++ b/base/numerics/safe_conversions_impl.h
@@ -40,8 +40,8 @@
 template <typename T>
 constexpr bool HasSignBit(T x) {
   // Cast to unsigned since right shift on signed is undefined.
-  return !!(static_cast<typename std::make_unsigned<T>::type>(x) >>
-            PositionOfSignBit<T>::value);
+  return (static_cast<typename std::make_unsigned<T>::type>(x) >>
+          PositionOfSignBit<T>::value) != 0;
 }
 
 // This wrapper undoes the standard integer promotions.
@@ -80,22 +80,34 @@
       (static_cast<UnsignedT>(x) ^ -SignedT(is_negative)) + is_negative);
 }
 
-// This performs a safe, non-branching absolute value via unsigned overflow.
+// Wrapper for the sign mask used in the absolute value function.
 template <typename T>
-constexpr T SafeUnsignedAbsImpl(T value, T sign_mask) {
-  static_assert(!std::is_signed<T>::value, "Types must be unsigned.");
-  return (value ^ sign_mask) - sign_mask;
+constexpr T SignMask(T x) {
+  using SignedT = typename std::make_signed<T>::type;
+  // Right shift on a signed number is implementation defined, but it's often
+  // implemented as arithmetic shift. If the compiler uses an arithmetic shift,
+  // then use that to avoid the extra negation.
+  return static_cast<T>(
+      (static_cast<SignedT>(-1) >> PositionOfSignBit<T>::value) ==
+              static_cast<SignedT>(-1)
+          ? (static_cast<SignedT>(x) >> PositionOfSignBit<T>::value)
+          : -static_cast<SignedT>(HasSignBit(x)));
 }
+static_assert(SignMask(-2) == -1,
+              "Inconsistent handling of signed right shift.");
+static_assert(SignMask(-3L) == -1L,
+              "Inconsistent handling of signed right shift.");
+static_assert(SignMask(-4LL) == -1LL,
+              "Inconsistent handling of signed right shift.");
 
+// This performs a safe, non-branching absolute value via unsigned overflow.
 template <typename T,
           typename std::enable_if<std::is_integral<T>::value &&
                                   std::is_signed<T>::value>::type* = nullptr>
 constexpr typename std::make_unsigned<T>::type SafeUnsignedAbs(T value) {
   using UnsignedT = typename std::make_unsigned<T>::type;
-  return SafeUnsignedAbsImpl(
-      static_cast<UnsignedT>(value),
-      // The sign mask is all ones for negative and zero otherwise.
-      static_cast<UnsignedT>(-static_cast<T>(HasSignBit(value))));
+  return static_cast<T>(static_cast<UnsignedT>(value ^ SignMask(value)) -
+                        static_cast<UnsignedT>(SignMask(value)));
 }
 
 template <typename T,
diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
index 76ac515..c088556a1 100644
--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
@@ -833,11 +833,15 @@
 config("default_warnings") {
   cflags = []
   cflags_cc = []
+  ldflags = []
 
   if (is_win) {
     if (treat_warnings_as_errors) {
       cflags += [ "/WX" ]
     }
+    if (fatal_linker_warnings) {
+      ldflags += [ "/WX" ]
+    }
 
     cflags += [
       # Assume UTF-8 by default to avoid code page dependencies.
diff --git a/build/config/win/BUILD.gn b/build/config/win/BUILD.gn
index 3da27470..b1cb7246 100644
--- a/build/config/win/BUILD.gn
+++ b/build/config/win/BUILD.gn
@@ -238,17 +238,13 @@
 # their own.
 config("common_linker_setup") {
   ldflags = [
+    "/fastfail",
     "/FIXED:NO",
     "/ignore:4199",
     "/ignore:4221",
     "/NXCOMPAT",
   ]
 
-  ldflags += [
-    # Tell the linker to crash on failures.
-    "/fastfail",
-  ]
-
   # ASLR makes debugging with windbg difficult because Chrome.exe and
   # Chrome.dll share the same base name. As result, windbg will name the
   # Chrome.dll module like chrome_<base address>, where <base address>
diff --git a/chrome/VERSION b/chrome/VERSION
index d9bd8fe3..082d2a67 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=57
 MINOR=0
-BUILD=2960
+BUILD=2961
 PATCH=0
diff --git a/chrome/app/chromeos_strings.grdp b/chrome/app/chromeos_strings.grdp
index 149ac6a5..8c4254be 100644
--- a/chrome/app/chromeos_strings.grdp
+++ b/chrome/app/chromeos_strings.grdp
@@ -5562,6 +5562,9 @@
   <message name="IDS_DEVICE_OWNED_BY_NOTICE" desc="Text for notifications showing that this is managed device.">
     This device is managed by <ph name="DOMAIN">$1<ex>acmecorp.com</ex></ph>.
   </message>
+  <message name="IDS_DEVICE_ENTERPRISE_MANAGED_NOTICE" desc="Text for notifications showing that this device is enterprise managed.">
+    This device is enterprise managed
+  </message>
   <message name="IDS_LOGIN_PUBLIC_ACCOUNT_INFO_FORMAT" desc="Template for text shown in the public account user pod, informing the user that this is a public, managed account.">
     Managed by <ph name="DOMAIN">$1<ex>yourdomain.com</ex></ph>
   </message>
diff --git a/chrome/browser/chrome_content_utility_manifest_overlay.json b/chrome/browser/chrome_content_utility_manifest_overlay.json
index f192f786..333b9e2 100644
--- a/chrome/browser/chrome_content_utility_manifest_overlay.json
+++ b/chrome/browser/chrome_content_utility_manifest_overlay.json
@@ -4,6 +4,7 @@
     "service_manager:connector": {
       "provides": {
         "browser": [
+          "chrome::mojom::FilePatcher",
           "chrome::mojom::ProfileImport",
           "chrome::mojom::ResourceUsageReporter",
           "chrome::mojom::ShellHandler",
diff --git a/chrome/browser/chromeos/input_method/input_method_engine_unittest.cc b/chrome/browser/chromeos/input_method/input_method_engine_unittest.cc
index f2f2391..2cea3b75 100644
--- a/chrome/browser/chromeos/input_method/input_method_engine_unittest.cc
+++ b/chrome/browser/chromeos/input_method/input_method_engine_unittest.cc
@@ -106,6 +106,7 @@
                                 int cursor_pos,
                                 int anchor_pos,
                                 int offset) override {}
+  void OnRequestEngineSwitch() override {}
   void OnCompositionBoundsChanged(
       const std::vector<gfx::Rect>& bounds) override {
     calls_bitmap_ |= ONCOMPOSITIONBOUNDSCHANGED;
diff --git a/chrome/browser/chromeos/input_method/mock_input_method_engine.cc b/chrome/browser/chromeos/input_method/mock_input_method_engine.cc
index 42d8823b..7efb6750 100644
--- a/chrome/browser/chromeos/input_method/mock_input_method_engine.cc
+++ b/chrome/browser/chromeos/input_method/mock_input_method_engine.cc
@@ -71,6 +71,8 @@
 
 void MockInputMethodEngine::Reset() {}
 
+void MockInputMethodEngine::MaybeSwitchEngine() {}
+
 bool MockInputMethodEngine::IsInterestedInKeyEvent() const {
   return true;
 }
diff --git a/chrome/browser/chromeos/input_method/mock_input_method_engine.h b/chrome/browser/chromeos/input_method/mock_input_method_engine.h
index 65909633..3a38cea6 100644
--- a/chrome/browser/chromeos/input_method/mock_input_method_engine.h
+++ b/chrome/browser/chromeos/input_method/mock_input_method_engine.h
@@ -50,6 +50,7 @@
   void Disable() override;
   void PropertyActivate(const std::string& property_name) override;
   void Reset() override;
+  void MaybeSwitchEngine() override;
   bool IsInterestedInKeyEvent() const override;
   void ProcessKeyEvent(const ui::KeyEvent& key_event,
                        KeyEventDoneCallback& callback) override;
diff --git a/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc b/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc
index 27d2795f..fc5f152 100644
--- a/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc
+++ b/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc
@@ -4,95 +4,20 @@
 
 #include "chrome/browser/component_updater/component_patcher_operation_out_of_process.h"
 
-#include <memory>
-#include <vector>
-
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/files/file.h"
 #include "base/files/file_path.h"
-#include "base/location.h"
-#include "base/single_thread_task_runner.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "chrome/common/chrome_utility_messages.h"
+#include "base/sequenced_task_runner.h"
+#include "base/strings/string16.h"
 #include "chrome/grit/generated_resources.h"
-#include "components/component_updater/component_updater_service.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/utility_process_host.h"
-#include "content/public/browser/utility_process_host_client.h"
-#include "courgette/courgette.h"
-#include "courgette/third_party/bsdiff/bsdiff.h"
-#include "ipc/ipc_message_macros.h"
 #include "ui/base/l10n/l10n_util.h"
 
 namespace component_updater {
 
-class PatchHost : public content::UtilityProcessHostClient {
- public:
-  PatchHost(base::Callback<void(int result)> callback,
-            scoped_refptr<base::SequencedTaskRunner> task_runner);
+ChromeOutOfProcessPatcher::ChromeOutOfProcessPatcher() = default;
 
-  void StartProcess(std::unique_ptr<IPC::Message> message);
-
- private:
-  ~PatchHost() override;
-
-  void OnPatchFinished(int result);
-
-  // Overrides of content::UtilityProcessHostClient.
-  bool OnMessageReceived(const IPC::Message& message) override;
-
-  void OnProcessCrashed(int exit_code) override;
-
-  base::Callback<void(int result)> callback_;
-  scoped_refptr<base::SequencedTaskRunner> task_runner_;
-};
-
-PatchHost::PatchHost(base::Callback<void(int result)> callback,
-                     scoped_refptr<base::SequencedTaskRunner> task_runner)
-    : callback_(callback), task_runner_(task_runner) {
-}
-
-PatchHost::~PatchHost() {
-}
-
-void PatchHost::StartProcess(std::unique_ptr<IPC::Message> message) {
-  // The DeltaUpdateOpPatchHost is not responsible for deleting the
-  // UtilityProcessHost object.
-  content::UtilityProcessHost* host = content::UtilityProcessHost::Create(
-      this, base::ThreadTaskRunnerHandle::Get().get());
-  host->SetName(l10n_util::GetStringUTF16(
-      IDS_UTILITY_PROCESS_COMPONENT_PATCHER_NAME));
-  host->Send(message.release());
-}
-
-bool PatchHost::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(PatchHost, message)
-  IPC_MESSAGE_HANDLER(ChromeUtilityHostMsg_PatchFile_Finished, OnPatchFinished)
-  IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void PatchHost::OnPatchFinished(int result) {
-  if (task_runner_.get()) {
-    task_runner_->PostTask(FROM_HERE, base::Bind(callback_, result));
-    task_runner_ = NULL;
-  }
-}
-
-void PatchHost::OnProcessCrashed(int exit_code) {
-  if (task_runner_.get()) {
-    task_runner_->PostTask(FROM_HERE, base::Bind(callback_, -1));
-    task_runner_ = NULL;
-  }
-}
-
-ChromeOutOfProcessPatcher::ChromeOutOfProcessPatcher() {
-}
-
-ChromeOutOfProcessPatcher::~ChromeOutOfProcessPatcher() {
-}
+ChromeOutOfProcessPatcher::~ChromeOutOfProcessPatcher() = default;
 
 void ChromeOutOfProcessPatcher::Patch(
     const std::string& operation,
@@ -101,35 +26,50 @@
     const base::FilePath& patch_abs_path,
     const base::FilePath& output_abs_path,
     base::Callback<void(int result)> callback) {
-  host_ = new PatchHost(callback, task_runner);
-  IPC::PlatformFileForTransit input = IPC::TakePlatformFileForTransit(
-      base::File(
-          input_abs_path, base::File::FLAG_OPEN | base::File::FLAG_READ));
-  IPC::PlatformFileForTransit patch = IPC::TakePlatformFileForTransit(
-      base::File(
-          patch_abs_path, base::File::FLAG_OPEN | base::File::FLAG_READ));
-  IPC::PlatformFileForTransit output = IPC::TakePlatformFileForTransit(
-      base::File(
-          output_abs_path,
-          base::File::FLAG_CREATE |
-              base::File::FLAG_WRITE |
-              base::File::FLAG_EXCLUSIVE_WRITE));
-  std::unique_ptr<IPC::Message> patch_message;
+  DCHECK(task_runner);
+  DCHECK(!input_abs_path.empty());
+  DCHECK(!patch_abs_path.empty());
+  DCHECK(!output_abs_path.empty());
+  DCHECK(!utility_process_mojo_client_);
+
+  task_runner_ = std::move(task_runner);
+  callback_ = callback;
+
+  base::File input_file(input_abs_path,
+                        base::File::FLAG_OPEN | base::File::FLAG_READ);
+  base::File patch_file(patch_abs_path,
+                        base::File::FLAG_OPEN | base::File::FLAG_READ);
+  base::File output_file(output_abs_path, base::File::FLAG_CREATE |
+                                              base::File::FLAG_WRITE |
+                                              base::File::FLAG_EXCLUSIVE_WRITE);
+
+  const base::string16 utility_process_name =
+      l10n_util::GetStringUTF16(IDS_UTILITY_PROCESS_COMPONENT_PATCHER_NAME);
+
+  utility_process_mojo_client_.reset(
+      new content::UtilityProcessMojoClient<chrome::mojom::FilePatcher>(
+          utility_process_name));
+  utility_process_mojo_client_->set_error_callback(
+      base::Bind(&ChromeOutOfProcessPatcher::PatchDone, this, -1));
+
+  utility_process_mojo_client_->Start();  // Start the utility process.
+
   if (operation == update_client::kBsdiff) {
-    patch_message.reset(new ChromeUtilityMsg_PatchFileBsdiff(
-        input, patch, output));
+    utility_process_mojo_client_->service()->PatchFileBsdiff(
+        std::move(input_file), std::move(patch_file), std::move(output_file),
+        base::Bind(&ChromeOutOfProcessPatcher::PatchDone, this));
   } else if (operation == update_client::kCourgette) {
-    patch_message.reset(new ChromeUtilityMsg_PatchFileCourgette(
-        input, patch, output));
+    utility_process_mojo_client_->service()->PatchFileCourgette(
+        std::move(input_file), std::move(patch_file), std::move(output_file),
+        base::Bind(&ChromeOutOfProcessPatcher::PatchDone, this));
   } else {
     NOTREACHED();
   }
+}
 
-  content::BrowserThread::PostTask(
-      content::BrowserThread::IO,
-      FROM_HERE,
-      base::Bind(
-          &PatchHost::StartProcess, host_, base::Passed(&patch_message)));
+void ChromeOutOfProcessPatcher::PatchDone(int result) {
+  utility_process_mojo_client_.reset();  // Terminate the utility process.
+  task_runner_->PostTask(FROM_HERE, base::Bind(callback_, result));
 }
 
 }  // namespace component_updater
diff --git a/chrome/browser/component_updater/component_patcher_operation_out_of_process.h b/chrome/browser/component_updater/component_patcher_operation_out_of_process.h
index 5500193..92789c18 100644
--- a/chrome/browser/component_updater/component_patcher_operation_out_of_process.h
+++ b/chrome/browser/component_updater/component_patcher_operation_out_of_process.h
@@ -10,7 +10,9 @@
 #include "base/callback_forward.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "chrome/common/file_patcher.mojom.h"
 #include "components/update_client/component_patcher_operation.h"
+#include "content/public/browser/utility_process_mojo_client.h"
 
 namespace base {
 class FilePath;
@@ -19,14 +21,11 @@
 
 namespace component_updater {
 
-class PatchHost;
-
-// Implements the DeltaUpdateOpPatch out-of-process patching.
 class ChromeOutOfProcessPatcher : public update_client::OutOfProcessPatcher {
  public:
   ChromeOutOfProcessPatcher();
 
-  // DeltaUpdateOpPatch::OutOfProcessPatcher implementation.
+  // update_client::OutOfProcessPatcher:
   void Patch(const std::string& operation,
              scoped_refptr<base::SequencedTaskRunner> task_runner,
              const base::FilePath& input_abs_path,
@@ -37,7 +36,16 @@
  private:
   ~ChromeOutOfProcessPatcher() override;
 
-  scoped_refptr<PatchHost> host_;
+  // Patch() request operation result.
+  void PatchDone(int result);
+
+  // Used to signal the operation result back to the Patch() requester.
+  scoped_refptr<base::SequencedTaskRunner> task_runner_;
+  base::Callback<void(int result)> callback_;
+
+  // Utility process used for out-of-process file patching.
+  std::unique_ptr<content::UtilityProcessMojoClient<chrome::mojom::FilePatcher>>
+      utility_process_mojo_client_;
 
   DISALLOW_COPY_AND_ASSIGN(ChromeOutOfProcessPatcher);
 };
diff --git a/chrome/browser/component_updater/component_patcher_operation_out_of_process_browsertest.cc b/chrome/browser/component_updater/component_patcher_operation_out_of_process_browsertest.cc
new file mode 100644
index 0000000..d27a4507
--- /dev/null
+++ b/chrome/browser/component_updater/component_patcher_operation_out_of_process_browsertest.cc
@@ -0,0 +1,143 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/base_paths.h"
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/files/file.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/macros.h"
+#include "base/path_service.h"
+#include "base/run_loop.h"
+#include "base/single_thread_task_runner.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "chrome/browser/component_updater/component_patcher_operation_out_of_process.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "components/update_client/component_patcher_operation.h"
+#include "content/public/browser/browser_thread.h"
+#include "courgette/courgette.h"
+#include "courgette/third_party/bsdiff/bsdiff.h"
+
+class OutOfProcessPatchTest : public InProcessBrowserTest {
+ public:
+  OutOfProcessPatchTest() {
+    EXPECT_TRUE(installed_dir_.CreateUniqueTempDir());
+    EXPECT_TRUE(input_dir_.CreateUniqueTempDir());
+    EXPECT_TRUE(unpack_dir_.CreateUniqueTempDir());
+  }
+
+  static base::FilePath test_file(const char* name) {
+    base::FilePath path;
+    PathService::Get(base::DIR_SOURCE_ROOT, &path);
+    return path.AppendASCII("components")
+        .AppendASCII("test")
+        .AppendASCII("data")
+        .AppendASCII("update_client")
+        .AppendASCII(name);
+  }
+
+  base::FilePath InputFilePath(const char* name) {
+    base::FilePath file = installed_dir_.GetPath().AppendASCII(name);
+
+    base::RunLoop run_loop;
+    content::BrowserThread::PostBlockingPoolTaskAndReply(
+        FROM_HERE,
+        base::Bind(&OutOfProcessPatchTest::CopyFile, test_file(name), file),
+        run_loop.QuitClosure());
+
+    run_loop.Run();
+    return file;
+  }
+
+  base::FilePath PatchFilePath(const char* name) {
+    base::FilePath file = input_dir_.GetPath().AppendASCII(name);
+
+    base::RunLoop run_loop;
+    content::BrowserThread::PostBlockingPoolTaskAndReply(
+        FROM_HERE,
+        base::Bind(&OutOfProcessPatchTest::CopyFile, test_file(name), file),
+        run_loop.QuitClosure());
+
+    run_loop.Run();
+    return file;
+  }
+
+  base::FilePath OutputFilePath(const char* name) {
+    base::FilePath file = unpack_dir_.GetPath().AppendASCII(name);
+    return file;
+  }
+
+  void RunPatchTest(const std::string& operation,
+                    const base::FilePath& input_file,
+                    const base::FilePath& patch_file,
+                    const base::FilePath& output_file,
+                    int expected_result) {
+    scoped_refptr<base::SequencedTaskRunner> task_runner =
+        base::ThreadTaskRunnerHandle::Get();
+
+    scoped_refptr<update_client::OutOfProcessPatcher> patcher =
+        make_scoped_refptr(new component_updater::ChromeOutOfProcessPatcher);
+
+    base::RunLoop run_loop;
+    patch_done_called_ = false;
+    patcher->Patch(
+        operation, task_runner, input_file, patch_file, output_file,
+        base::Bind(&OutOfProcessPatchTest::PatchDone, base::Unretained(this),
+                   run_loop.QuitClosure(), expected_result));
+
+    run_loop.Run();
+    EXPECT_TRUE(patch_done_called_);
+  }
+
+ private:
+  void PatchDone(const base::Closure& quit_closure, int expected, int result) {
+    EXPECT_EQ(expected, result);
+    patch_done_called_ = true;
+    quit_closure.Run();
+  }
+
+  static void CopyFile(const base::FilePath& source,
+                       const base::FilePath& target) {
+    EXPECT_TRUE(base::CopyFile(source, target));
+  }
+
+  base::ScopedTempDir installed_dir_;
+  base::ScopedTempDir input_dir_;
+  base::ScopedTempDir unpack_dir_;
+  bool patch_done_called_;
+
+  DISALLOW_COPY_AND_ASSIGN(OutOfProcessPatchTest);
+};
+
+// TODO(noel): Add a test where one or more of the files can't be opened.
+
+// Verify that a 'courgette' delta update operation works correctly.
+IN_PROC_BROWSER_TEST_F(OutOfProcessPatchTest, CheckCourgetteOperation) {
+  const int kExpectedResult = courgette::C_OK;
+
+  base::FilePath input_file = InputFilePath("binary_input.bin");
+  base::FilePath patch_file = PatchFilePath("binary_courgette_patch.bin");
+  base::FilePath output_file = OutputFilePath("output.bin");
+
+  RunPatchTest(update_client::kCourgette, input_file, patch_file, output_file,
+               kExpectedResult);
+
+  EXPECT_TRUE(base::ContentsEqual(test_file("binary_output.bin"), output_file));
+}
+
+// Verify that a 'bsdiff' delta update operation works correctly.
+IN_PROC_BROWSER_TEST_F(OutOfProcessPatchTest, CheckBsdiffOperation) {
+  const int kExpectedResult = bsdiff::OK;
+
+  base::FilePath input_file = InputFilePath("binary_input.bin");
+  base::FilePath patch_file = PatchFilePath("binary_bsdiff_patch.bin");
+  base::FilePath output_file = OutputFilePath("output.bin");
+
+  RunPatchTest(update_client::kBsdiff, input_file, patch_file, output_file,
+               kExpectedResult);
+
+  EXPECT_TRUE(base::ContentsEqual(test_file("binary_output.bin"), output_file));
+}
diff --git a/chrome/browser/extensions/api/input_ime/input_ime_api.h b/chrome/browser/extensions/api/input_ime/input_ime_api.h
index 2b2f81be..a4b849d 100644
--- a/chrome/browser/extensions/api/input_ime/input_ime_api.h
+++ b/chrome/browser/extensions/api/input_ime/input_ime_api.h
@@ -65,6 +65,7 @@
                                 int cursor_pos,
                                 int anchor_pos,
                                 int offset_pos) override;
+  void OnRequestEngineSwitch() override {};
 
  protected:
   // Helper function used to forward the given event to the |profile_|'s event
diff --git a/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.cc b/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.cc
index 8d8778b..29a9791e 100644
--- a/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.cc
+++ b/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.cc
@@ -91,6 +91,17 @@
         OnCompositionBoundsChanged::kEventName, std::move(args));
   }
 
+  void OnRequestEngineSwitch() override {
+    Browser* browser = chrome::FindLastActive();
+    if (!browser)
+      return;
+    extensions::InputImeEventRouter* router =
+        extensions::GetInputImeEventRouter(browser->profile());
+    if (!router)
+      return;
+    ui::IMEBridge::Get()->SetCurrentEngineHandler(router->active_engine());
+  }
+
  private:
   // ImeObserver overrides.
   void DispatchEventToExtension(
diff --git a/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.h b/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.h
index 011015e..da76c46 100644
--- a/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.h
+++ b/chrome/browser/extensions/api/input_ime/input_ime_api_nonchromeos.h
@@ -41,6 +41,10 @@
   // previous engine if another extension was active.
   void SetActiveEngine(const std::string& extension_id);
 
+  input_method::InputMethodEngine* active_engine() {
+    return active_engine_;
+  }
+
   // Deletes the current input method engine of the specific extension.
   void DeleteInputMethodEngine(const std::string& extension_id);
 
diff --git a/chrome/browser/password_manager/credential_manager_browsertest.cc b/chrome/browser/password_manager/credential_manager_browsertest.cc
index e0cd9cc..f7d3a22 100644
--- a/chrome/browser/password_manager/credential_manager_browsertest.cc
+++ b/chrome/browser/password_manager/credential_manager_browsertest.cc
@@ -3,17 +3,23 @@
 // found in the LICENSE file.
 
 #include "base/macros.h"
+#include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/password_manager/password_manager_test_base.h"
 #include "chrome/browser/password_manager/password_store_factory.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/profiles/profile_io_data.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/passwords/passwords_model_delegate.h"
+#include "chrome/test/base/ui_test_utils.h"
 #include "components/password_manager/core/browser/password_bubble_experiment.h"
 #include "components/password_manager/core/browser/password_store_consumer.h"
 #include "components/password_manager/core/browser/test_password_store.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
+#include "net/cert/cert_verify_result.h"
+#include "net/cert/mock_cert_verifier.h"
+#include "net/dns/mock_host_resolver.h"
 
 namespace {
 
@@ -59,8 +65,33 @@
     syncer.Wait();
   }
 
- private:
+  // Similarly to PasswordManagerBrowserTestBase::NavigateToFile this is a
+  // wrapper around ui_test_utils::NavigateURL that waits until DidFinishLoad()
+  // fires. Different to NavigateToFile this method allows passing a test_server
+  // and modifications to the hostname.
+  void NavigateToURL(const net::EmbeddedTestServer& test_server,
+                     const std::string& hostname,
+                     const std::string& relative_url) {
+    NavigationObserver observer(WebContents());
+    GURL url = test_server.GetURL(hostname, relative_url);
+    ui_test_utils::NavigateToURL(browser(), url);
+    observer.Wait();
+  }
 
+  void SetUpInProcessBrowserTestFixture() override {
+    ProfileIOData::SetCertVerifierForTesting(&mock_cert_verifier_);
+  }
+
+  void TearDownInProcessBrowserTestFixture() override {
+    ProfileIOData::SetCertVerifierForTesting(nullptr);
+  }
+
+  net::MockCertVerifier& mock_cert_verifier() {
+    return mock_cert_verifier_;
+  }
+
+ private:
+  net::MockCertVerifier mock_cert_verifier_;
   DISALLOW_COPY_AND_ASSIGN(CredentialManagerBrowserTest);
 };
 
@@ -119,6 +150,83 @@
   EXPECT_FALSE(form.skip_zero_click);
 }
 
+IN_PROC_BROWSER_TEST_F(CredentialManagerBrowserTest,
+                       StoreSavesPSLMatchedCredential) {
+  // Setup HTTPS server serving files from standard test directory.
+  static constexpr base::FilePath::CharType kDocRoot[] =
+      FILE_PATH_LITERAL("chrome/test/data");
+  net::EmbeddedTestServer https_test_server(
+      net::EmbeddedTestServer::TYPE_HTTPS);
+  https_test_server.ServeFilesFromSourceDirectory(base::FilePath(kDocRoot));
+  ASSERT_TRUE(https_test_server.Start());
+
+  // Setup mock certificate for all origins.
+  auto cert = https_test_server.GetCertificate();
+  net::CertVerifyResult verify_result;
+  verify_result.cert_status = 0;
+  verify_result.is_issued_by_known_root = true;
+  verify_result.verified_cert = cert;
+  mock_cert_verifier().AddResultForCert(cert.get(), verify_result, net::OK);
+
+  // Redirect all requests to localhost.
+  host_resolver()->AddRule("*", "127.0.0.1");
+
+  scoped_refptr<password_manager::TestPasswordStore> password_store =
+      static_cast<password_manager::TestPasswordStore*>(
+          PasswordStoreFactory::GetForProfile(
+              browser()->profile(), ServiceAccessType::IMPLICIT_ACCESS)
+              .get());
+
+  // The call to |GetURL| is needed to get the correct port.
+  GURL psl_url = https_test_server.GetURL("psl.example.com", "/");
+
+  autofill::PasswordForm signin_form;
+  signin_form.signon_realm = psl_url.spec();
+  signin_form.password_value = base::ASCIIToUTF16("password");
+  signin_form.username_value = base::ASCIIToUTF16("user");
+  signin_form.origin = psl_url;
+  password_store->AddLogin(signin_form);
+
+  NavigateToURL(https_test_server, "www.example.com",
+                "/password/password_form.html");
+
+  // Call the API to trigger |get| and |store| and redirect.
+  ASSERT_TRUE(
+      content::ExecuteScript(RenderViewHost(),
+                             "navigator.credentials.get({password: true})"
+                             ".then(cred => "
+                             "navigator.credentials.store(cred)"
+                             ".then(cred => "
+                             "window.location = '/password/done.html'))"));
+
+  WaitForPasswordStore();
+  ASSERT_EQ(password_manager::ui::CREDENTIAL_REQUEST_STATE,
+            PasswordsModelDelegateFromWebContents(WebContents())->GetState());
+  PasswordsModelDelegateFromWebContents(WebContents())
+      ->ChooseCredential(
+          signin_form,
+          password_manager::CredentialType::CREDENTIAL_TYPE_PASSWORD);
+
+  NavigationObserver observer(WebContents());
+  observer.SetPathToWaitFor("/password/done.html");
+  observer.Wait();
+
+  // Wait for the password store before checking the prompt because it pops up
+  // after the store replies.
+  WaitForPasswordStore();
+  std::unique_ptr<BubbleObserver> prompt_observer(
+      new BubbleObserver(WebContents()));
+  EXPECT_FALSE(prompt_observer->IsShowingSavePrompt());
+  EXPECT_FALSE(prompt_observer->IsShowingUpdatePrompt());
+
+  // There should be an entry for both psl.example.com and www.example.com.
+  password_manager::TestPasswordStore::PasswordMap passwords =
+      password_store->stored_passwords();
+  GURL www_url = https_test_server.GetURL("www.example.com", "/");
+  EXPECT_EQ(2U, passwords.size());
+  EXPECT_TRUE(base::ContainsKey(passwords, psl_url.spec()));
+  EXPECT_TRUE(base::ContainsKey(passwords, www_url.spec()));
+}
 
 IN_PROC_BROWSER_TEST_F(CredentialManagerBrowserTest,
                        AutoSigninOldCredentialAndNavigation) {
diff --git a/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc b/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
index 2e3eb6a..a0f3f5c 100644
--- a/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
+++ b/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
@@ -254,16 +254,9 @@
   return enterprise_domain_;
 }
 
-std::string SystemTrayDelegateChromeOS::GetEnterpriseRealm() const {
-  return enterprise_realm_;
-}
-
 base::string16 SystemTrayDelegateChromeOS::GetEnterpriseMessage() const {
-  if (!GetEnterpriseRealm().empty()) {
-    // TODO(rsorokin): Maybe change a message for the Active Directory devices.
-    return l10n_util::GetStringFUTF16(IDS_DEVICE_OWNED_BY_NOTICE,
-                                      base::UTF8ToUTF16(GetEnterpriseRealm()));
-  }
+  if (is_active_directory_managed_)
+    return l10n_util::GetStringUTF16(IDS_DEVICE_ENTERPRISE_MANAGED_NOTICE);
   if (!GetEnterpriseDomain().empty()) {
     return l10n_util::GetStringFUTF16(IDS_DEVICE_OWNED_BY_NOTICE,
                                       base::UTF8ToUTF16(GetEnterpriseDomain()));
@@ -870,12 +863,13 @@
 void SystemTrayDelegateChromeOS::UpdateEnterpriseDomain() {
   policy::BrowserPolicyConnectorChromeOS* connector =
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
-  std::string enterprise_domain = connector->GetEnterpriseDomain();
-  std::string enterprise_realm = connector->GetRealm();
-  if (enterprise_domain_ != enterprise_domain ||
-      enterprise_realm_ != enterprise_realm) {
-    enterprise_domain_ = enterprise_domain;
-    enterprise_realm_ = enterprise_realm;
+  std::string old_enterprise_domain(std::move(enterprise_domain_));
+  enterprise_domain_ = connector->GetEnterpriseDomain();
+  bool old_is_active_directory_managed = is_active_directory_managed_;
+  is_active_directory_managed_ = connector->IsActiveDirectoryManaged();
+  if ((!is_active_directory_managed_ &&
+       enterprise_domain_ != old_enterprise_domain) ||
+      (is_active_directory_managed_ != old_is_active_directory_managed)) {
     GetSystemTrayNotifier()->NotifyEnterpriseDomainChanged();
   }
 }
diff --git a/chrome/browser/ui/ash/system_tray_delegate_chromeos.h b/chrome/browser/ui/ash/system_tray_delegate_chromeos.h
index 668fd0f..b2276f6 100644
--- a/chrome/browser/ui/ash/system_tray_delegate_chromeos.h
+++ b/chrome/browser/ui/ash/system_tray_delegate_chromeos.h
@@ -78,7 +78,6 @@
   void Initialize() override;
   ash::LoginStatus GetUserLoginStatus() const override;
   std::string GetEnterpriseDomain() const override;
-  std::string GetEnterpriseRealm() const override;
   base::string16 GetEnterpriseMessage() const override;
   std::string GetSupervisedUserManager() const override;
   base::string16 GetSupervisedUserManagerName() const override;
@@ -235,7 +234,7 @@
   bool have_session_length_limit_ = false;
   base::TimeDelta session_length_limit_;
   std::string enterprise_domain_;
-  std::string enterprise_realm_;
+  bool is_active_directory_managed_ = false;
   bool should_run_bluetooth_discovery_ = false;
   bool session_started_ = false;
 
diff --git a/chrome/browser/ui/input_method/input_method_engine_base.cc b/chrome/browser/ui/input_method/input_method_engine_base.cc
index 64ce74d..e28670bd 100644
--- a/chrome/browser/ui/input_method/input_method_engine_base.cc
+++ b/chrome/browser/ui/input_method/input_method_engine_base.cc
@@ -348,6 +348,10 @@
   observer_->OnReset(active_component_id_);
 }
 
+void InputMethodEngineBase::MaybeSwitchEngine() {
+  observer_->OnRequestEngineSwitch();
+}
+
 bool InputMethodEngineBase::IsInterestedInKeyEvent() const {
   return observer_->IsInterestedInKeyEvent();
 }
diff --git a/chrome/browser/ui/input_method/input_method_engine_base.h b/chrome/browser/ui/input_method/input_method_engine_base.h
index 8d7899a1..9076c73 100644
--- a/chrome/browser/ui/input_method/input_method_engine_base.h
+++ b/chrome/browser/ui/input_method/input_method_engine_base.h
@@ -104,6 +104,9 @@
                                           int anchor_pos,
                                           int offset_pos) = 0;
 
+    // Called when the engine's MaybeSwitchEngine is called.
+    virtual void OnRequestEngineSwitch() = 0;
+
 #if defined(OS_CHROMEOS)
 
     // Called when an InputContext's properties change while it is focused.
@@ -137,6 +140,7 @@
   void Enable(const std::string& component_id) override;
   void Disable() override;
   void Reset() override;
+  void MaybeSwitchEngine() override;
   void ProcessKeyEvent(const ui::KeyEvent& key_event,
                        KeyEventDoneCallback& callback) override;
   void SetSurroundingText(const std::string& text,
diff --git a/chrome/browser/ui/input_method/input_method_engine_unittest.cc b/chrome/browser/ui/input_method/input_method_engine_unittest.cc
index 8664e8792..e44466a 100644
--- a/chrome/browser/ui/input_method/input_method_engine_unittest.cc
+++ b/chrome/browser/ui/input_method/input_method_engine_unittest.cc
@@ -107,6 +107,7 @@
     surrounding_info_.anchor = anchor_pos;
     surrounding_info_.offset = offset;
   }
+  void OnRequestEngineSwitch() override {}
 
   // Returns and resets the bitmap |calls_bitmap_|.
   unsigned char GetCallsBitmapAndReset() {
diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter.cc b/chrome/browser/ui/sync/one_click_signin_sync_starter.cc
index 2a4f603..80a1aee 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter.cc
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter.cc
@@ -80,6 +80,7 @@
     const std::string& email,
     const std::string& password,
     const std::string& refresh_token,
+    ProfileMode profile_mode,
     StartSyncMode start_mode,
     content::WebContents* web_contents,
     ConfirmationRequired confirmation_required,
@@ -100,13 +101,10 @@
   BrowserList::AddObserver(this);
   Initialize(profile, browser);
 
-  // Policy is enabled, so pass in a callback to do extra policy-related UI
-  // before signin completes.
-  SigninManagerFactory::GetForProfile(profile_)->
-      StartSignInWithRefreshToken(
-          refresh_token, gaia_id, email, password,
-          base::Bind(&OneClickSigninSyncStarter::ConfirmSignin,
-                     weak_pointer_factory_.GetWeakPtr()));
+  SigninManagerFactory::GetForProfile(profile_)->StartSignInWithRefreshToken(
+      refresh_token, gaia_id, email, password,
+      base::Bind(&OneClickSigninSyncStarter::ConfirmSignin,
+                 weak_pointer_factory_.GetWeakPtr(), profile_mode));
 }
 
 void OneClickSigninSyncStarter::OnBrowserRemoved(Browser* browser) {
@@ -142,26 +140,42 @@
   // will not be able to complete successfully.
   syncer::SyncPrefs sync_prefs(profile_->GetPrefs());
   sync_prefs.SetSyncRequested(true);
+  skip_sync_confirm_ = false;
 }
 
-void OneClickSigninSyncStarter::ConfirmSignin(const std::string& oauth_token) {
+void OneClickSigninSyncStarter::ConfirmSignin(ProfileMode profile_mode,
+                                              const std::string& oauth_token) {
   DCHECK(!oauth_token.empty());
   SigninManager* signin = SigninManagerFactory::GetForProfile(profile_);
-  // If this is a new signin (no account authenticated yet) try loading
-  // policy for this user now, before any signed in services are initialized.
-  if (!signin->IsAuthenticated()) {
-    policy::UserPolicySigninService* policy_service =
-        policy::UserPolicySigninServiceFactory::GetForProfile(profile_);
-    policy_service->RegisterForPolicy(
-        signin->GetUsernameForAuthInProgress(),
-        oauth_token,
-        base::Bind(&OneClickSigninSyncStarter::OnRegisteredForPolicy,
-                   weak_pointer_factory_.GetWeakPtr()));
-    return;
-  } else {
+  if (signin->IsAuthenticated()) {
     // The user is already signed in - just tell SigninManager to continue
     // with its re-auth flow.
+    DCHECK_EQ(CURRENT_PROFILE, profile_mode);
     signin->CompletePendingSignin();
+    return;
+  }
+
+  switch (profile_mode) {
+    case CURRENT_PROFILE: {
+      // If this is a new signin (no account authenticated yet) try loading
+      // policy for this user now, before any signed in services are
+      // initialized.
+      policy::UserPolicySigninService* policy_service =
+          policy::UserPolicySigninServiceFactory::GetForProfile(profile_);
+      policy_service->RegisterForPolicy(
+          signin->GetUsernameForAuthInProgress(), oauth_token,
+          base::Bind(&OneClickSigninSyncStarter::OnRegisteredForPolicy,
+                     weak_pointer_factory_.GetWeakPtr()));
+      break;
+    }
+    case NEW_PROFILE:
+      // If this is a new signin (no account authenticated yet) in a new
+      // profile, then just create the new signed-in profile and skip loading
+      // the policy as there is no need to ask the user again if they should be
+      // signed in to a new profile. Note that in this case the policy will be
+      // applied after the new profile is signed in.
+      CreateNewSignedInProfile();
+      break;
   }
 }
 
@@ -263,8 +277,7 @@
 void OneClickSigninSyncStarter::CreateNewSignedInProfile() {
   SigninManager* signin = SigninManagerFactory::GetForProfile(profile_);
   DCHECK(!signin->GetUsernameForAuthInProgress().empty());
-  DCHECK(!dm_token_.empty());
-  DCHECK(!client_id_.empty());
+
   // Create a new profile and have it call back when done so we can inject our
   // signin credentials.
   size_t icon_index = g_browser_process->profile_manager()->
@@ -302,8 +315,6 @@
       DCHECK(!old_signin_manager->GetUsernameForAuthInProgress().empty());
       DCHECK(!old_signin_manager->IsAuthenticated());
       DCHECK(!new_signin_manager->IsAuthenticated());
-      DCHECK(!dm_token_.empty());
-      DCHECK(!client_id_.empty());
 
       // Copy credentials from the old profile to the just-created profile,
       // and switch over to tracking that profile.
@@ -311,6 +322,7 @@
       FinishProfileSyncServiceSetup();
       Initialize(new_profile, nullptr);
       DCHECK_EQ(profile_, new_profile);
+      skip_sync_confirm_ = true;
 
       // We've transferred our credentials to the new profile - notify that
       // the signin for the original profile was cancelled (must do this after
@@ -319,9 +331,15 @@
       old_signin_manager->SignOut(signin_metrics::TRANSFER_CREDENTIALS,
                                   signin_metrics::SignoutDelete::IGNORE_METRIC);
 
-      // Load policy for the just-created profile - once policy has finished
-      // loading the signin process will complete.
-      LoadPolicyWithCachedCredentials();
+      if (!dm_token_.empty()) {
+        // Load policy for the just-created profile - once policy has finished
+        // loading the signin process will complete.
+        DCHECK(!client_id_.empty());
+        LoadPolicyWithCachedCredentials();
+      } else {
+        // No policy to load - simply complete the signin process.
+        SigninManagerFactory::GetForProfile(profile_)->CompletePendingSignin();
+      }
 
       // Unlock the new profile.
       ProfileAttributesEntry* entry;
@@ -476,6 +494,14 @@
   // Regardless of whether the account was successfully added or not,
   // continue with sync starting.
 
+  // TODO(zmin): Remove this hack once the https://crbug.com/657924 fixed.
+  // Skip the Sync confirmation dialog if user choose to create a new profile
+  // for the corp signin. This is because the dialog doesn't work properly
+  // after the corp signin.
+  if (skip_sync_confirm_) {
+    OnSyncConfirmationUIClosed(LoginUIService::ABORT_SIGNIN);
+    return;
+  }
 
   if (switches::UsePasswordSeparatedSigninFlow()) {
     // Under the new signin flow, the sync confirmation dialog should always be
diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter.h b/chrome/browser/ui/sync/one_click_signin_sync_starter.h
index 956efa19..efd09d5 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter.h
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter.h
@@ -41,6 +41,17 @@
                                   public content::WebContentsObserver,
                                   public LoginUIService::Observer {
  public:
+  enum ProfileMode {
+    // Attempts to sign the user in |profile_|. Note that if the account to be
+    // signed in is a managed account, then a profile confirmation dialog is
+    // shown and the user has the possibility to create a new profile before
+    // signing in.
+    CURRENT_PROFILE,
+
+    // Creates a new profile and signs the user in this new profile.
+    NEW_PROFILE
+  };
+
   enum StartSyncMode {
     // Starts the process of signing the user in with the SigninManager, and
     // once completed automatically starts sync with all data types enabled.
@@ -105,6 +116,7 @@
                             const std::string& email,
                             const std::string& password,
                             const std::string& refresh_token,
+                            ProfileMode profile_mode,
                             StartSyncMode start_mode,
                             content::WebContents* web_contents,
                             ConfirmationRequired display_confirmation,
@@ -184,7 +196,7 @@
 
   // Callback invoked to check whether the user needs policy or if a
   // confirmation is required (in which case we have to prompt the user first).
-  void ConfirmSignin(const std::string& oauth_token);
+  void ConfirmSignin(ProfileMode profile_mode, const std::string& oauth_token);
 
   // Displays confirmation UI to the user if confirmation_required_ ==
   // CONFIRM_UNTRUSTED_SIGNIN, otherwise completes the pending signin process.
@@ -248,6 +260,10 @@
   // Prevents Sync from running until configuration is complete.
   std::unique_ptr<syncer::SyncSetupInProgressHandle> sync_blocker_;
 
+  // Temporary flag to disable new sync confirm page if user choose to create a
+  // new profile after the corp account signin.
+  bool skip_sync_confirm_;
+
   base::WeakPtrFactory<OneClickSigninSyncStarter> weak_pointer_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(OneClickSigninSyncStarter);
diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc b/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc
index c71f49c..aa78d980 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc
@@ -79,9 +79,10 @@
                          const GURL& continue_url) {
     sync_starter_ = new OneClickSigninSyncStarter(
         profile(), NULL, kTestingGaiaId, kTestingUsername, std::string(),
-        "refresh_token", OneClickSigninSyncStarter::SYNC_WITH_DEFAULT_SETTINGS,
-        web_contents(), OneClickSigninSyncStarter::NO_CONFIRMATION, GURL(),
-        continue_url, callback);
+        "refresh_token", OneClickSigninSyncStarter::CURRENT_PROFILE,
+        OneClickSigninSyncStarter::SYNC_WITH_DEFAULT_SETTINGS, web_contents(),
+        OneClickSigninSyncStarter::NO_CONFIRMATION, GURL(), continue_url,
+        callback);
   }
 
   // Deletes itself when SigninFailed() or SigninSuccess() is called.
diff --git a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
index 1e6f110..b0ecfb5 100644
--- a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
+++ b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
@@ -285,7 +285,8 @@
     if (start_signin) {
       CreateSyncStarter(browser, contents, current_url_,
                         signin::GetNextPageURLForPromoURL(current_url_),
-                        result.refresh_token, start_mode,
+                        result.refresh_token,
+                        OneClickSigninSyncStarter::CURRENT_PROFILE, start_mode,
                         confirmation_required);
       base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
     }
@@ -298,12 +299,14 @@
     const GURL& current_url,
     const GURL& continue_url,
     const std::string& refresh_token,
+    OneClickSigninSyncStarter::ProfileMode profile_mode,
     OneClickSigninSyncStarter::StartSyncMode start_mode,
     OneClickSigninSyncStarter::ConfirmationRequired confirmation_required) {
   // OneClickSigninSyncStarter will delete itself once the job is done.
   new OneClickSigninSyncStarter(
-      profile_, browser, gaia_id_, email_, password_, refresh_token, start_mode,
-      contents, confirmation_required, current_url, continue_url,
+      profile_, browser, gaia_id_, email_, password_, refresh_token,
+      profile_mode, start_mode, contents, confirmation_required, current_url,
+      continue_url,
       base::Bind(&InlineLoginHandlerImpl::SyncStarterCallback, handler_));
 }
 
@@ -346,18 +349,17 @@
     case SigninEmailConfirmationDialog::CREATE_NEW_USER:
       content::RecordAction(
           base::UserMetricsAction("Signin_ImportDataPrompt_DontImport"));
-      if (handler_) {
-        handler_->SyncStarterCallback(
-            OneClickSigninSyncStarter::SYNC_SETUP_FAILURE);
-      }
-      UserManager::Show(base::FilePath(), profiles::USER_MANAGER_NO_TUTORIAL,
-                        profiles::USER_MANAGER_OPEN_CREATE_USER_PAGE);
+      CreateSyncStarter(browser, web_contents, current_url_, GURL(),
+                        refresh_token, OneClickSigninSyncStarter::NEW_PROFILE,
+                        start_mode, confirmation_required);
       break;
     case SigninEmailConfirmationDialog::START_SYNC:
       content::RecordAction(
           base::UserMetricsAction("Signin_ImportDataPrompt_ImportData"));
       CreateSyncStarter(browser, web_contents, current_url_, GURL(),
-                        refresh_token, start_mode, confirmation_required);
+                        refresh_token,
+                        OneClickSigninSyncStarter::CURRENT_PROFILE, start_mode,
+                        confirmation_required);
       break;
     case SigninEmailConfirmationDialog::CLOSE:
       content::RecordAction(
diff --git a/chrome/browser/ui/webui/signin/inline_login_handler_impl.h b/chrome/browser/ui/webui/signin/inline_login_handler_impl.h
index 0340102..8a71c14 100644
--- a/chrome/browser/ui/webui/signin/inline_login_handler_impl.h
+++ b/chrome/browser/ui/webui/signin/inline_login_handler_impl.h
@@ -189,6 +189,7 @@
       const GURL& current_url,
       const GURL& continue_url,
       const std::string& refresh_token,
+      OneClickSigninSyncStarter::ProfileMode profile_mode,
       OneClickSigninSyncStarter::StartSyncMode start_mode,
       OneClickSigninSyncStarter::ConfirmationRequired confirmation_required);
 
diff --git a/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc b/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc
index d8fb375..57bd3f0f 100644
--- a/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc
@@ -151,12 +151,13 @@
 
   MOCK_METHOD1(OnClientOAuthSuccess, void(const ClientOAuthResult& result));
   MOCK_METHOD1(OnClientOAuthFailure, void(const GoogleServiceAuthError& error));
-  MOCK_METHOD7(CreateSyncStarter,
+  MOCK_METHOD8(CreateSyncStarter,
                void(Browser*,
                     content::WebContents*,
                     const GURL&,
                     const GURL&,
                     const std::string&,
+                    OneClickSigninSyncStarter::ProfileMode,
                     OneClickSigninSyncStarter::StartSyncMode,
                     OneClickSigninSyncStarter::ConfirmationRequired));
 
@@ -209,12 +210,13 @@
       bool choose_what_to_sync,
       bool confirm_untrusted_signin);
 
-  MOCK_METHOD7(CreateSyncStarter,
+  MOCK_METHOD8(CreateSyncStarter,
                void(Browser*,
                     content::WebContents*,
                     const GURL&,
                     const GURL&,
                     const std::string&,
+                    OneClickSigninSyncStarter::ProfileMode,
                     OneClickSigninSyncStarter::StartSyncMode,
                     OneClickSigninSyncStarter::ConfirmationRequired));
 
@@ -593,6 +595,7 @@
   EXPECT_CALL(
       *helper,
       CreateSyncStarter(_, _, _, _, "refresh_token",
+                        OneClickSigninSyncStarter::CURRENT_PROFILE,
                         OneClickSigninSyncStarter::CONFIRM_SYNC_SETTINGS_FIRST,
                         OneClickSigninSyncStarter::CONFIRM_AFTER_SIGNIN));
 
@@ -627,6 +630,7 @@
           false);  // confirm untrusted signin
   EXPECT_CALL(*helper, CreateSyncStarter(
                            _, _, _, _, "refresh_token",
+                           OneClickSigninSyncStarter::CURRENT_PROFILE,
                            OneClickSigninSyncStarter::CONFIGURE_SYNC_FIRST,
                            OneClickSigninSyncStarter::CONFIRM_AFTER_SIGNIN));
 
@@ -662,6 +666,7 @@
   EXPECT_CALL(
       *helper,
       CreateSyncStarter(_, _, _, _, "refresh_token",
+                        OneClickSigninSyncStarter::CURRENT_PROFILE,
                         OneClickSigninSyncStarter::CONFIRM_SYNC_SETTINGS_FIRST,
                         OneClickSigninSyncStarter::CONFIRM_UNTRUSTED_SIGNIN));
 
@@ -699,6 +704,7 @@
   // settings, which means the user wants to CONFIGURE_SYNC_FIRST.
   EXPECT_CALL(*helper, CreateSyncStarter(
                            _, _, _, _, "refresh_token",
+                           OneClickSigninSyncStarter::CURRENT_PROFILE,
                            OneClickSigninSyncStarter::CONFIGURE_SYNC_FIRST,
                            OneClickSigninSyncStarter::CONFIRM_AFTER_SIGNIN));
 
diff --git a/chrome/browser/ui/webui/signin/sync_confirmation_handler_unittest.cc b/chrome/browser/ui/webui/signin/sync_confirmation_handler_unittest.cc
index 6d310f4..36f976a8 100644
--- a/chrome/browser/ui/webui/signin/sync_confirmation_handler_unittest.cc
+++ b/chrome/browser/ui/webui/signin/sync_confirmation_handler_unittest.cc
@@ -63,17 +63,10 @@
     // This dialog assumes the signin flow was completed, which kicks off the
     // SigninManager.
     new OneClickSigninSyncStarter(
-        profile(),
-        browser(),
-        "gaia",
-        "foo@example.com",
-        "password",
-        "refresh_token",
-        OneClickSigninSyncStarter::SYNC_WITH_DEFAULT_SETTINGS,
-        nullptr,
-        OneClickSigninSyncStarter::NO_CONFIRMATION,
-        GURL(),
-        GURL(),
+        profile(), browser(), "gaia", "foo@example.com", "password",
+        "refresh_token", OneClickSigninSyncStarter::CURRENT_PROFILE,
+        OneClickSigninSyncStarter::SYNC_WITH_DEFAULT_SETTINGS, nullptr,
+        OneClickSigninSyncStarter::NO_CONFIRMATION, GURL(), GURL(),
         OneClickSigninSyncStarter::Callback());
   }
 
diff --git a/chrome/common/BUILD.gn b/chrome/common/BUILD.gn
index 05d7ef9..0391430 100644
--- a/chrome/common/BUILD.gn
+++ b/chrome/common/BUILD.gn
@@ -677,6 +677,7 @@
     "conflicts/module_database_win.mojom",
     "conflicts/module_event_win.mojom",
     "field_trial_recorder.mojom",
+    "file_patcher.mojom",
     "net_benchmarking.mojom",
     "network_diagnostics.mojom",
     "renderer_configuration.mojom",
@@ -685,6 +686,7 @@
   ]
 
   public_deps = [
+    "//mojo/common:common_custom_types",
     "//url/mojo:url_mojom_gurl",
   ]
 }
diff --git a/chrome/common/chrome_utility_messages.h b/chrome/common/chrome_utility_messages.h
index 4bc2f0a..3473e6b 100644
--- a/chrome/common/chrome_utility_messages.h
+++ b/chrome/common/chrome_utility_messages.h
@@ -140,22 +140,6 @@
 // Utility process messages:
 // These are messages from the browser to the utility process.
 
-// Tell the utility process to patch the given |input_file| using |patch_file|
-// and place the output in |output_file|. The patch should use the bsdiff
-// algorithm (Courgette's version).
-IPC_MESSAGE_CONTROL3(ChromeUtilityMsg_PatchFileBsdiff,
-                     IPC::PlatformFileForTransit /* input_file */,
-                     IPC::PlatformFileForTransit /* patch_file */,
-                     IPC::PlatformFileForTransit /* output_file */)
-
-// Tell the utility process to patch the given |input_file| using |patch_file|
-// and place the output in |output_file|. The patch should use the Courgette
-// algorithm.
-IPC_MESSAGE_CONTROL3(ChromeUtilityMsg_PatchFileCourgette,
-                     IPC::PlatformFileForTransit /* input_file */,
-                     IPC::PlatformFileForTransit /* patch_file */,
-                     IPC::PlatformFileForTransit /* output_file */)
-
 #if defined(OS_CHROMEOS)
 // Tell the utility process to create a zip file on the given list of files.
 IPC_MESSAGE_CONTROL3(ChromeUtilityMsg_CreateZipFile,
@@ -209,9 +193,6 @@
 IPC_MESSAGE_CONTROL1(ChromeUtilityHostMsg_UnpackWebResource_Failed,
                      std::string /* error_message, if any */)
 
-// Reply when a file has been patched.
-IPC_MESSAGE_CONTROL1(ChromeUtilityHostMsg_PatchFile_Finished, int /* result */)
-
 #if defined(OS_CHROMEOS)
 // Reply when the utility process has succeeded in creating the zip file.
 IPC_MESSAGE_CONTROL0(ChromeUtilityHostMsg_CreateZipFile_Succeeded)
diff --git a/chrome/common/file_patcher.mojom b/chrome/common/file_patcher.mojom
new file mode 100644
index 0000000..fb7a19a7
--- /dev/null
+++ b/chrome/common/file_patcher.mojom
@@ -0,0 +1,28 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// File patching interface provided by the utility process and exposed
+// by mojo policy control to the chrome browser process.
+
+module chrome.mojom;
+
+import "mojo/common/file.mojom";
+
+interface FilePatcher {
+  // Patch |input_file| with |patch_file| using the bsdiff algorithm
+  // (Courgette's version) and place the output in |output_file|.
+  // Returns |result| bsdiff::BSDiffStatus::OK on success.
+  PatchFileBsdiff(
+      mojo.common.mojom.File input_file,
+      mojo.common.mojom.File patch_file,
+      mojo.common.mojom.File output_file) => (int32 result);
+
+  // Patch |input_file| with |patch_file| using the Courgette algorithm
+  // and place the output in |output_file|.
+  // Returns |result| courgette::Status::C_OK on success.
+  PatchFileCourgette(
+      mojo.common.mojom.File input_file,
+      mojo.common.mojom.File patch_file,
+      mojo.common.mojom.File output_file) => (int32 result);
+};
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 81f78e4..ae6dbcd 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -1339,6 +1339,7 @@
       "../browser/chrome_site_per_process_browsertest.cc",
       "../browser/chrome_switches_browsertest.cc",
       "../browser/collected_cookies_browsertest.cc",
+      "../browser/component_updater/component_patcher_operation_out_of_process_browsertest.cc",
       "../browser/content_settings/content_settings_browsertest.cc",
       "../browser/crash_recovery_browsertest.cc",
       "../browser/custom_handlers/protocol_handler_registry_browsertest.cc",
@@ -1958,6 +1959,7 @@
       "//chrome/browser/policy/test/policy_testserver.py",
       "//chrome/common/extensions/docs/examples/apps/calculator/",
       "//chrome/third_party/mock4js/",
+      "//components/test/data/update_client/",
       "//content/test/data/",
       "//google_apis/test/",
       "//media/test/data/",
diff --git a/chrome/utility/chrome_content_utility_client.cc b/chrome/utility/chrome_content_utility_client.cc
index f95ceadf..a0b7b170 100644
--- a/chrome/utility/chrome_content_utility_client.cc
+++ b/chrome/utility/chrome_content_utility_client.cc
@@ -13,6 +13,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "chrome/common/chrome_utility_messages.h"
+#include "chrome/common/file_patcher.mojom.h"
 #include "chrome/common/safe_browsing/zip_analyzer.h"
 #include "chrome/common/safe_browsing/zip_analyzer_results.h"
 #include "chrome/utility/chrome_content_utility_ipc_whitelist.h"
@@ -63,6 +64,7 @@
 
 namespace {
 
+#if defined(OS_CHROMEOS) || defined(FULL_SAFE_BROWSING)
 bool Send(IPC::Message* message) {
   return content::UtilityThread::Get()->Send(message);
 }
@@ -70,6 +72,41 @@
 void ReleaseProcessIfNeeded() {
   content::UtilityThread::Get()->ReleaseProcessIfNeeded();
 }
+#endif  // defined(OS_CHROMEOS) || defined(FULL_SAFE_BROWSING)
+
+class FilePatcherImpl : public chrome::mojom::FilePatcher {
+ public:
+  FilePatcherImpl() = default;
+  ~FilePatcherImpl() override = default;
+
+  static void Create(chrome::mojom::FilePatcherRequest request) {
+    mojo::MakeStrongBinding(base::MakeUnique<FilePatcherImpl>(),
+                            std::move(request));
+  }
+
+ private:
+  // chrome::mojom::FilePatcher:
+
+  void PatchFileBsdiff(base::File input_file,
+                       base::File patch_file,
+                       base::File output_file,
+                       const PatchFileBsdiffCallback& callback) override {
+    const int patch_result_status = bsdiff::ApplyBinaryPatch(
+        std::move(input_file), std::move(patch_file), std::move(output_file));
+    callback.Run(patch_result_status);
+  }
+
+  void PatchFileCourgette(base::File input_file,
+                          base::File patch_file,
+                          base::File output_file,
+                          const PatchFileCourgetteCallback& callback) override {
+    const int patch_result_status = courgette::ApplyEnsemblePatch(
+        std::move(input_file), std::move(patch_file), std::move(output_file));
+    callback.Run(patch_result_status);
+  }
+
+  DISALLOW_COPY_AND_ASSIGN(FilePatcherImpl);
+};
 
 #if !defined(OS_ANDROID)
 void CreateProxyResolverFactory(
@@ -155,10 +192,6 @@
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ChromeContentUtilityClient, message)
-    IPC_MESSAGE_HANDLER(ChromeUtilityMsg_PatchFileBsdiff,
-                        OnPatchFileBsdiff)
-    IPC_MESSAGE_HANDLER(ChromeUtilityMsg_PatchFileCourgette,
-                        OnPatchFileCourgette)
 #if defined(FULL_SAFE_BROWSING)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_AnalyzeZipFileForDownloadProtection,
                         OnAnalyzeZipFileForDownloadProtection)
@@ -200,6 +233,7 @@
   if (filter_messages_)
     return;
 
+  registry->AddInterface(base::Bind(&FilePatcherImpl::Create));
 #if !defined(OS_ANDROID)
   registry->AddInterface<net::interfaces::ProxyResolverFactory>(
       base::Bind(CreateProxyResolverFactory));
@@ -264,30 +298,6 @@
 }
 #endif  // defined(OS_CHROMEOS)
 
-void ChromeContentUtilityClient::OnPatchFileBsdiff(
-    const IPC::PlatformFileForTransit& input_file,
-    const IPC::PlatformFileForTransit& patch_file,
-    const IPC::PlatformFileForTransit& output_file) {
-  const int patch_status = bsdiff::ApplyBinaryPatch(
-      IPC::PlatformFileForTransitToFile(input_file),
-      IPC::PlatformFileForTransitToFile(patch_file),
-      IPC::PlatformFileForTransitToFile(output_file));
-  Send(new ChromeUtilityHostMsg_PatchFile_Finished(patch_status));
-  ReleaseProcessIfNeeded();
-}
-
-void ChromeContentUtilityClient::OnPatchFileCourgette(
-    const IPC::PlatformFileForTransit& input_file,
-    const IPC::PlatformFileForTransit& patch_file,
-    const IPC::PlatformFileForTransit& output_file) {
-  const int patch_status = courgette::ApplyEnsemblePatch(
-      IPC::PlatformFileForTransitToFile(input_file),
-      IPC::PlatformFileForTransitToFile(patch_file),
-      IPC::PlatformFileForTransitToFile(output_file));
-  Send(new ChromeUtilityHostMsg_PatchFile_Finished(patch_status));
-  ReleaseProcessIfNeeded();
-}
-
 #if defined(FULL_SAFE_BROWSING)
 void ChromeContentUtilityClient::OnAnalyzeZipFileForDownloadProtection(
     const IPC::PlatformFileForTransit& zip_file,
diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index d929769..ca7768a 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM
@@ -1 +1 @@
-9110.0.0
\ No newline at end of file
+9113.0.0
\ No newline at end of file
diff --git a/components/autofill/core/browser/BUILD.gn b/components/autofill/core/browser/BUILD.gn
index 74426f0c..3833eda 100644
--- a/components/autofill/core/browser/BUILD.gn
+++ b/components/autofill/core/browser/BUILD.gn
@@ -320,6 +320,7 @@
     "phone_number_unittest.cc",
     "ui/card_unmask_prompt_controller_impl_unittest.cc",
     "validation_unittest.cc",
+    "webdata/autocomplete_sync_bridge_unittest.cc",
     "webdata/autofill_data_type_controller_unittest.cc",
     "webdata/autofill_profile_syncable_service_unittest.cc",
     "webdata/autofill_table_unittest.cc",
diff --git a/components/autofill/core/browser/webdata/autocomplete_sync_bridge.cc b/components/autofill/core/browser/webdata/autocomplete_sync_bridge.cc
index 3a76db0b..9b8e201 100644
--- a/components/autofill/core/browser/webdata/autocomplete_sync_bridge.cc
+++ b/components/autofill/core/browser/webdata/autocomplete_sync_bridge.cc
@@ -4,14 +4,18 @@
 
 #include "components/autofill/core/browser/webdata/autocomplete_sync_bridge.h"
 
+#include <unordered_set>
+
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
+#include "base/strings/utf_string_conversions.h"
 #include "components/autofill/core/browser/webdata/autofill_metadata_change_list.h"
 #include "components/autofill/core/browser/webdata/autofill_table.h"
 #include "components/autofill/core/browser/webdata/autofill_webdata_backend.h"
 #include "components/autofill/core/browser/webdata/autofill_webdata_service.h"
 #include "components/sync/model/entity_data.h"
 #include "components/sync/model/model_type_change_processor.h"
+#include "components/sync/model/mutable_data_batch.h"
 #include "components/sync/model/sync_error.h"
 #include "net/base/escape.h"
 
@@ -26,9 +30,18 @@
   return reinterpret_cast<void*>(&user_data_key);
 }
 
-const std::string FormatStorageKey(const std::string name,
-                                   const std::string value) {
-  return net::EscapePath(name) + "|" + net::EscapePath(value);
+std::unique_ptr<syncer::EntityData> CreateEntityData(
+    const autofill::AutofillEntry& entry) {
+  auto entity_data = base::MakeUnique<syncer::EntityData>();
+  entity_data->non_unique_name = base::UTF16ToUTF8(entry.key().name());
+  sync_pb::AutofillSpecifics* autofill =
+      entity_data->specifics.mutable_autofill();
+  autofill->set_name(base::UTF16ToUTF8(entry.key().name()));
+  autofill->set_value(base::UTF16ToUTF8(entry.key().value()));
+  autofill->add_usage_timestamp(entry.date_created().ToInternalValue());
+  if (entry.date_created() != entry.date_last_used())
+    autofill->add_usage_timestamp(entry.date_last_used().ToInternalValue());
+  return entity_data;
 }
 
 }  // namespace
@@ -95,12 +108,32 @@
     StorageKeyList storage_keys,
     DataCallback callback) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  NOTIMPLEMENTED();
+  std::unordered_set<std::string> keys_set;
+  for (const auto& key : storage_keys) {
+    keys_set.insert(key);
+  }
+
+  auto batch = base::MakeUnique<syncer::MutableDataBatch>();
+  std::vector<AutofillEntry> entries;
+  GetAutofillTable()->GetAllAutofillEntries(&entries);
+  for (const AutofillEntry& entry : entries) {
+    std::string key = GetStorageKeyFromAutofillEntry(entry);
+    if (keys_set.find(key) != keys_set.end()) {
+      batch->Put(key, CreateEntityData(entry));
+    }
+  }
+  callback.Run(syncer::SyncError(), std::move(batch));
 }
 
 void AutocompleteSyncBridge::GetAllData(DataCallback callback) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  NOTIMPLEMENTED();
+  auto batch = base::MakeUnique<syncer::MutableDataBatch>();
+  std::vector<AutofillEntry> entries;
+  GetAutofillTable()->GetAllAutofillEntries(&entries);
+  for (const AutofillEntry& entry : entries) {
+    batch->Put(GetStorageKeyFromAutofillEntry(entry), CreateEntityData(entry));
+  }
+  callback.Run(syncer::SyncError(), std::move(batch));
 }
 
 std::string AutocompleteSyncBridge::GetClientTag(
@@ -126,8 +159,35 @@
   DCHECK(thread_checker_.CalledOnValidThread());
 }
 
+// static
+AutofillEntry AutocompleteSyncBridge::CreateAutofillEntry(
+    const sync_pb::AutofillSpecifics& autofill_specifics) {
+  AutofillKey key(base::UTF8ToUTF16(autofill_specifics.name()),
+                  base::UTF8ToUTF16(autofill_specifics.value()));
+  base::Time date_created, date_last_used;
+  const google::protobuf::RepeatedField<int64_t>& timestamps =
+      autofill_specifics.usage_timestamp();
+  if (!timestamps.empty()) {
+    date_created = base::Time::FromInternalValue(*timestamps.begin());
+    date_last_used = base::Time::FromInternalValue(*timestamps.rbegin());
+  }
+  return AutofillEntry(key, date_created, date_last_used);
+}
+
 AutofillTable* AutocompleteSyncBridge::GetAutofillTable() const {
   return AutofillTable::FromWebDatabase(web_data_backend_->GetDatabase());
 }
 
+std::string AutocompleteSyncBridge::GetStorageKeyFromAutofillEntry(
+    const autofill::AutofillEntry& entry) {
+  return FormatStorageKey(base::UTF16ToUTF8(entry.key().name()),
+                          base::UTF16ToUTF8(entry.key().value()));
+}
+
+// static
+std::string AutocompleteSyncBridge::FormatStorageKey(const std::string& name,
+                                                     const std::string& value) {
+  return net::EscapePath(name) + "|" + net::EscapePath(value);
+}
+
 }  // namespace autofill
diff --git a/components/autofill/core/browser/webdata/autocomplete_sync_bridge.h b/components/autofill/core/browser/webdata/autocomplete_sync_bridge.h
index 2a575ed..00a69f1b 100644
--- a/components/autofill/core/browser/webdata/autocomplete_sync_bridge.h
+++ b/components/autofill/core/browser/webdata/autocomplete_sync_bridge.h
@@ -64,10 +64,19 @@
   // AutofillWebDataServiceObserverOnDBThread implementation.
   void AutofillEntriesChanged(const AutofillChangeList& changes) override;
 
+  static AutofillEntry CreateAutofillEntry(
+      const sync_pb::AutofillSpecifics& autofill_specifics);
+
  private:
   // Returns the table associated with the |web_data_backend_|.
   AutofillTable* GetAutofillTable() const;
 
+  std::string GetStorageKeyFromAutofillEntry(
+      const autofill::AutofillEntry& entry);
+
+  static std::string FormatStorageKey(const std::string& name,
+                                      const std::string& value);
+
   base::ThreadChecker thread_checker_;
 
   // AutocompleteSyncBridge is owned by |web_data_backend_| through
diff --git a/components/autofill/core/browser/webdata/autocomplete_sync_bridge_unittest.cc b/components/autofill/core/browser/webdata/autocomplete_sync_bridge_unittest.cc
new file mode 100644
index 0000000..de05b01
--- /dev/null
+++ b/components/autofill/core/browser/webdata/autocomplete_sync_bridge_unittest.cc
@@ -0,0 +1,174 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/autofill/core/browser/webdata/autocomplete_sync_bridge.h"
+
+#include <memory>
+
+#include "base/bind.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/macros.h"
+#include "base/memory/ptr_util.h"
+#include "base/run_loop.h"
+#include "base/strings/stringprintf.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "components/autofill/core/browser/webdata/autofill_table.h"
+#include "components/autofill/core/browser/webdata/autofill_webdata_backend.h"
+#include "components/autofill/core/browser/webdata/autofill_webdata_service.h"
+#include "components/sync/model/data_batch.h"
+#include "components/sync/model/fake_model_type_change_processor.h"
+#include "components/sync/model/metadata_batch.h"
+#include "components/webdata/common/web_database.h"
+#include "net/base/escape.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using sync_pb::AutofillSpecifics;
+using syncer::SyncError;
+
+namespace autofill {
+
+namespace {
+
+const char kNameFormat[] = "name %d";
+const char kValueFormat[] = "value %d";
+
+void VerifyEqual(const AutofillSpecifics& s1, const AutofillSpecifics& s2) {
+  EXPECT_EQ(s1.SerializeAsString(), s2.SerializeAsString());
+}
+
+void VerifyDataBatch(std::map<std::string, AutofillSpecifics> expected,
+                     SyncError error,
+                     std::unique_ptr<syncer::DataBatch> batch) {
+  EXPECT_FALSE(error.IsSet());
+  while (batch->HasNext()) {
+    const syncer::KeyAndData& pair = batch->Next();
+    auto iter = expected.find(pair.first);
+    ASSERT_NE(iter, expected.end());
+    VerifyEqual(iter->second, pair.second->specifics.autofill());
+    // Removing allows us to verify we don't see the same item multiple times,
+    // and that we saw everything we expected.
+    expected.erase(iter);
+  }
+  EXPECT_TRUE(expected.empty());
+}
+
+std::unique_ptr<syncer::ModelTypeChangeProcessor>
+CreateModelTypeChangeProcessor(syncer::ModelType type,
+                               syncer::ModelTypeSyncBridge* bridge) {
+  return base::MakeUnique<syncer::FakeModelTypeChangeProcessor>();
+}
+
+class FakeAutofillBackend : public AutofillWebDataBackend {
+ public:
+  FakeAutofillBackend() {}
+  ~FakeAutofillBackend() override {}
+  WebDatabase* GetDatabase() override { return db_; }
+  void AddObserver(
+      autofill::AutofillWebDataServiceObserverOnDBThread* observer) override {}
+  void RemoveObserver(
+      autofill::AutofillWebDataServiceObserverOnDBThread* observer) override {}
+  void RemoveExpiredFormElements() override {}
+  void NotifyOfMultipleAutofillChanges() override {}
+  void NotifyThatSyncHasStarted(syncer::ModelType model_type) override {}
+  void SetWebDatabase(WebDatabase* db) { db_ = db; }
+
+ private:
+  WebDatabase* db_;
+};
+
+}  // namespace
+
+class AutocompleteSyncBridgeTest : public testing::Test {
+ public:
+  AutocompleteSyncBridgeTest() {
+    if (temp_dir_.CreateUniqueTempDir()) {
+      db_.AddTable(&table_);
+      db_.Init(temp_dir_.GetPath().AppendASCII("SyncTestWebDatabase"));
+      backend_.SetWebDatabase(&db_);
+
+      bridge_.reset(new AutocompleteSyncBridge(
+          &backend_, base::Bind(&CreateModelTypeChangeProcessor)));
+    }
+  }
+  ~AutocompleteSyncBridgeTest() override {}
+
+ protected:
+  AutocompleteSyncBridge* bridge() { return bridge_.get(); }
+
+  void SaveSpecificsToTable(
+      const std::vector<AutofillSpecifics>& specifics_list) {
+    std::vector<AutofillEntry> new_entries;
+    for (const auto& specifics : specifics_list) {
+      new_entries.push_back(
+          AutocompleteSyncBridge::CreateAutofillEntry(specifics));
+    }
+    table_.UpdateAutofillEntries(new_entries);
+  }
+
+  AutofillSpecifics CreateSpecifics(int suffix) {
+    AutofillSpecifics specifics;
+    specifics.set_name(base::StringPrintf(kNameFormat, suffix));
+    specifics.set_value(base::StringPrintf(kValueFormat, suffix));
+    specifics.add_usage_timestamp(0);
+    return specifics;
+  }
+
+  std::string GetStorageKey(const AutofillSpecifics& specifics) {
+    return net::EscapePath(specifics.name()) + "|" +
+           net::EscapePath(specifics.value());
+  }
+
+ private:
+  base::ScopedTempDir temp_dir_;
+  base::MessageLoop message_loop_;
+  FakeAutofillBackend backend_;
+  AutofillTable table_;
+  WebDatabase db_;
+  std::unique_ptr<AutocompleteSyncBridge> bridge_;
+
+  DISALLOW_COPY_AND_ASSIGN(AutocompleteSyncBridgeTest);
+};
+
+TEST_F(AutocompleteSyncBridgeTest, GetData) {
+  const AutofillSpecifics specifics1 = CreateSpecifics(1);
+  const AutofillSpecifics specifics2 = CreateSpecifics(2);
+  const AutofillSpecifics specifics3 = CreateSpecifics(3);
+  SaveSpecificsToTable({specifics1, specifics2, specifics3});
+
+  const std::map<std::string, AutofillSpecifics> expected{
+      {GetStorageKey(specifics1), specifics1},
+      {GetStorageKey(specifics3), specifics3}};
+  bridge()->GetData({GetStorageKey(specifics1), GetStorageKey(specifics3)},
+                    base::Bind(&VerifyDataBatch, expected));
+}
+
+TEST_F(AutocompleteSyncBridgeTest, GetDataNotExist) {
+  const AutofillSpecifics specifics1 = CreateSpecifics(1);
+  const AutofillSpecifics specifics2 = CreateSpecifics(2);
+  const AutofillSpecifics specifics3 = CreateSpecifics(3);
+  SaveSpecificsToTable({specifics1, specifics2});
+
+  const std::map<std::string, AutofillSpecifics> expected{
+      {GetStorageKey(specifics1), specifics1},
+      {GetStorageKey(specifics2), specifics2}};
+  bridge()->GetData({GetStorageKey(specifics1), GetStorageKey(specifics2),
+                     GetStorageKey(specifics3)},
+                    base::Bind(&VerifyDataBatch, expected));
+}
+
+TEST_F(AutocompleteSyncBridgeTest, GetAllData) {
+  const AutofillSpecifics specifics1 = CreateSpecifics(1);
+  const AutofillSpecifics specifics2 = CreateSpecifics(2);
+  const AutofillSpecifics specifics3 = CreateSpecifics(3);
+  SaveSpecificsToTable({specifics1, specifics2, specifics3});
+
+  const std::map<std::string, AutofillSpecifics> expected{
+      {GetStorageKey(specifics1), specifics1},
+      {GetStorageKey(specifics2), specifics2},
+      {GetStorageKey(specifics3), specifics3}};
+  bridge()->GetAllData(base::Bind(&VerifyDataBatch, expected));
+}
+
+}  // namespace autofill
diff --git a/components/autofill/core/browser/webdata/autocomplete_syncable_service.cc b/components/autofill/core/browser/webdata/autocomplete_syncable_service.cc
index 76fb7fb..aff31218 100644
--- a/components/autofill/core/browser/webdata/autocomplete_syncable_service.cc
+++ b/components/autofill/core/browser/webdata/autocomplete_syncable_service.cc
@@ -317,7 +317,7 @@
   if (it == loaded_data->end()) {
     // New entry.
     base::Time date_created, date_last_used;
-    if (timestamps.size() > 0) {
+    if (!timestamps.empty()) {
       date_created = base::Time::FromInternalValue(*timestamps.begin());
       date_last_used = base::Time::FromInternalValue(*timestamps.rbegin());
     }
diff --git a/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.cc b/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.cc
index 467fdc0..c01b4e2 100644
--- a/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.cc
+++ b/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.cc
@@ -491,7 +491,7 @@
   std::unique_ptr<base::ListValue> pref_value =
       std::unique_ptr<base::ListValue>(
           pref_service_->GetList(pref)->DeepCopy());
-  list_pref_map_.add(pref, std::move(pref_value));
+  list_pref_map_[pref] = std::move(pref_value);
 }
 
 int64_t DataReductionProxyCompressionStats::GetInt64(const char* pref_path) {
@@ -525,7 +525,10 @@
     return ListPrefUpdate(pref_service_, pref_path).Get();
 
   DelayedWritePrefs();
-  return list_pref_map_.get(pref_path);
+  auto it = list_pref_map_.find(pref_path);
+  if (it == list_pref_map_.end())
+    return nullptr;
+  return it->second.get();
 }
 
 void DataReductionProxyCompressionStats::WritePrefs() {
@@ -538,9 +541,9 @@
     pref_service_->SetInt64(iter->first, iter->second);
   }
 
-  for (DataReductionProxyListPrefMap::iterator iter = list_pref_map_.begin();
-       iter != list_pref_map_.end(); ++iter) {
-    TransferList(*(iter->second),
+  for (auto iter = list_pref_map_.begin(); iter != list_pref_map_.end();
+       ++iter) {
+    TransferList(*(iter->second.get()),
                  ListPrefUpdate(pref_service_, iter->first).Get());
   }
 }
@@ -687,8 +690,8 @@
          data_usage->connection_usage_size() == 1);
   for (const auto& connection_usage : data_usage->connection_usage()) {
     for (const auto& site_usage : connection_usage.site_usage()) {
-      data_usage_map_.set(site_usage.hostname(),
-                          base::MakeUnique<PerSiteDataUsage>(site_usage));
+      data_usage_map_[site_usage.hostname()] =
+          base::MakeUnique<PerSiteDataUsage>(site_usage);
     }
   }
 
@@ -718,8 +721,8 @@
   pref_service_->ClearPref(
       prefs::kDailyOriginalContentLengthWithDataReductionProxyEnabled);
 
-  for (DataReductionProxyListPrefMap::iterator iter = list_pref_map_.begin();
-       iter != list_pref_map_.end(); ++iter) {
+  for (auto iter = list_pref_map_.begin(); iter != list_pref_map_.end();
+       ++iter) {
     iter->second->Clear();
   }
 }
@@ -1159,9 +1162,9 @@
   }
 
   std::string normalized_host = NormalizeHostname(data_usage_host);
-  auto j = data_usage_map_.add(normalized_host,
-                               base::MakeUnique<PerSiteDataUsage>());
-  PerSiteDataUsage* per_site_usage = j.first->second;
+  auto j = data_usage_map_.insert(
+      std::make_pair(normalized_host, base::MakeUnique<PerSiteDataUsage>()));
+  PerSiteDataUsage* per_site_usage = j.first->second.get();
   per_site_usage->set_hostname(normalized_host);
   per_site_usage->set_original_size(per_site_usage->original_size() +
                                     original_size);
@@ -1182,7 +1185,7 @@
         data_usage_bucket->add_connection_usage();
     for (auto i = data_usage_map_.begin(); i != data_usage_map_.end(); ++i) {
         PerSiteDataUsage* per_site_usage = connection_usage->add_site_usage();
-        per_site_usage->CopyFrom(*(i->second));
+        per_site_usage->CopyFrom(*(i->second.get()));
     }
     service_->StoreCurrentDataUsageBucket(std::move(data_usage_bucket));
   }
diff --git a/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.h b/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.h
index 70cd97d..60c0020 100644
--- a/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.h
+++ b/components/data_reduction_proxy/core/browser/data_reduction_proxy_compression_stats.h
@@ -11,8 +11,8 @@
 #include <map>
 #include <memory>
 #include <string>
+#include <unordered_map>
 
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
@@ -45,7 +45,7 @@
 // prefs must be stored and read on the UI thread.
 class DataReductionProxyCompressionStats {
  public:
-  typedef base::ScopedPtrHashMap<std::string, std::unique_ptr<PerSiteDataUsage>>
+  typedef std::unordered_map<std::string, std::unique_ptr<PerSiteDataUsage>>
       SiteUsageMap;
 
   // Collects and store data usage and compression statistics. Basic data usage
@@ -140,7 +140,7 @@
   friend class DataReductionProxyCompressionStatsTest;
 
   typedef std::map<const char*, int64_t> DataReductionProxyPrefMap;
-  typedef base::ScopedPtrHashMap<const char*, std::unique_ptr<base::ListValue>>
+  typedef std::unordered_map<const char*, std::unique_ptr<base::ListValue>>
       DataReductionProxyListPrefMap;
 
   class DailyContentLengthUpdate;
diff --git a/components/password_manager/content/browser/credential_manager_impl.cc b/components/password_manager/content/browser/credential_manager_impl.cc
index 80b11b9..3f7a88e7 100644
--- a/components/password_manager/content/browser/credential_manager_impl.cc
+++ b/components/password_manager/content/browser/credential_manager_impl.cc
@@ -86,6 +86,14 @@
   DCHECK(client_->IsSavingAndFillingEnabledForCurrentPage());
   const autofill::PasswordForm& form = form_manager_->pending_credentials();
 
+  if (form_manager_->IsPendingCredentialsPublicSuffixMatch()) {
+    // Having a credential with a PSL match implies there is no credential with
+    // an exactly matching origin and username. In order to avoid showing a save
+    // bubble to the user Save() is called directly.
+    form_manager_->Save();
+    return;
+  }
+
   if (!form.federation_origin.unique()) {
     // If this is a federated credential, check it against the federated matches
     // produced by the PasswordFormManager. If a match is found, update it and
diff --git a/components/password_manager/content/browser/credential_manager_impl_unittest.cc b/components/password_manager/content/browser/credential_manager_impl_unittest.cc
index 4c0840bd..887fb91 100644
--- a/components/password_manager/content/browser/credential_manager_impl_unittest.cc
+++ b/components/password_manager/content/browser/credential_manager_impl_unittest.cc
@@ -521,6 +521,94 @@
             passwords[form_.signon_realm][0].password_value);
 }
 
+TEST_F(CredentialManagerImplTest,
+       CredentialManagerStorePSLMatchDoesNotTriggerBubble) {
+  autofill::PasswordForm psl_form = subdomain_form_;
+  psl_form.username_value = form_.username_value;
+  psl_form.password_value = form_.password_value;
+  store_->AddLogin(psl_form);
+
+  // Calling 'Store' with a new credential that is a PSL match for an existing
+  // credential with identical username and password should result in a silent
+  // save without prompting the user.
+  CredentialInfo info(form_, CredentialType::CREDENTIAL_TYPE_PASSWORD);
+  EXPECT_CALL(*client_, PromptUserToSavePasswordPtr(_, _))
+      .Times(testing::Exactly(0));
+  EXPECT_CALL(*client_, NotifyStorePasswordCalled());
+  bool called = false;
+  CallStore(info, base::Bind(&RespondCallback, &called));
+  RunAllPendingTasks();
+  EXPECT_TRUE(called);
+
+  // Check that both credentials are present in the password store.
+  TestPasswordStore::PasswordMap passwords = store_->stored_passwords();
+  EXPECT_EQ(2U, passwords.size());
+  EXPECT_EQ(1U, passwords[form_.signon_realm].size());
+  EXPECT_EQ(1U, passwords[psl_form.signon_realm].size());
+}
+
+TEST_F(CredentialManagerImplTest,
+       CredentialManagerStorePSLMatchWithDifferentUsernameTriggersBubble) {
+  base::string16 delta = base::ASCIIToUTF16("_totally_different");
+  autofill::PasswordForm psl_form = subdomain_form_;
+  psl_form.username_value = form_.username_value + delta;
+  psl_form.password_value = form_.password_value;
+  store_->AddLogin(psl_form);
+
+  // Calling 'Store' with a new credential that is a PSL match for an existing
+  // credential but has a different username should prompt the user and not
+  // result in a silent save.
+  CredentialInfo info(form_, CredentialType::CREDENTIAL_TYPE_PASSWORD);
+  EXPECT_CALL(*client_, PromptUserToSavePasswordPtr(_, _))
+      .Times(testing::Exactly(1));
+  EXPECT_CALL(*client_, NotifyStorePasswordCalled());
+  bool called = false;
+  CallStore(info, base::Bind(&RespondCallback, &called));
+  RunAllPendingTasks();
+  EXPECT_TRUE(called);
+
+  // Check that only the initial credential is present in the password store
+  // and the new one is still pending.
+  TestPasswordStore::PasswordMap passwords = store_->stored_passwords();
+  EXPECT_EQ(1U, passwords.size());
+  EXPECT_EQ(1U, passwords[psl_form.signon_realm].size());
+
+  const auto& pending_cred = client_->pending_manager()->pending_credentials();
+  EXPECT_EQ(info.id, pending_cred.username_value);
+  EXPECT_EQ(info.password, pending_cred.password_value);
+}
+
+TEST_F(CredentialManagerImplTest,
+       CredentialManagerStorePSLMatchWithDifferentPasswordTriggersBubble) {
+  base::string16 delta = base::ASCIIToUTF16("_totally_different");
+  autofill::PasswordForm psl_form = subdomain_form_;
+  psl_form.username_value = form_.username_value;
+  psl_form.password_value = form_.password_value + delta;
+  store_->AddLogin(psl_form);
+
+  // Calling 'Store' with a new credential that is a PSL match for an existing
+  // credential but has a different password should prompt the user and not
+  // result in a silent save.
+  CredentialInfo info(form_, CredentialType::CREDENTIAL_TYPE_PASSWORD);
+  EXPECT_CALL(*client_, PromptUserToSavePasswordPtr(_, _))
+      .Times(testing::Exactly(1));
+  EXPECT_CALL(*client_, NotifyStorePasswordCalled());
+  bool called = false;
+  CallStore(info, base::Bind(&RespondCallback, &called));
+  RunAllPendingTasks();
+  EXPECT_TRUE(called);
+
+  // Check that only the initial credential is present in the password store
+  // and the new one is still pending.
+  TestPasswordStore::PasswordMap passwords = store_->stored_passwords();
+  EXPECT_EQ(1U, passwords.size());
+  EXPECT_EQ(1U, passwords[psl_form.signon_realm].size());
+
+  const auto& pending_cred = client_->pending_manager()->pending_credentials();
+  EXPECT_EQ(info.id, pending_cred.username_value);
+  EXPECT_EQ(info.password, pending_cred.password_value);
+}
+
 TEST_F(CredentialManagerImplTest, CredentialManagerStoreOverwriteZeroClick) {
   form_.skip_zero_click = true;
   store_->AddLogin(form_);
diff --git a/components/search_engines/OWNERS b/components/search_engines/OWNERS
index c19e61b7..9608b23 100644
--- a/components/search_engines/OWNERS
+++ b/components/search_engines/OWNERS
@@ -1,2 +1,2 @@
 pkasting@chromium.org
-stevet@chromium.org
+vasilii@chromium.org
diff --git a/content/browser/compositor/software_output_device_win.cc b/content/browser/compositor/software_output_device_win.cc
index 2edf325..fd74052 100644
--- a/content/browser/compositor/software_output_device_win.cc
+++ b/content/browser/compositor/software_output_device_win.cc
@@ -139,7 +139,7 @@
       }
     }
     if (can_create_contents) {
-      contents_ = skia::CreatePlatformCanvas(
+      contents_ = skia::CreatePlatformCanvasWithSharedSection(
           viewport_pixel_size_.width(), viewport_pixel_size_.height(), true,
           shared_section, skia::CRASH_ON_FAILURE);
     }
diff --git a/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm b/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
index a5838a4..a9361d3 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
@@ -88,11 +88,13 @@
   if (!consumed)
     unhandledWheelEventReceived_ = true;
 }
+
 - (void)rendererHandledGestureScrollEvent:(const blink::WebGestureEvent&)event
                                  consumed:(BOOL)consumed {
   if (!consumed && event.type == blink::WebInputEvent::GestureScrollUpdate)
     unhandledWheelEventReceived_ = true;
 }
+
 - (void)touchesBeganWithEvent:(NSEvent*)event {}
 - (void)touchesMovedWithEvent:(NSEvent*)event {}
 - (void)touchesCancelledWithEvent:(NSEvent*)event {}
@@ -160,6 +162,8 @@
   void SelectAll() override {}
 
   std::unique_ptr<TextInputManager> text_input_manager_;
+
+  DISALLOW_COPY_AND_ASSIGN(MockRenderWidgetHostDelegate);
 };
 
 class MockRenderWidgetHostImpl : public RenderWidgetHostImpl {
@@ -183,7 +187,11 @@
 
   MOCK_METHOD0(Focus, void());
   MOCK_METHOD0(Blur, void());
+
   ui::LatencyInfo lastWheelEventLatencyInfo;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(MockRenderWidgetHostImpl);
 };
 
 // Generates the |length| of composition rectangle vector and save them to
@@ -230,8 +238,8 @@
 // Returns NSScrollWheel event that mocks -phase. |mockPhaseSelector| should
 // correspond to a method in |MockPhaseMethods| that returns the desired phase.
 NSEvent* MockScrollWheelEventWithPhase(SEL mockPhaseSelector, int32_t delta) {
-  CGEventRef cg_event =
-      CGEventCreateScrollWheelEvent(NULL, kCGScrollEventUnitLine, 1, delta, 0);
+  CGEventRef cg_event = CGEventCreateScrollWheelEvent(
+      nullptr, kCGScrollEventUnitLine, 1, delta, 0);
   CGEventTimestamp timestamp = 0;
   CGEventSetTimestamp(cg_event, timestamp);
   NSEvent* event = [NSEvent eventWithCGEvent:cg_event];
@@ -246,7 +254,7 @@
 
 class RenderWidgetHostViewMacTest : public RenderViewHostImplTestHarness {
  public:
-  RenderWidgetHostViewMacTest() : old_rwhv_(NULL), rwhv_mac_(NULL) {
+  RenderWidgetHostViewMacTest() : rwhv_mac_(nullptr), old_rwhv_(nullptr) {
     std::unique_ptr<base::SimpleTestTickClock> mock_clock(
         new base::SimpleTestTickClock());
     mock_clock->Advance(base::TimeDelta::FromMilliseconds(100));
@@ -268,6 +276,7 @@
 
     rwhv_cocoa_.reset([rwhv_mac_->cocoa_view() retain]);
   }
+
   void TearDown() override {
     // Make sure the rwhv_mac_ is gone once the superclass's |TearDown()| runs.
     rwhv_cocoa_.reset();
@@ -298,12 +307,6 @@
     view->TextInputStateChanged(state);
   }
 
- private:
-  // This class isn't derived from PlatformTest.
-  base::mac::ScopedNSAutoreleasePool pool_;
-
-  RenderWidgetHostView* old_rwhv_;
-
  protected:
   std::string selected_text() const { return rwhv_mac_->selected_text_; }
 
@@ -311,6 +314,11 @@
   base::scoped_nsobject<RenderWidgetHostViewCocoa> rwhv_cocoa_;
 
  private:
+  // This class isn't derived from PlatformTest.
+  base::mac::ScopedNSAutoreleasePool pool_;
+
+  RenderWidgetHostView* old_rwhv_;
+
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewMacTest);
 };
 
@@ -346,7 +354,7 @@
 }
 
 TEST_F(RenderWidgetHostViewMacTest, Fullscreen) {
-  rwhv_mac_->InitAsFullscreen(NULL);
+  rwhv_mac_->InitAsFullscreen(nullptr);
   EXPECT_TRUE(rwhv_mac_->pepper_fullscreen_window());
 
   // Break the reference cycle caused by pepper_fullscreen_window() without
@@ -583,11 +591,10 @@
   const gfx::Size kBoundsUnit(10, 20);
 
   NSRect rect;
-  // Make sure not crashing by passing NULL pointer instead of |actual_range|.
+  // Make sure not crashing by passing nullptr pointer instead of
+  // |actual_range|.
   EXPECT_FALSE(rwhv_mac_->GetCachedFirstRectForCharacterRange(
-      gfx::Range(0, 0).ToNSRange(),
-      &rect,
-      NULL));
+      gfx::Range(0, 0).ToNSRange(), &rect, nullptr));
 
   // If there are no update from renderer, always returned caret position.
   NSRange actual_range;
@@ -617,9 +624,7 @@
   rwhv_mac_->ImeCompositionRangeChanged(gfx::Range(10, 12),
                                         std::vector<gfx::Rect>());
   EXPECT_FALSE(rwhv_mac_->GetCachedFirstRectForCharacterRange(
-      gfx::Range(10, 11).ToNSRange(),
-      &rect,
-      NULL));
+      gfx::Range(10, 11).ToNSRange(), &rect, nullptr));
 
   const int kCompositionLength = 10;
   std::vector<gfx::Rect> composition_bounds;
@@ -676,12 +681,10 @@
       EXPECT_EQ(gfx::Range(request_range), gfx::Range(actual_range));
       EXPECT_EQ(expected_rect, gfx::Rect(NSRectToCGRect(rect)));
 
-      // Make sure not crashing by passing NULL pointer instead of
+      // Make sure not crashing by passing nullptr pointer instead of
       // |actual_range|.
       EXPECT_TRUE(rwhv_mac_->GetCachedFirstRectForCharacterRange(
-            request_range,
-            &rect,
-            NULL));
+          request_range, &rect, nullptr));
     }
   }
 }
@@ -1086,7 +1089,7 @@
   view->SetDelegate(view_delegate.get());
 
   base::WeakPtr<RenderWidgetHostViewBase> guest_rwhv_weak =
-      (RenderWidgetHostViewGuest::Create(rwh, NULL, view->GetWeakPtr()))
+      (RenderWidgetHostViewGuest::Create(rwh, nullptr, view->GetWeakPtr()))
           ->GetWeakPtr();
 
   // Remove the cocoa_view() so |view| also goes away before |rwh|.
@@ -1153,10 +1156,10 @@
 
 class RenderWidgetHostViewMacPinchTest : public RenderWidgetHostViewMacTest {
  public:
-  RenderWidgetHostViewMacPinchTest() : process_host_(NULL) {}
+  RenderWidgetHostViewMacPinchTest() : process_host_(nullptr) {}
 
   bool ZoomDisabledForPinchUpdateMessage() {
-    const IPC::Message* message = NULL;
+    const IPC::Message* message = nullptr;
     // The first message may be a PinchBegin. Go for the second message if
     // there are two.
     switch (process_host_->sink().message_count()) {
@@ -1182,6 +1185,9 @@
   }
 
   MockRenderProcessHost* process_host_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewMacPinchTest);
 };
 
 TEST_F(RenderWidgetHostViewMacPinchTest, PinchThresholding) {
@@ -1358,6 +1364,7 @@
  public:
   InputMethodMacTest() {}
   ~InputMethodMacTest() override {}
+
   void SetUp() override {
     RenderWidgetHostViewMacTest::SetUp();
 
diff --git a/ios/chrome/app/strings/ios_strings.grd b/ios/chrome/app/strings/ios_strings.grd
index 3c95b181..a6b2679e 100644
--- a/ios/chrome/app/strings/ios_strings.grd
+++ b/ios/chrome/app/strings/ios_strings.grd
@@ -1050,6 +1050,9 @@
       <message name="IDS_IOS_READING_LIST_SNACKBAR_MESSAGE" desc="Message briefly displayed at the bottom of the screen to the user to inform that the selected page has been added to the reading list. [Length: 35em]" meaning="The selected page has been added to your reading list. [Length: 35em]">
         Added to Reading List
       </message>
+      <message name="IDS_IOS_READING_LIST_ENTRY_ACCESSIBILITY_LABEL" desc="Accessibility label for a reading list entry. Summarizes fields in the reading list entry (title and url). Read by Text To Speech.">
+        <ph name="TITLE"><ex>Chromium - The Chromium Projects</ex>$1</ph>, <ph name="URL"><ex>http://www.chromium.org/Home</ex>$2</ph>
+      </message>
       <message name="IDS_IOS_READING_LIST_CANCEL_BUTTON" desc="Label of the button to stop editing the reading list entries (delete, mark as read/unread) [Length: 15em]" meaning="Stop editing. [Length: 15em]">
         Cancel
       </message>
diff --git a/ios/chrome/browser/reading_list/BUILD.gn b/ios/chrome/browser/reading_list/BUILD.gn
index 500a8c3..49756335 100644
--- a/ios/chrome/browser/reading_list/BUILD.gn
+++ b/ios/chrome/browser/reading_list/BUILD.gn
@@ -42,6 +42,7 @@
   testonly = true
   sources = [
     "offline_url_utils_unittest.cc",
+    "reading_list_web_state_observer_unittest.mm",
     "url_downloader_unittest.mm",
   ]
   deps = [
diff --git a/ios/chrome/browser/reading_list/reading_list_web_state_observer_unittest.mm b/ios/chrome/browser/reading_list/reading_list_web_state_observer_unittest.mm
new file mode 100644
index 0000000..3008236
--- /dev/null
+++ b/ios/chrome/browser/reading_list/reading_list_web_state_observer_unittest.mm
@@ -0,0 +1,121 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ios/chrome/browser/reading_list/reading_list_web_state_observer.h"
+
+#include "base/memory/ptr_util.h"
+#include "components/reading_list/ios/reading_list_model_impl.h"
+#include "ios/chrome/browser/reading_list/offline_url_utils.h"
+#import "ios/web/public/navigation_item.h"
+#import "ios/web/public/test/test_navigation_manager.h"
+#include "ios/web/public/test/test_web_state.h"
+#include "ios/web/public/test/web_test.h"
+#import "ios/web/public/web_state/web_state.h"
+#include "net/base/network_change_notifier.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+const char kTestURL[] = "http://foo.bar";
+const char kTestTitle[] = "title";
+const char kTestDistilledPath[] = "distilled/page.html";
+}
+
+// A Test navigation manager that checks if Reload was called.
+class TestNavigationManager : public web::TestNavigationManager {
+ public:
+  void Reload(bool check_for_repost) override { reload_called_ = true; }
+  bool ReloadCalled() { return reload_called_; }
+
+ private:
+  bool reload_called_ = false;
+};
+
+// Test fixture to test loading of Reading list entries.
+class ReadingListWebStateObserverTest : public web::WebTest {
+ public:
+  ReadingListWebStateObserverTest() {
+    auto test_navigation_manager = base::MakeUnique<TestNavigationManager>();
+    test_navigation_manager_ = test_navigation_manager.get();
+    pending_item_ = web::NavigationItem::Create();
+    last_committed_item_ = web::NavigationItem::Create();
+    test_navigation_manager->SetPendingItem(pending_item_.get());
+    test_navigation_manager->SetLastCommittedItem(last_committed_item_.get());
+    test_web_state_.SetNavigationManager(std::move(test_navigation_manager));
+    reading_list_model_ =
+        base::MakeUnique<ReadingListModelImpl>(nullptr, nullptr);
+    reading_list_model_->AddEntry(GURL(kTestURL), kTestTitle);
+    ReadingListWebStateObserver::FromWebState(&test_web_state_,
+                                              reading_list_model_.get());
+  }
+
+ protected:
+  std::unique_ptr<web::NavigationItem> pending_item_;
+  std::unique_ptr<web::NavigationItem> last_committed_item_;
+  std::unique_ptr<ReadingListModelImpl> reading_list_model_;
+  TestNavigationManager* test_navigation_manager_;
+  web::TestWebState test_web_state_;
+};
+
+// Tests that failing loading an online version does not mark it read.
+TEST_F(ReadingListWebStateObserverTest, TestLoadReadingListFailure) {
+  GURL url(kTestURL);
+  const ReadingListEntry* entry = reading_list_model_->GetEntryByURL(url);
+  test_navigation_manager_->GetPendingItem()->SetURL(url);
+  test_web_state_.SetLoading(true);
+  test_web_state_.OnPageLoaded(web::PageLoadCompletionStatus::FAILURE);
+  test_web_state_.SetLoading(false);
+
+  EXPECT_FALSE(test_navigation_manager_->ReloadCalled());
+  // Check that |GetLastCommittedItem()| has not been altered.
+  EXPECT_EQ(test_navigation_manager_->GetLastCommittedItem()->GetVirtualURL(),
+            GURL());
+  EXPECT_EQ(test_navigation_manager_->GetLastCommittedItem()->GetURL(), GURL());
+  EXPECT_FALSE(entry->IsRead());
+}
+
+// Tests that loading an online version of an entry.
+TEST_F(ReadingListWebStateObserverTest, TestLoadReadingListOnline) {
+  GURL url(kTestURL);
+  std::string distilled_path = kTestDistilledPath;
+  reading_list_model_->SetEntryDistilledPath(url,
+                                             base::FilePath(distilled_path));
+  const ReadingListEntry* entry = reading_list_model_->GetEntryByURL(url);
+  GURL distilled_url =
+      reading_list::DistilledURLForPath(entry->DistilledPath(), entry->URL());
+
+  test_navigation_manager_->GetPendingItem()->SetURL(url);
+  test_web_state_.SetLoading(true);
+  test_web_state_.OnPageLoaded(web::PageLoadCompletionStatus::SUCCESS);
+  test_web_state_.SetLoading(false);
+
+  EXPECT_FALSE(test_navigation_manager_->ReloadCalled());
+  // Check that |GetLastCommittedItem()| has not been altered.
+  EXPECT_EQ(test_navigation_manager_->GetLastCommittedItem()->GetVirtualURL(),
+            GURL());
+  EXPECT_EQ(test_navigation_manager_->GetLastCommittedItem()->GetURL(), GURL());
+  EXPECT_TRUE(entry->IsRead());
+}
+
+// Tests that loading a distilled version of an entry.
+TEST_F(ReadingListWebStateObserverTest, TestLoadReadingListDistilled) {
+  GURL url(kTestURL);
+  std::string distilled_path = kTestDistilledPath;
+  reading_list_model_->SetEntryDistilledPath(url,
+                                             base::FilePath(distilled_path));
+  const ReadingListEntry* entry = reading_list_model_->GetEntryByURL(url);
+  GURL distilled_url =
+      reading_list::DistilledURLForPath(entry->DistilledPath(), entry->URL());
+
+  test_navigation_manager_->GetPendingItem()->SetURL(url);
+  test_web_state_.SetLoading(true);
+  test_web_state_.OnPageLoaded(web::PageLoadCompletionStatus::FAILURE);
+  test_web_state_.SetLoading(false);
+
+  EXPECT_TRUE(test_navigation_manager_->ReloadCalled());
+  EXPECT_EQ(test_navigation_manager_->GetLastCommittedItem()->GetVirtualURL(),
+            url);
+  EXPECT_EQ(test_navigation_manager_->GetLastCommittedItem()->GetURL(),
+            distilled_url);
+  EXPECT_TRUE(entry->IsRead());
+}
diff --git a/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.h b/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.h
index a0f21557..afda7ca 100644
--- a/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.h
+++ b/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.h
@@ -45,9 +45,6 @@
 @property(nonatomic, readonly, strong) UILabel* detailTextLabel;
 // View for displaying the favicon for the reading list entry.
 @property(nonatomic, readonly, strong) FaviconViewNew* faviconView;
-// Status of the offline version. Updates the visual indicator when updated.
-@property(nonatomic, assign)
-    ReadingListEntry::DistillationState distillationState;
 
 @end
 
diff --git a/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.mm b/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.mm
index 6fa6ecc..c90b5e36 100644
--- a/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.mm
+++ b/ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.mm
@@ -4,11 +4,14 @@
 
 #import "ios/chrome/browser/ui/reading_list/reading_list_collection_view_item.h"
 
+#include "base/strings/sys_string_conversions.h"
 #import "ios/chrome/browser/ui/colors/MDCPalette+CrAdditions.h"
 #import "ios/chrome/browser/ui/favicon_view.h"
 #import "ios/chrome/browser/ui/uikit_ui_util.h"
+#include "ios/chrome/grit/ios_strings.h"
 #import "ios/third_party/material_components_ios/src/components/Palettes/src/MaterialPalettes.h"
 #import "ios/third_party/material_roboto_font_loader_ios/src/src/MaterialRobotoFontLoader.h"
+#include "ui/base/l10n/l10n_util.h"
 #import "url/gurl.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
@@ -34,6 +37,9 @@
 @interface ReadingListCell ()
 
 @property(nonatomic, weak) id<ReadingListCellDelegate> delegate;
+// Status of the offline version. Updates the visual indicator when updated.
+@property(nonatomic, assign)
+    ReadingListEntry::DistillationState distillationState;
 
 @end
 
@@ -102,6 +108,11 @@
   self.displayedCell = cell;
   cell.delegate = self;
   cell.distillationState = _distillationState;
+  cell.isAccessibilityElement = YES;
+  cell.accessibilityLabel =
+      l10n_util::GetNSStringF(IDS_IOS_READING_LIST_ENTRY_ACCESSIBILITY_LABEL,
+                              base::SysNSStringToUTF16(self.text),
+                              base::SysNSStringToUTF16(self.detailText));
 }
 
 #pragma mark - ReadingListCellDelegate
diff --git a/ios/chrome/share_extension/share_extension_view.mm b/ios/chrome/share_extension/share_extension_view.mm
index c417dd5..7710d4b 100644
--- a/ios/chrome/share_extension/share_extension_view.mm
+++ b/ios/chrome/share_extension/share_extension_view.mm
@@ -40,7 +40,7 @@
   [super setHighlighted:highlighted];
 
   if (highlighted)
-    self.backgroundColor = [UIColor colorWithWhite:0.98 alpha:1];
+    self.backgroundColor = [UIColor colorWithWhite:217.0f / 255.0f alpha:1];
   else
     self.backgroundColor = [UIColor clearColor];
 }
@@ -97,6 +97,8 @@
     UIVibrancyEffect* vibrancyEffect =
         [UIVibrancyEffect effectForBlurEffect:blurEffect];
 
+    self.backgroundColor = [UIColor colorWithWhite:242.0f / 255.0f alpha:1];
+
     // Add the blur effect to the whole widget.
     UIVisualEffectView* blurringView =
         [[UIVisualEffectView alloc] initWithEffect:blurEffect];
diff --git a/ios/web/BUILD.gn b/ios/web/BUILD.gn
index 6076341a..27ea438 100644
--- a/ios/web/BUILD.gn
+++ b/ios/web/BUILD.gn
@@ -419,6 +419,8 @@
     "public/test/test_native_content.mm",
     "public/test/test_native_content_provider.h",
     "public/test/test_native_content_provider.mm",
+    "public/test/test_navigation_manager.h",
+    "public/test/test_navigation_manager.mm",
     "public/test/test_redirect_observer.h",
     "public/test/test_redirect_observer.mm",
     "public/test/test_web_client.h",
diff --git a/ios/web/public/test/test_navigation_manager.h b/ios/web/public/test/test_navigation_manager.h
new file mode 100644
index 0000000..a85644e
--- /dev/null
+++ b/ios/web/public/test/test_navigation_manager.h
@@ -0,0 +1,54 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_PUBLIC_TEST_TEST_NAVIGATION_MANAGER_H_
+#define IOS_WEB_PUBLIC_TEST_TEST_NAVIGATION_MANAGER_H_
+
+#import "ios/web/public/navigation_manager.h"
+
+namespace web {
+
+// A minimal implementation of web::NavigationManager that raises NOTREACHED()
+// on most calls.
+class TestNavigationManager : public web::NavigationManager {
+ public:
+  TestNavigationManager();
+  ~TestNavigationManager() override;
+  BrowserState* GetBrowserState() const override;
+  WebState* GetWebState() const override;
+  NavigationItem* GetVisibleItem() const override;
+  NavigationItem* GetLastCommittedItem() const override;
+  NavigationItem* GetPendingItem() const override;
+  NavigationItem* GetTransientItem() const override;
+  void DiscardNonCommittedItems() override;
+  void LoadIfNecessary() override;
+  void LoadURLWithParams(const NavigationManager::WebLoadParams&) override;
+  void AddTransientURLRewriter(
+      BrowserURLRewriter::URLRewriter rewriter) override;
+  int GetItemCount() const override;
+  NavigationItem* GetItemAtIndex(size_t index) const override;
+  int GetCurrentItemIndex() const override;
+  int GetPendingItemIndex() const override;
+  int GetLastCommittedItemIndex() const override;
+  bool RemoveItemAtIndex(int index) override;
+  bool CanGoBack() const override;
+  bool CanGoForward() const override;
+  bool CanGoToOffset(int offset) const override;
+  void GoBack() override;
+  void GoForward() override;
+  void GoToIndex(int index) override;
+  void Reload(bool check_for_reposts) override;
+
+  // Setters for test data.
+  void SetLastCommittedItem(NavigationItem* item);
+  void SetPendingItem(NavigationItem* item);
+
+ private:
+  NavigationItem* pending_item_;
+  NavigationItem* last_committed_item_;
+};
+
+}  // namespace web
+
+#endif
diff --git a/ios/web/public/test/test_navigation_manager.mm b/ios/web/public/test/test_navigation_manager.mm
new file mode 100644
index 0000000..0966d35
--- /dev/null
+++ b/ios/web/public/test/test_navigation_manager.mm
@@ -0,0 +1,136 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ios/web/public/test/test_navigation_manager.h"
+
+namespace web {
+
+TestNavigationManager::TestNavigationManager() {}
+
+TestNavigationManager::~TestNavigationManager() {}
+
+BrowserState* TestNavigationManager::GetBrowserState() const {
+  NOTREACHED();
+  return nullptr;
+}
+
+WebState* TestNavigationManager::GetWebState() const {
+  NOTREACHED();
+  return nullptr;
+}
+
+NavigationItem* TestNavigationManager::GetVisibleItem() const {
+  NOTREACHED();
+  return nullptr;
+}
+
+NavigationItem* TestNavigationManager::GetLastCommittedItem() const {
+  return last_committed_item_;
+}
+
+void TestNavigationManager::SetLastCommittedItem(NavigationItem* item) {
+  last_committed_item_ = item;
+}
+
+NavigationItem* TestNavigationManager::GetPendingItem() const {
+  return pending_item_;
+}
+
+void TestNavigationManager::SetPendingItem(NavigationItem* item) {
+  pending_item_ = item;
+}
+
+web::NavigationItem* TestNavigationManager::GetTransientItem() const {
+  NOTREACHED();
+  return nullptr;
+}
+
+void TestNavigationManager::DiscardNonCommittedItems() {
+  NOTREACHED();
+  return;
+}
+
+void TestNavigationManager::LoadIfNecessary() {
+  NOTREACHED();
+  return;
+}
+
+void TestNavigationManager::LoadURLWithParams(
+    const NavigationManager::WebLoadParams& params) {
+  NOTREACHED();
+  return;
+}
+
+void TestNavigationManager::AddTransientURLRewriter(
+    BrowserURLRewriter::URLRewriter rewriter) {
+  NOTREACHED();
+  return;
+}
+
+int TestNavigationManager::GetItemCount() const {
+  NOTREACHED();
+  return 0;
+}
+
+web::NavigationItem* TestNavigationManager::GetItemAtIndex(size_t index) const {
+  NOTREACHED();
+  return nullptr;
+}
+
+int TestNavigationManager::GetCurrentItemIndex() const {
+  NOTREACHED();
+  return 0;
+}
+
+int TestNavigationManager::GetLastCommittedItemIndex() const {
+  NOTREACHED();
+  return 0;
+}
+
+int TestNavigationManager::GetPendingItemIndex() const {
+  NOTREACHED();
+  return 0;
+}
+
+bool TestNavigationManager::RemoveItemAtIndex(int index) {
+  NOTREACHED();
+  return false;
+}
+
+bool TestNavigationManager::CanGoBack() const {
+  NOTREACHED();
+  return false;
+}
+
+bool TestNavigationManager::CanGoForward() const {
+  NOTREACHED();
+  return false;
+}
+
+bool TestNavigationManager::CanGoToOffset(int offset) const {
+  NOTREACHED();
+  return false;
+}
+
+void TestNavigationManager::GoBack() {
+  NOTREACHED();
+  return;
+}
+
+void TestNavigationManager::GoForward() {
+  NOTREACHED();
+  return;
+}
+
+void TestNavigationManager::GoToIndex(int index) {
+  NOTREACHED();
+  return;
+}
+
+void TestNavigationManager::Reload(bool check_for_repost) {
+  NOTREACHED();
+  return;
+}
+
+}  // namespace web
diff --git a/ios/web/public/test/test_web_state.h b/ios/web/public/test/test_web_state.h
index b47baa9..ca2e121 100644
--- a/ios/web/public/test/test_web_state.h
+++ b/ios/web/public/test/test_web_state.h
@@ -11,8 +11,10 @@
 
 #include "base/observer_list.h"
 #include "base/strings/string16.h"
+#import "ios/web/public/navigation_manager.h"
 #include "ios/web/public/web_state/url_verification_constants.h"
-#include "ios/web/public/web_state/web_state.h"
+#import "ios/web/public/web_state/web_state.h"
+#include "ios/web/public/web_state/web_state_observer.h"
 #include "url/gurl.h"
 
 namespace web {
@@ -79,6 +81,11 @@
   void SetLoading(bool is_loading);
   void SetCurrentURL(const GURL& url);
   void SetTrustLevel(URLVerificationTrustLevel trust_level);
+  void SetNavigationManager(
+      std::unique_ptr<NavigationManager> navigation_manager);
+
+  // Notifier for tests.
+  void OnPageLoaded(PageLoadCompletionStatus load_completion_status);
 
  private:
   bool web_usage_enabled_;
@@ -89,6 +96,7 @@
   bool content_is_html_;
   std::string mime_type_;
   std::string content_language_;
+  std::unique_ptr<NavigationManager> navigation_manager_;
 
   // A list of observers notified when page state changes. Weak references.
   base::ObserverList<WebStateObserver, true> observers_;
diff --git a/ios/web/public/test/test_web_state.mm b/ios/web/public/test/test_web_state.mm
index 732e8769..e6665844 100644
--- a/ios/web/public/test/test_web_state.mm
+++ b/ios/web/public/test/test_web_state.mm
@@ -61,11 +61,16 @@
 }
 
 const NavigationManager* TestWebState::GetNavigationManager() const {
-  return nullptr;
+  return navigation_manager_.get();
 }
 
 NavigationManager* TestWebState::GetNavigationManager() {
-  return nullptr;
+  return navigation_manager_.get();
+}
+
+void TestWebState::SetNavigationManager(
+    std::unique_ptr<NavigationManager> navigation_manager) {
+  navigation_manager_ = std::move(navigation_manager);
 }
 
 CRWJSInjectionReceiver* TestWebState::GetJSInjectionReceiver() const {
@@ -147,6 +152,12 @@
   }
 }
 
+void TestWebState::OnPageLoaded(
+    PageLoadCompletionStatus load_completion_status) {
+  for (auto& observer : observers_)
+    observer.PageLoaded(load_completion_status);
+}
+
 void TestWebState::SetCurrentURL(const GURL& url) {
   url_ = url;
 }
diff --git a/media/BUILD.gn b/media/BUILD.gn
index 279eab9b..c886c396 100644
--- a/media/BUILD.gn
+++ b/media/BUILD.gn
@@ -736,6 +736,14 @@
 # Contains tests for all targets in the "media" folder.
 # TODO(xhwang): Move mojo/capture/remoting tests here where applicable.
 test("media_unittests") {
+  # crbug.com/676418: Suppress symbol import warnings.
+  if (is_win && is_component_build) {
+    ldflags = [
+      "/ignore:4217",
+      "/ignore:4049",
+    ]
+  }
+
   deps = [
     ":unit_tests",
     "//media/audio:unit_tests",
diff --git a/media/gpu/generic_v4l2_device.cc b/media/gpu/generic_v4l2_device.cc
index 830d004..e98ea72ed 100644
--- a/media/gpu/generic_v4l2_device.cc
+++ b/media/gpu/generic_v4l2_device.cc
@@ -434,7 +434,7 @@
       break;
     case Type::kJpegDecoder:
       device_pattern = kJpegDecoderDevicePattern;
-      buf_type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+      buf_type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
       break;
   }
 
diff --git a/media/gpu/v4l2_device.cc b/media/gpu/v4l2_device.cc
index 3dcd1bf..718d566 100644
--- a/media/gpu/v4l2_device.cc
+++ b/media/gpu/v4l2_device.cc
@@ -56,6 +56,9 @@
     case V4L2_PIX_FMT_YVU420:
       return PIXEL_FORMAT_YV12;
 
+    case V4L2_PIX_FMT_YUV422M:
+      return PIXEL_FORMAT_I422;
+
     case V4L2_PIX_FMT_RGB32:
       return PIXEL_FORMAT_ARGB;
 
diff --git a/media/gpu/v4l2_jpeg_decode_accelerator.cc b/media/gpu/v4l2_jpeg_decode_accelerator.cc
index ab39a53..f99ef67 100644
--- a/media/gpu/v4l2_jpeg_decode_accelerator.cc
+++ b/media/gpu/v4l2_jpeg_decode_accelerator.cc
@@ -13,6 +13,7 @@
 
 #include "base/big_endian.h"
 #include "base/bind.h"
+#include "base/numerics/safe_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "media/filters/jpeg_parser.h"
 #include "media/gpu/v4l2_jpeg_decode_accelerator.h"
@@ -63,6 +64,17 @@
     *(out) = _out;                                                         \
   } while (0)
 
+namespace {
+
+// Input pixel format (i.e. V4L2_PIX_FMT_JPEG) has only one physical plane.
+const size_t kMaxInputPlanes = 1;
+
+// This class can only handle V4L2_PIX_FMT_JPEG as input, so kMaxInputPlanes
+// can only be 1.
+static_assert(kMaxInputPlanes == 1,
+              "kMaxInputPlanes must be 1 as input must be V4L2_PIX_FMT_JPEG");
+}
+
 namespace media {
 
 // This is default huffman segment for 8-bit precision luminance and
@@ -107,8 +119,10 @@
     0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7,
     0xE8, 0xE9, 0xEA, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8, 0xF9, 0xFA};
 
-V4L2JpegDecodeAccelerator::BufferRecord::BufferRecord()
-    : address(nullptr), length(0), at_device(false) {}
+V4L2JpegDecodeAccelerator::BufferRecord::BufferRecord() : at_device(false) {
+  memset(address, 0, sizeof(address));
+  memset(length, 0, sizeof(length));
+}
 
 V4L2JpegDecodeAccelerator::BufferRecord::~BufferRecord() {}
 
@@ -125,6 +139,7 @@
     const scoped_refptr<V4L2Device>& device,
     const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner)
     : output_buffer_pixelformat_(0),
+      output_buffer_num_planes_(0),
       child_task_runner_(base::ThreadTaskRunnerHandle::Get()),
       io_task_runner_(io_task_runner),
       client_(nullptr),
@@ -194,7 +209,7 @@
 
   // Capabilities check.
   struct v4l2_capability caps;
-  const __u32 kCapsRequired = V4L2_CAP_STREAMING | V4L2_CAP_VIDEO_M2M;
+  const __u32 kCapsRequired = V4L2_CAP_STREAMING | V4L2_CAP_VIDEO_M2M_MPLANE;
   memset(&caps, 0, sizeof(caps));
   if (device_->Ioctl(VIDIOC_QUERYCAP, &caps) != 0) {
     PLOG(ERROR) << __func__ << ": ioctl() failed: VIDIOC_QUERYCAP";
@@ -297,7 +312,7 @@
   // Check input buffer size is enough
   return (input_buffer_map_.empty() ||
           (job_record->shm.size() + sizeof(kDefaultDhtSeg)) >
-              input_buffer_map_.front().length);
+              input_buffer_map_.front().length[0]);
 }
 
 bool V4L2JpegDecodeAccelerator::RecreateInputBuffers() {
@@ -344,16 +359,17 @@
   size_t reserve_size = (job_record->shm.size() + sizeof(kDefaultDhtSeg)) * 2;
   struct v4l2_format format;
   memset(&format, 0, sizeof(format));
-  format.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
-  format.fmt.pix.pixelformat = V4L2_PIX_FMT_JPEG;
-  format.fmt.pix.sizeimage = reserve_size;
-  format.fmt.pix.field = V4L2_FIELD_ANY;
+  format.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
+  format.fmt.pix_mp.pixelformat = V4L2_PIX_FMT_JPEG;
+  format.fmt.pix_mp.plane_fmt[0].sizeimage = reserve_size;
+  format.fmt.pix_mp.field = V4L2_FIELD_ANY;
+  format.fmt.pix_mp.num_planes = kMaxInputPlanes;
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_S_FMT, &format);
 
   struct v4l2_requestbuffers reqbufs;
   memset(&reqbufs, 0, sizeof(reqbufs));
   reqbufs.count = kBufferCount;
-  reqbufs.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+  reqbufs.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
   reqbufs.memory = V4L2_MEMORY_MMAP;
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_REQBUFS, &reqbufs);
 
@@ -364,20 +380,30 @@
     free_input_buffers_.push_back(i);
 
     struct v4l2_buffer buffer;
+    struct v4l2_plane planes[VIDEO_MAX_PLANES];
     memset(&buffer, 0, sizeof(buffer));
+    memset(planes, 0, sizeof(planes));
     buffer.index = i;
-    buffer.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+    buffer.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
+    buffer.m.planes = planes;
+    buffer.length = arraysize(planes);
     buffer.memory = V4L2_MEMORY_MMAP;
     IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_QUERYBUF, &buffer);
-    void* address = device_->Mmap(NULL, buffer.length, PROT_READ | PROT_WRITE,
-                                  MAP_SHARED, buffer.m.offset);
-    if (address == MAP_FAILED) {
-      PLOG(ERROR) << __func__ << ": mmap() failed";
-      PostNotifyError(kInvalidBitstreamBufferId, PLATFORM_FAILURE);
+    if (buffer.length != kMaxInputPlanes) {
       return false;
     }
-    input_buffer_map_[i].address = address;
-    input_buffer_map_[i].length = buffer.length;
+    for (size_t j = 0; j < buffer.length; ++j) {
+      void* address =
+          device_->Mmap(NULL, planes[j].length, PROT_READ | PROT_WRITE,
+                        MAP_SHARED, planes[j].m.mem_offset);
+      if (address == MAP_FAILED) {
+        PLOG(ERROR) << __func__ << ": mmap() failed";
+        PostNotifyError(kInvalidBitstreamBufferId, PLATFORM_FAILURE);
+        return false;
+      }
+      input_buffer_map_[i].address[j] = address;
+      input_buffer_map_[i].length[j] = planes[j].length;
+    }
   }
 
   return true;
@@ -394,54 +420,74 @@
       PIXEL_FORMAT_I420, job_record->out_frame->coded_size());
   struct v4l2_format format;
   memset(&format, 0, sizeof(format));
-  format.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-  format.fmt.pix.width = job_record->out_frame->coded_size().width();
-  format.fmt.pix.height = job_record->out_frame->coded_size().height();
-  format.fmt.pix.sizeimage = frame_size;
-  format.fmt.pix.pixelformat = V4L2_PIX_FMT_YUV420;
-  format.fmt.pix.field = V4L2_FIELD_ANY;
+  format.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
+  format.fmt.pix_mp.width = job_record->out_frame->coded_size().width();
+  format.fmt.pix_mp.height = job_record->out_frame->coded_size().height();
+  format.fmt.pix_mp.num_planes = 1;
+  format.fmt.pix_mp.pixelformat = V4L2_PIX_FMT_YUV420;
+  format.fmt.pix_mp.plane_fmt[0].sizeimage = frame_size;
+  format.fmt.pix_mp.field = V4L2_FIELD_ANY;
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_S_FMT, &format);
-  output_buffer_pixelformat_ = format.fmt.pix.pixelformat;
-  output_buffer_coded_size_.SetSize(format.fmt.pix.width,
-                                    format.fmt.pix.height);
+  output_buffer_pixelformat_ = format.fmt.pix_mp.pixelformat;
+  output_buffer_coded_size_.SetSize(format.fmt.pix_mp.width,
+                                    format.fmt.pix_mp.height);
+  output_buffer_num_planes_ = format.fmt.pix_mp.num_planes;
+
+  VideoPixelFormat output_format =
+      V4L2Device::V4L2PixFmtToVideoPixelFormat(output_buffer_pixelformat_);
+  if (output_format == PIXEL_FORMAT_UNKNOWN) {
+    PLOG(ERROR) << __func__ << ": unknown V4L2 pixel format: "
+                << output_buffer_pixelformat_;
+    PostNotifyError(kInvalidBitstreamBufferId, PLATFORM_FAILURE);
+    return false;
+  }
 
   struct v4l2_requestbuffers reqbufs;
   memset(&reqbufs, 0, sizeof(reqbufs));
   reqbufs.count = kBufferCount;
-  reqbufs.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+  reqbufs.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
   reqbufs.memory = V4L2_MEMORY_MMAP;
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_REQBUFS, &reqbufs);
 
   DCHECK(output_buffer_map_.empty());
   output_buffer_map_.resize(reqbufs.count);
 
-  VideoPixelFormat output_format =
-      V4L2Device::V4L2PixFmtToVideoPixelFormat(output_buffer_pixelformat_);
-
   for (size_t i = 0; i < output_buffer_map_.size(); ++i) {
     free_output_buffers_.push_back(i);
 
     struct v4l2_buffer buffer;
+    struct v4l2_plane planes[VIDEO_MAX_PLANES];
     memset(&buffer, 0, sizeof(buffer));
+    memset(planes, 0, sizeof(planes));
     buffer.index = i;
-    buffer.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+    buffer.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
     buffer.memory = V4L2_MEMORY_MMAP;
+    buffer.m.planes = planes;
+    buffer.length = arraysize(planes);
     IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_QUERYBUF, &buffer);
 
-    DCHECK_GE(buffer.length,
-              VideoFrame::AllocationSize(
-                  output_format,
-                  gfx::Size(format.fmt.pix.width, format.fmt.pix.height)));
-
-    void* address = device_->Mmap(NULL, buffer.length, PROT_READ | PROT_WRITE,
-                                  MAP_SHARED, buffer.m.offset);
-    if (address == MAP_FAILED) {
-      PLOG(ERROR) << __func__ << ": mmap() failed";
-      PostNotifyError(kInvalidBitstreamBufferId, PLATFORM_FAILURE);
+    if (output_buffer_num_planes_ != buffer.length) {
       return false;
     }
-    output_buffer_map_[i].address = address;
-    output_buffer_map_[i].length = buffer.length;
+    for (size_t j = 0; j < buffer.length; ++j) {
+      if (base::checked_cast<int64_t>(planes[j].length) <
+          VideoFrame::PlaneSize(
+              output_format, j,
+              gfx::Size(format.fmt.pix_mp.width, format.fmt.pix_mp.height))
+              .GetArea()) {
+        return false;
+      }
+      void* address =
+          device_->Mmap(NULL, planes[j].length, PROT_READ | PROT_WRITE,
+                        MAP_SHARED, planes[j].m.mem_offset);
+      if (address == MAP_FAILED) {
+        PLOG(ERROR) << __func__ << ": mmap() failed";
+        PostNotifyError(kInvalidBitstreamBufferId, PLATFORM_FAILURE);
+        return false;
+      }
+      output_buffer_map_[i].address[j] = address;
+      output_buffer_map_[i].length[j] = planes[j].length;
+    }
   }
 
   return true;
@@ -456,20 +502,21 @@
     return;
 
   if (input_streamon_) {
-    __u32 type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+    __u32 type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
     IOCTL_OR_ERROR_RETURN(VIDIOC_STREAMOFF, &type);
     input_streamon_ = false;
   }
 
-  for (size_t i = 0; i < input_buffer_map_.size(); ++i) {
-    BufferRecord& input_record = input_buffer_map_[i];
-    device_->Munmap(input_record.address, input_record.length);
+  for (const auto& input_record : input_buffer_map_) {
+    for (size_t i = 0; i < kMaxInputPlanes; ++i) {
+      device_->Munmap(input_record.address[i], input_record.length[i]);
+    }
   }
 
   struct v4l2_requestbuffers reqbufs;
   memset(&reqbufs, 0, sizeof(reqbufs));
   reqbufs.count = 0;
-  reqbufs.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+  reqbufs.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
   reqbufs.memory = V4L2_MEMORY_MMAP;
   IOCTL_OR_LOG_ERROR(VIDIOC_REQBUFS, &reqbufs);
 
@@ -485,24 +532,26 @@
     return;
 
   if (output_streamon_) {
-    __u32 type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+    __u32 type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
     IOCTL_OR_ERROR_RETURN(VIDIOC_STREAMOFF, &type);
     output_streamon_ = false;
   }
 
-  for (size_t i = 0; i < output_buffer_map_.size(); ++i) {
-    BufferRecord& output_record = output_buffer_map_[i];
-    device_->Munmap(output_record.address, output_record.length);
+  for (const auto& output_record : output_buffer_map_) {
+    for (size_t i = 0; i < output_buffer_num_planes_; ++i) {
+      device_->Munmap(output_record.address[i], output_record.length[i]);
+    }
   }
 
   struct v4l2_requestbuffers reqbufs;
   memset(&reqbufs, 0, sizeof(reqbufs));
   reqbufs.count = 0;
-  reqbufs.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+  reqbufs.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
   reqbufs.memory = V4L2_MEMORY_MMAP;
   IOCTL_OR_LOG_ERROR(VIDIOC_REQBUFS, &reqbufs);
 
   output_buffer_map_.clear();
+  output_buffer_num_planes_ = 0;
 }
 
 void V4L2JpegDecodeAccelerator::DevicePollTask() {
@@ -597,7 +646,7 @@
   // Check here because we cannot STREAMON before QBUF in earlier kernel.
   // (kernel version < 3.14)
   if (!input_streamon_ && InputBufferQueuedCount()) {
-    __u32 type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+    __u32 type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
     IOCTL_OR_ERROR_RETURN(VIDIOC_STREAMON, &type);
     input_streamon_ = true;
   }
@@ -615,19 +664,15 @@
   // Check here because we cannot STREAMON before QBUF in earlier kernel.
   // (kernel version < 3.14)
   if (!output_streamon_ && OutputBufferQueuedCount()) {
-    __u32 type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+    __u32 type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
     IOCTL_OR_ERROR_RETURN(VIDIOC_STREAMON, &type);
     output_streamon_ = true;
   }
 }
 
-static bool CopyOutputImage(const uint32_t src_pixelformat,
-                            const void* src_addr,
-                            const gfx::Size& src_coded_size,
-                            const scoped_refptr<VideoFrame>& dst_frame) {
-  VideoPixelFormat format =
-      V4L2Device::V4L2PixFmtToVideoPixelFormat(src_pixelformat);
-  size_t src_size = VideoFrame::AllocationSize(format, src_coded_size);
+bool V4L2JpegDecodeAccelerator::ConvertOutputImage(
+    const BufferRecord& output_buffer,
+    const scoped_refptr<VideoFrame>& dst_frame) {
   uint8_t* dst_y = dst_frame->data(VideoFrame::kYPlane);
   uint8_t* dst_u = dst_frame->data(VideoFrame::kUPlane);
   uint8_t* dst_v = dst_frame->data(VideoFrame::kVPlane);
@@ -635,20 +680,54 @@
   size_t dst_u_stride = dst_frame->stride(VideoFrame::kUPlane);
   size_t dst_v_stride = dst_frame->stride(VideoFrame::kVPlane);
 
-  // If the source format is I420, ConvertToI420 will simply copy the frame.
-  if (libyuv::ConvertToI420(static_cast<uint8_t*>(const_cast<void*>(src_addr)),
-                            src_size,
-                            dst_y, dst_y_stride,
-                            dst_u, dst_u_stride,
-                            dst_v, dst_v_stride,
-                            0, 0,
-                            src_coded_size.width(),
-                            src_coded_size.height(),
-                            dst_frame->coded_size().width(),
-                            dst_frame->coded_size().height(),
-                            libyuv::kRotate0,
-                            src_pixelformat)) {
-    LOG(ERROR) << "ConvertToI420 failed. Source format: " << src_pixelformat;
+  if (output_buffer_num_planes_ == 1) {
+    // Use ConvertToI420 to convert all splane buffers.
+    // If the source format is I420, ConvertToI420 will simply copy the frame.
+    VideoPixelFormat format =
+        V4L2Device::V4L2PixFmtToVideoPixelFormat(output_buffer_pixelformat_);
+    size_t src_size =
+        VideoFrame::AllocationSize(format, output_buffer_coded_size_);
+    if (libyuv::ConvertToI420(
+            static_cast<uint8_t*>(output_buffer.address[0]), src_size, dst_y,
+            dst_y_stride, dst_u, dst_u_stride, dst_v, dst_v_stride, 0, 0,
+            output_buffer_coded_size_.width(),
+            output_buffer_coded_size_.height(), dst_frame->coded_size().width(),
+            dst_frame->coded_size().height(), libyuv::kRotate0,
+            output_buffer_pixelformat_)) {
+      LOG(ERROR) << "ConvertToI420 failed. Source format: "
+                 << output_buffer_pixelformat_;
+      return false;
+    }
+  } else if (output_buffer_pixelformat_ == V4L2_PIX_FMT_YUV420M ||
+             output_buffer_pixelformat_ == V4L2_PIX_FMT_YUV422M) {
+    uint8_t* src_y = static_cast<uint8_t*>(output_buffer.address[0]);
+    uint8_t* src_u = static_cast<uint8_t*>(output_buffer.address[1]);
+    uint8_t* src_v = static_cast<uint8_t*>(output_buffer.address[2]);
+    size_t src_y_stride = output_buffer_coded_size_.width();
+    size_t src_u_stride = output_buffer_coded_size_.width() / 2;
+    size_t src_v_stride = output_buffer_coded_size_.width() / 2;
+    if (output_buffer_pixelformat_ == V4L2_PIX_FMT_YUV420M) {
+      if (libyuv::I420Copy(src_y, src_y_stride, src_u, src_u_stride, src_v,
+                           src_v_stride, dst_y, dst_y_stride, dst_u,
+                           dst_u_stride, dst_v, dst_v_stride,
+                           output_buffer_coded_size_.width(),
+                           output_buffer_coded_size_.height())) {
+        LOG(ERROR) << "I420Copy failed";
+        return false;
+      }
+    } else {  // output_buffer_pixelformat_ == V4L2_PIX_FMT_YUV422M
+      if (libyuv::I422ToI420(src_y, src_y_stride, src_u, src_u_stride, src_v,
+                             src_v_stride, dst_y, dst_y_stride, dst_u,
+                             dst_u_stride, dst_v, dst_v_stride,
+                             output_buffer_coded_size_.width(),
+                             output_buffer_coded_size_.height())) {
+        LOG(ERROR) << "I422ToI420 failed";
+        return false;
+      }
+    }
+  } else {
+    LOG(ERROR) << "Unsupported source buffer format: "
+               << output_buffer_pixelformat_;
     return false;
   }
   return true;
@@ -660,11 +739,15 @@
   // Dequeue completed input (VIDEO_OUTPUT) buffers,
   // and recycle to the free list.
   struct v4l2_buffer dqbuf;
+  struct v4l2_plane planes[VIDEO_MAX_PLANES];
   while (InputBufferQueuedCount() > 0) {
     DCHECK(input_streamon_);
     memset(&dqbuf, 0, sizeof(dqbuf));
-    dqbuf.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+    memset(planes, 0, sizeof(planes));
+    dqbuf.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
     dqbuf.memory = V4L2_MEMORY_MMAP;
+    dqbuf.length = arraysize(planes);
+    dqbuf.m.planes = planes;
     if (device_->Ioctl(VIDIOC_DQBUF, &dqbuf) != 0) {
       if (errno == EAGAIN) {
         // EAGAIN if we're just out of buffers to dequeue.
@@ -694,11 +777,14 @@
   while (!running_jobs_.empty() && OutputBufferQueuedCount() > 0) {
     DCHECK(output_streamon_);
     memset(&dqbuf, 0, sizeof(dqbuf));
-    dqbuf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+    memset(planes, 0, sizeof(planes));
+    dqbuf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
     // From experiments, using MMAP and memory copy is still faster than
     // USERPTR. Also, client doesn't need to consider the buffer alignment and
     // JpegDecodeAccelerator API will be simpler.
     dqbuf.memory = V4L2_MEMORY_MMAP;
+    dqbuf.length = arraysize(planes);
+    dqbuf.m.planes = planes;
     if (device_->Ioctl(VIDIOC_DQBUF, &dqbuf) != 0) {
       if (errno == EAGAIN) {
         // EAGAIN if we're just out of buffers to dequeue.
@@ -724,12 +810,10 @@
       // Copy the decoded data from output buffer to the buffer provided by the
       // client. Do format conversion when output format is not
       // V4L2_PIX_FMT_YUV420.
-      if (!CopyOutputImage(output_buffer_pixelformat_, output_record.address,
-                           output_buffer_coded_size_, job_record->out_frame)) {
+      if (!ConvertOutputImage(output_record, job_record->out_frame)) {
         PostNotifyError(job_record->bitstream_buffer_id, PLATFORM_FAILURE);
         return;
       }
-
       DVLOG(3) << "Decoding finished, returning bitstream buffer, id="
                << job_record->bitstream_buffer_id;
 
@@ -834,16 +918,22 @@
 
   // It will add default huffman segment if it's missing.
   if (!AddHuffmanTable(job_record->shm.memory(), job_record->shm.size(),
-                       input_record.address, input_record.length)) {
+                       input_record.address[0], input_record.length[0])) {
     PostNotifyError(job_record->bitstream_buffer_id, PARSE_JPEG_FAILED);
     return false;
   }
 
   struct v4l2_buffer qbuf;
+  struct v4l2_plane planes[VIDEO_MAX_PLANES];
   memset(&qbuf, 0, sizeof(qbuf));
+  memset(planes, 0, sizeof(planes));
   qbuf.index = index;
-  qbuf.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+  qbuf.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
   qbuf.memory = V4L2_MEMORY_MMAP;
+  qbuf.length = arraysize(planes);
+  // There is only one plane for V4L2_PIX_FMT_JPEG.
+  planes[0].bytesused = input_record.length[0];
+  qbuf.m.planes = planes;
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_QBUF, &qbuf);
   input_record.at_device = true;
   running_jobs_.push(job_record);
@@ -857,16 +947,21 @@
 
 bool V4L2JpegDecodeAccelerator::EnqueueOutputRecord() {
   DCHECK(!free_output_buffers_.empty());
+  DCHECK_GT(output_buffer_num_planes_, 0u);
 
   // Enqueue an output (VIDEO_CAPTURE) buffer.
   const int index = free_output_buffers_.back();
   BufferRecord& output_record = output_buffer_map_[index];
   DCHECK(!output_record.at_device);
   struct v4l2_buffer qbuf;
+  struct v4l2_plane planes[VIDEO_MAX_PLANES];
   memset(&qbuf, 0, sizeof(qbuf));
+  memset(planes, 0, sizeof(planes));
   qbuf.index = index;
-  qbuf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+  qbuf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
   qbuf.memory = V4L2_MEMORY_MMAP;
+  qbuf.length = arraysize(planes);
+  qbuf.m.planes = planes;
   IOCTL_OR_ERROR_RETURN_FALSE(VIDIOC_QBUF, &qbuf);
   output_record.at_device = true;
   free_output_buffers_.pop_back();
diff --git a/media/gpu/v4l2_jpeg_decode_accelerator.h b/media/gpu/v4l2_jpeg_decode_accelerator.h
index b282494..156585f 100644
--- a/media/gpu/v4l2_jpeg_decode_accelerator.h
+++ b/media/gpu/v4l2_jpeg_decode_accelerator.h
@@ -46,8 +46,8 @@
   struct BufferRecord {
     BufferRecord();
     ~BufferRecord();
-    void* address;  // mmap() address.
-    size_t length;  // mmap() length.
+    void* address[VIDEO_MAX_PLANES];  // mmap() address.
+    size_t length[VIDEO_MAX_PLANES];  // mmap() length.
 
     // Set true during QBUF and DQBUF. |address| will be accessed by hardware.
     bool at_device;
@@ -82,6 +82,14 @@
   void DestroyInputBuffers();
   void DestroyOutputBuffers();
 
+  // Convert |output_buffer| to I420 and copy the result to |dst_frame|.
+  // The function can convert to I420 from the following formats:
+  //   - All splane formats that libyuv::ConvertToI420 can handle.
+  //   - V4L2_PIX_FMT_YUV_420M
+  //   - V4L2_PIX_FMT_YUV_422M
+  bool ConvertOutputImage(const BufferRecord& output_buffer,
+                          const scoped_refptr<VideoFrame>& dst_frame);
+
   // Return the number of input/output buffers enqueued to the device.
   size_t InputBufferQueuedCount();
   size_t OutputBufferQueuedCount();
@@ -127,6 +135,9 @@
   // Pixel format of output buffer.
   uint32_t output_buffer_pixelformat_;
 
+  // Number of physical planes the output buffers have.
+  size_t output_buffer_num_planes_;
+
   // ChildThread's task runner.
   scoped_refptr<base::SingleThreadTaskRunner> child_task_runner_;
 
diff --git a/media/mojo/BUILD.gn b/media/mojo/BUILD.gn
index bcaaa4c..8ac65b3 100644
--- a/media/mojo/BUILD.gn
+++ b/media/mojo/BUILD.gn
@@ -35,6 +35,14 @@
 }
 
 test("media_mojo_unittests") {
+  # crbug.com/676418: Suppress symbol import warnings.
+  if (is_win && is_component_build) {
+    ldflags = [
+      "/ignore:4217",
+      "/ignore:4049",
+    ]
+  }
+
   deps = [
     ":unit_tests",
     "//mojo/edk/test:run_all_unittests",
diff --git a/media/mojo/services/BUILD.gn b/media/mojo/services/BUILD.gn
index f64a5e1f..3ee32122 100644
--- a/media/mojo/services/BUILD.gn
+++ b/media/mojo/services/BUILD.gn
@@ -132,6 +132,11 @@
 service("media") {
   testonly = true
 
+  # crbug.com/676418: Suppress symbol import warnings.
+  if (is_win && is_component_build) {
+    ldflags = [ "/ignore:4217" ]
+  }
+
   sources = [
     "main.cc",
   ]
diff --git a/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.cc b/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.cc
index d0a14a3..a280312b 100644
--- a/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.cc
+++ b/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.cc
@@ -44,13 +44,13 @@
 class FakeDriveResponseResource : public FakeURLResponseInfoResource {
  public:
   FakeDriveResponseResource()
-      : manager(NULL), loader(0), file_ref(0), stream_to_file(false) {}
+      : manager(NULL),
+        loader_resource(NULL),
+        file_ref(0),
+        stream_to_file(false) {}
 
   virtual void Destroy() {
     EXPECT_TRUE(manager != NULL);
-    if (loader != 0)
-      manager->Release(loader);
-
     if (file_ref != 0)
       manager->Release(file_ref);
   }
@@ -58,7 +58,7 @@
   static const char* classname() { return "FakeDriveResponseResource"; }
 
   FakeResourceManager* manager;
-  PP_Resource loader;
+  FakeDriveURLLoaderResource* loader_resource;
   PP_Resource file_ref;
   bool stream_to_file;
   std::string body;
@@ -122,9 +122,7 @@
       CREATE_RESOURCE(core_interface_->resource_manager(),
                       FakeDriveResponseResource, drive_response_resource);
 
-  drive_response_resource->loader = loader;
-  core_interface_->resource_manager()->AddRef(drive_response_resource->loader);
-
+  drive_response_resource->loader_resource = drive_loader_resource;
   drive_response_resource->stream_to_file = request_resource->stream_to_file;
 
   FakeGoogleDriveServerResponse server_response;
@@ -193,6 +191,23 @@
   drive_loader_resource->response_body.clear();
 }
 
+FakeDriveURLRequestInfoInterface::FakeDriveURLRequestInfoInterface(
+    FakeCoreInterface* core_interface,
+    FakeVarInterface* var_interface)
+    : FakeURLRequestInfoInterface(core_interface, var_interface) {}
+
+PP_Resource FakeDriveURLRequestInfoInterface::Create(PP_Instance instance) {
+  FakeDriveInstanceResource* drive_instance_resource =
+      core_interface_->resource_manager()->Get<FakeDriveInstanceResource>(
+          instance);
+  if (drive_instance_resource == NULL)
+    return PP_ERROR_BADRESOURCE;
+
+  return CREATE_RESOURCE(core_interface_->resource_manager(),
+                         FakeURLRequestInfoResource,
+                         new FakeURLRequestInfoResource);
+}
+
 FakeDriveURLResponseInfoInterface::FakeDriveURLResponseInfoInterface(
     FakeCoreInterface* core_interface,
     FakeVarInterface* var_interface,
@@ -212,6 +227,35 @@
   core_interface_->ReleaseResource(filesystem_resource_);
 }
 
+PP_Var FakeDriveURLResponseInfoInterface::GetProperty(
+    PP_Resource response,
+    PP_URLResponseProperty property) {
+  FakeDriveResponseResource* drive_response_resource =
+      core_interface_->resource_manager()->Get<FakeDriveResponseResource>(
+          response);
+  if (drive_response_resource == NULL)
+    return PP_Var();
+
+  switch (property) {
+    case PP_URLRESPONSEPROPERTY_URL:
+      return var_interface_->VarFromUtf8(drive_response_resource->url.data(),
+                                         drive_response_resource->url.size());
+
+    case PP_URLRESPONSEPROPERTY_STATUSCODE:
+      return PP_MakeInt32(drive_response_resource->status_code);
+
+    case PP_URLRESPONSEPROPERTY_HEADERS:
+      return var_interface_->VarFromUtf8(
+          drive_response_resource->headers.data(),
+          drive_response_resource->headers.size());
+    default:
+      EXPECT_TRUE(false) << "Unimplemented property " << property
+                         << " in "
+                            "FakeDriveURLResponseInfoInterface::GetProperty";
+      return PP_Var();
+  }
+}
+
 PP_Resource FakeDriveURLResponseInfoInterface::GetBodyAsFileRef(
     PP_Resource response) {
   FakeDriveResponseResource* drive_response_resource =
@@ -223,13 +267,10 @@
   if (!drive_response_resource->stream_to_file)
     return 0;
 
-  FakeDriveURLLoaderResource* drive_loader_resource =
-      core_interface_->resource_manager()->Get<FakeDriveURLLoaderResource>(
-          drive_response_resource->loader);
-  if (drive_loader_resource == NULL)
+  if (drive_response_resource->loader_resource == NULL)
     return 0;
 
-  if (drive_loader_resource->server == NULL)
+  if (drive_response_resource->loader_resource->server == NULL)
     return 0;
 
   if (drive_response_resource->file_ref == 0) {
@@ -260,9 +301,10 @@
 FakePepperInterfaceGoogleDriveFs::FakePepperInterfaceGoogleDriveFs()
     : core_interface_(&resource_manager_),
       var_interface_(&var_manager_),
+      file_io_interface_(&core_interface_),
       file_ref_interface_(&core_interface_, &var_interface_),
       drive_url_loader_interface_(&core_interface_),
-      url_request_info_interface_(&core_interface_, &var_interface_),
+      drive_url_request_info_interface_(&core_interface_, &var_interface_),
       drive_url_response_info_interface_(&core_interface_,
                                          &var_interface_,
                                          &file_ref_interface_) {
@@ -287,6 +329,11 @@
   return &core_interface_;
 }
 
+nacl_io::FileIoInterface*
+FakePepperInterfaceGoogleDriveFs::GetFileIoInterface() {
+  return &file_io_interface_;
+}
+
 nacl_io::FileRefInterface*
 FakePepperInterfaceGoogleDriveFs::GetFileRefInterface() {
   return &file_ref_interface_;
@@ -299,7 +346,7 @@
 
 nacl_io::URLRequestInfoInterface*
 FakePepperInterfaceGoogleDriveFs::GetURLRequestInfoInterface() {
-  return &url_request_info_interface_;
+  return &drive_url_request_info_interface_;
 }
 
 nacl_io::URLResponseInfoInterface*
diff --git a/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.h b/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.h
index 33b78861..1a36d82 100644
--- a/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.h
+++ b/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_googledrivefs.h
@@ -11,6 +11,7 @@
 #include "sdk_util/macros.h"
 
 #include "fake_ppapi/fake_core_interface.h"
+#include "fake_ppapi/fake_file_io_interface.h"
 #include "fake_ppapi/fake_file_ref_interface.h"
 #include "fake_ppapi/fake_pepper_interface_url_loader.h"
 #include "fake_ppapi/fake_var_interface.h"
@@ -50,6 +51,17 @@
   DISALLOW_COPY_AND_ASSIGN(FakeDriveURLLoaderInterface);
 };
 
+class FakeDriveURLRequestInfoInterface : public FakeURLRequestInfoInterface {
+ public:
+  FakeDriveURLRequestInfoInterface(FakeCoreInterface* core_interface,
+                                   FakeVarInterface* var_interface);
+
+  virtual PP_Resource Create(PP_Instance instance);
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FakeDriveURLRequestInfoInterface);
+};
+
 class FakeDriveURLResponseInfoInterface : public FakeURLResponseInfoInterface {
  public:
   FakeDriveURLResponseInfoInterface(FakeCoreInterface* core_interface,
@@ -57,6 +69,8 @@
                                     FakeFileRefInterface* file_ref_interface);
   ~FakeDriveURLResponseInfoInterface();
 
+  virtual PP_Var GetProperty(PP_Resource response,
+                             PP_URLResponseProperty property);
   virtual PP_Resource GetBodyAsFileRef(PP_Resource response);
 
  private:
@@ -87,6 +101,7 @@
 
   virtual PP_Instance GetInstance() { return instance_; }
   virtual nacl_io::CoreInterface* GetCoreInterface();
+  virtual nacl_io::FileIoInterface* GetFileIoInterface();
   virtual nacl_io::FileRefInterface* GetFileRefInterface();
   virtual nacl_io::VarInterface* GetVarInterface();
   virtual nacl_io::URLLoaderInterface* GetURLLoaderInterface();
@@ -104,10 +119,11 @@
   FakeCoreInterface core_interface_;
   FakeVarInterface var_interface_;
   FakeVarManager var_manager_;
+  FakeFileIoInterface file_io_interface_;
   FakeFileRefInterface file_ref_interface_;
   FakeGoogleDriveServer google_drive_server_template_;
   FakeDriveURLLoaderInterface drive_url_loader_interface_;
-  FakeURLRequestInfoInterface url_request_info_interface_;
+  FakeDriveURLRequestInfoInterface drive_url_request_info_interface_;
   FakeDriveURLResponseInfoInterface drive_url_response_info_interface_;
   PP_Instance instance_;
 
diff --git a/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_url_loader.h b/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_url_loader.h
index 0232403..fd22c78 100644
--- a/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_url_loader.h
+++ b/native_client_sdk/src/tests/nacl_io_test/fake_ppapi/fake_pepper_interface_url_loader.h
@@ -124,10 +124,11 @@
                                    const void* data,
                                    uint32_t len);
 
- private:
+ protected:
   FakeCoreInterface* core_interface_;  // Weak reference.
   FakeVarInterface* var_interface_;    // Weak reference.
 
+ private:
   DISALLOW_COPY_AND_ASSIGN(FakeURLRequestInfoInterface);
 };
 
diff --git a/net/quic/chromium/bidirectional_stream_quic_impl_unittest.cc b/net/quic/chromium/bidirectional_stream_quic_impl_unittest.cc
index 3aab8ae..fc330005 100644
--- a/net/quic/chromium/bidirectional_stream_quic_impl_unittest.cc
+++ b/net/quic/chromium/bidirectional_stream_quic_impl_unittest.cc
@@ -32,6 +32,7 @@
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
 #include "net/quic/core/quic_connection.h"
+#include "net/quic/core/quic_utils.h"
 #include "net/quic/core/spdy_utils.h"
 #include "net/quic/test_tools/crypto_test_utils.h"
 #include "net/quic/test_tools/mock_clock.h"
diff --git a/net/quic/core/crypto/null_decrypter.h b/net/quic/core/crypto/null_decrypter.h
index 57dbe5b..3f6aecb 100644
--- a/net/quic/core/crypto/null_decrypter.h
+++ b/net/quic/core/crypto/null_decrypter.h
@@ -10,6 +10,7 @@
 
 #include "base/compiler_specific.h"
 #include "base/macros.h"
+#include "net/base/int128.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/quic_types.h"
 #include "net/quic/platform/api/quic_export.h"
diff --git a/net/quic/core/quic_alarm.cc b/net/quic/core/quic_alarm.cc
index 985be648..1f7c725 100644
--- a/net/quic/core/quic_alarm.cc
+++ b/net/quic/core/quic_alarm.cc
@@ -5,7 +5,6 @@
 #include "net/quic/core/quic_alarm.h"
 
 #include "base/logging.h"
-#include "net/quic/core/quic_flags.h"
 
 namespace net {
 
diff --git a/net/quic/core/quic_arena_scoped_ptr_test.cc b/net/quic/core/quic_arena_scoped_ptr_test.cc
index 9c4a0a25..7c59e47 100644
--- a/net/quic/core/quic_arena_scoped_ptr_test.cc
+++ b/net/quic/core/quic_arena_scoped_ptr_test.cc
@@ -1,6 +1,7 @@
 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+
 #include "net/quic/core/quic_arena_scoped_ptr.h"
 
 #include "net/quic/core/quic_one_block_arena.h"
diff --git a/net/quic/core/quic_bandwidth.cc b/net/quic/core/quic_bandwidth.cc
index 75ccc68..05dd9d1e 100644
--- a/net/quic/core/quic_bandwidth.cc
+++ b/net/quic/core/quic_bandwidth.cc
@@ -4,11 +4,9 @@
 
 #include "net/quic/core/quic_bandwidth.h"
 
-#include <stdint.h>
-
+#include <cinttypes>
 #include <limits>
 
-#include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "net/quic/core/quic_bug_tracker.h"
diff --git a/net/quic/core/quic_bandwidth_test.cc b/net/quic/core/quic_bandwidth_test.cc
index d249768e..fd9e17d 100644
--- a/net/quic/core/quic_bandwidth_test.cc
+++ b/net/quic/core/quic_bandwidth_test.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "net/quic/core/quic_bandwidth.h"
+#include "net/quic/core/quic_time.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ -72,14 +73,18 @@
 }
 
 TEST_F(QuicBandwidthTest, BytesPerPeriod) {
-  EXPECT_EQ(2000u, QuicBandwidth::FromKBytesPerSecond(2000)
-                       .ToBytesPerPeriod(QuicTime::Delta::FromMilliseconds(1)));
-  EXPECT_EQ(2u, QuicBandwidth::FromKBytesPerSecond(2000)
-                    .ToKBytesPerPeriod(QuicTime::Delta::FromMilliseconds(1)));
-  EXPECT_EQ(200000u, QuicBandwidth::FromKBytesPerSecond(2000).ToBytesPerPeriod(
-                         QuicTime::Delta::FromMilliseconds(100)));
-  EXPECT_EQ(200u, QuicBandwidth::FromKBytesPerSecond(2000).ToKBytesPerPeriod(
-                      QuicTime::Delta::FromMilliseconds(100)));
+  EXPECT_EQ(2000u,
+            QuicBandwidth::FromKBytesPerSecond(2000).ToBytesPerPeriod(
+                QuicTime::Delta::FromMilliseconds(1)));
+  EXPECT_EQ(2u,
+            QuicBandwidth::FromKBytesPerSecond(2000).ToKBytesPerPeriod(
+                QuicTime::Delta::FromMilliseconds(1)));
+  EXPECT_EQ(200000u,
+            QuicBandwidth::FromKBytesPerSecond(2000).ToBytesPerPeriod(
+                QuicTime::Delta::FromMilliseconds(100)));
+  EXPECT_EQ(200u,
+            QuicBandwidth::FromKBytesPerSecond(2000).ToKBytesPerPeriod(
+                QuicTime::Delta::FromMilliseconds(100)));
 }
 
 TEST_F(QuicBandwidthTest, TransferTime) {
diff --git a/net/quic/core/quic_buffered_packet_store.h b/net/quic/core/quic_buffered_packet_store.h
index d6794ae..1319a8ef 100644
--- a/net/quic/core/quic_buffered_packet_store.h
+++ b/net/quic/core/quic_buffered_packet_store.h
@@ -5,6 +5,8 @@
 #ifndef NET_QUIC_CORE_QUIC_BUFFERED_PACKET_STORE_H_
 #define NET_QUIC_CORE_QUIC_BUFFERED_PACKET_STORE_H_
 
+#include <list>
+
 #include "net/base/linked_hash_map.h"
 #include "net/quic/core/quic_alarm.h"
 #include "net/quic/core/quic_alarm_factory.h"
diff --git a/net/quic/core/quic_buffered_packet_store_test.cc b/net/quic/core/quic_buffered_packet_store_test.cc
index 49a558ee..312f0bf3 100644
--- a/net/quic/core/quic_buffered_packet_store_test.cc
+++ b/net/quic/core/quic_buffered_packet_store_test.cc
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/stl_util.h"
+#include "net/quic/core/quic_flags.h"
 #include "net/quic/test_tools/mock_clock.h"
 #include "net/quic/test_tools/quic_buffered_packet_store_peer.h"
 #include "net/quic/test_tools/quic_test_utils.h"
diff --git a/net/quic/core/quic_data_reader.h b/net/quic/core/quic_data_reader.h
index 4913d3c..b1d8444 100644
--- a/net/quic/core/quic_data_reader.h
+++ b/net/quic/core/quic_data_reader.h
@@ -5,10 +5,8 @@
 #ifndef NET_QUIC_CORE_QUIC_DATA_READER_H_
 #define NET_QUIC_CORE_QUIC_DATA_READER_H_
 
-#include <stddef.h>
-#include <stdint.h>
-
 #include <cstddef>
+#include <cstdint>
 
 #include "base/macros.h"
 #include "base/strings/string_piece.h"
diff --git a/net/quic/core/quic_data_writer.cc b/net/quic/core/quic_data_writer.cc
index 6983553..f890eb2 100644
--- a/net/quic/core/quic_data_writer.cc
+++ b/net/quic/core/quic_data_writer.cc
@@ -4,7 +4,6 @@
 
 #include "net/quic/core/quic_data_writer.h"
 
-#include <stdint.h>
 #include <algorithm>
 #include <limits>
 
diff --git a/net/quic/core/quic_data_writer.h b/net/quic/core/quic_data_writer.h
index f33da9d7..5d13e0d 100644
--- a/net/quic/core/quic_data_writer.h
+++ b/net/quic/core/quic_data_writer.h
@@ -5,10 +5,8 @@
 #ifndef NET_QUIC_CORE_QUIC_DATA_WRITER_H_
 #define NET_QUIC_CORE_QUIC_DATA_WRITER_H_
 
-#include <stddef.h>
-#include <stdint.h>
-
 #include <cstddef>
+#include <cstdint>
 #include <string>
 
 #include "base/logging.h"
diff --git a/net/quic/core/quic_data_writer_test.cc b/net/quic/core/quic_data_writer_test.cc
index bb3cfaf..fcd1a57 100644
--- a/net/quic/core/quic_data_writer_test.cc
+++ b/net/quic/core/quic_data_writer_test.cc
@@ -4,12 +4,9 @@
 
 #include "net/quic/core/quic_data_writer.h"
 
-#include <stdint.h>
-
-#include <memory>
+#include <cstdint>
 
 #include "net/quic/core/quic_data_reader.h"
-#include "net/test/gtest_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
diff --git a/net/quic/core/quic_error_codes.h b/net/quic/core/quic_error_codes.h
index e0ccd9e..7e341f1 100644
--- a/net/quic/core/quic_error_codes.h
+++ b/net/quic/core/quic_error_codes.h
@@ -5,8 +5,7 @@
 #ifndef NET_QUIC_CORE_QUIC_ERROR_CODES_H_
 #define NET_QUIC_CORE_QUIC_ERROR_CODES_H_
 
-#include <stdint.h>
-
+#include <cstdint>
 #include <limits>
 
 #include "net/quic/platform/api/quic_export.h"
diff --git a/net/quic/core/quic_error_codes_test.cc b/net/quic/core/quic_error_codes_test.cc
index 0023e934..0694fef 100644
--- a/net/quic/core/quic_error_codes_test.cc
+++ b/net/quic/core/quic_error_codes_test.cc
@@ -4,14 +4,9 @@
 
 #include "net/quic/core/quic_error_codes.h"
 
-#include "base/strings/string_piece.h"
-#include "net/quic/core/quic_flags.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-using base::StringPiece;
-using std::string;
-
 namespace net {
 namespace test {
 namespace {
diff --git a/net/quic/core/quic_flow_controller.cc b/net/quic/core/quic_flow_controller.cc
index 12c0368..78f8ff3 100644
--- a/net/quic/core/quic_flow_controller.cc
+++ b/net/quic/core/quic_flow_controller.cc
@@ -4,10 +4,11 @@
 
 #include "net/quic/core/quic_flow_controller.h"
 
+#include <cstdint>
+
 #include "base/strings/stringprintf.h"
 #include "net/quic/core/quic_bug_tracker.h"
 #include "net/quic/core/quic_connection.h"
-#include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_packets.h"
 
 namespace net {
diff --git a/net/quic/core/quic_flow_controller_test.cc b/net/quic/core/quic_flow_controller_test.cc
index 5b7981f1..117540a0 100644
--- a/net/quic/core/quic_flow_controller_test.cc
+++ b/net/quic/core/quic_flow_controller_test.cc
@@ -8,14 +8,11 @@
 
 #include "base/format_macros.h"
 #include "base/strings/stringprintf.h"
-#include "net/quic/core/quic_flags.h"
-#include "net/quic/core/quic_utils.h"
 #include "net/quic/test_tools/quic_connection_peer.h"
 #include "net/quic/test_tools/quic_flow_controller_peer.h"
 #include "net/quic/test_tools/quic_sent_packet_manager_peer.h"
 #include "net/quic/test_tools/quic_test_utils.h"
-#include "net/test/gtest_util.h"
-#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
 
 using testing::_;
 
diff --git a/net/quic/core/quic_framer.cc b/net/quic/core/quic_framer.cc
index 3909a74..f90a01e 100644
--- a/net/quic/core/quic_framer.cc
+++ b/net/quic/core/quic_framer.cc
@@ -6,7 +6,6 @@
 
 #include <cstdint>
 #include <memory>
-#include <vector>
 
 #include "base/compiler_specific.h"
 #include "base/logging.h"
@@ -1980,7 +1979,7 @@
       const size_t num_encoded_gaps =
           (total_gap + std::numeric_limits<uint8_t>::max() - 1) /
           std::numeric_limits<uint8_t>::max();
-      DCHECK_GT(num_encoded_gaps, 0u);
+      DCHECK_LE(0u, num_encoded_gaps);
 
       // Append empty ACK blocks because the gap is longer than a single gap.
       for (size_t i = 1;
diff --git a/net/quic/core/quic_framer.h b/net/quic/core/quic_framer.h
index ae86505..c55e2680 100644
--- a/net/quic/core/quic_framer.h
+++ b/net/quic/core/quic_framer.h
@@ -5,14 +5,12 @@
 #ifndef NET_QUIC_CORE_QUIC_FRAMER_H_
 #define NET_QUIC_CORE_QUIC_FRAMER_H_
 
-#include <stddef.h>
-#include <stdint.h>
-
+#include <cstddef>
+#include <cstdint>
 #include <memory>
 #include <string>
 #include <unordered_map>
 #include <unordered_set>
-#include <vector>
 
 #include "base/logging.h"
 #include "base/macros.h"
diff --git a/net/quic/core/quic_framer_test.cc b/net/quic/core/quic_framer_test.cc
index ff9bc91..dcdb2ea3 100644
--- a/net/quic/core/quic_framer_test.cc
+++ b/net/quic/core/quic_framer_test.cc
@@ -4,9 +4,8 @@
 
 #include "net/quic/core/quic_framer.h"
 
-#include <string.h>
-
 #include <algorithm>
+#include <cstdint>
 #include <map>
 #include <memory>
 #include <string>
@@ -18,11 +17,12 @@
 #include "net/quic/core/crypto/null_encrypter.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
+#include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_packets.h"
 #include "net/quic/core/quic_utils.h"
 #include "net/quic/test_tools/quic_framer_peer.h"
 #include "net/quic/test_tools/quic_test_utils.h"
-#include "net/test/gtest_util.h"
+#include "testing/gtest/include/gtest/gtest.h"
 
 using base::StringPiece;
 using std::string;
@@ -1197,7 +1197,7 @@
   EXPECT_TRUE(framer_.ProcessPacket(encrypted));
   ASSERT_TRUE(visitor_.public_header_->nonce != nullptr);
   for (char i = 0; i < 32; ++i) {
-    EXPECT_EQ(i, (*visitor_.public_header_->nonce)[static_cast<int>(i)]);
+    EXPECT_EQ(i, (*visitor_.public_header_->nonce)[static_cast<size_t>(i)]);
   }
 };
 
@@ -1658,7 +1658,7 @@
 
   EXPECT_EQ(0u, visitor_.stream_frames_.size());
   ASSERT_EQ(1u, visitor_.ack_frames_.size());
-  const QuicAckFrame& frame = *visitor_.ack_frames_[0].get();
+  const QuicAckFrame& frame = *visitor_.ack_frames_[0];
   EXPECT_EQ(kSmallLargestObserved, frame.largest_observed);
   ASSERT_EQ(4660u, frame.packets.NumPacketsSlow());
 
@@ -1753,7 +1753,7 @@
 
   EXPECT_EQ(0u, visitor_.stream_frames_.size());
   ASSERT_EQ(1u, visitor_.ack_frames_.size());
-  const QuicAckFrame& frame = *visitor_.ack_frames_[0].get();
+  const QuicAckFrame& frame = *visitor_.ack_frames_[0];
   EXPECT_EQ(kSmallLargestObserved, frame.largest_observed);
   ASSERT_EQ(4254u, frame.packets.NumPacketsSlow());
 
@@ -1868,7 +1868,7 @@
 
   EXPECT_EQ(0u, visitor_.stream_frames_.size());
   ASSERT_EQ(1u, visitor_.stop_waiting_frames_.size());
-  const QuicStopWaitingFrame& frame = *visitor_.stop_waiting_frames_[0].get();
+  const QuicStopWaitingFrame& frame = *visitor_.stop_waiting_frames_[0];
   EXPECT_EQ(kLeastUnacked, frame.least_unacked);
 
   const size_t frame_size = 7;
@@ -3914,7 +3914,7 @@
   ASSERT_TRUE(framer_.ProcessPacket(
       QuicEncryptedPacket(buffer, encrypted_length, false)));
   ASSERT_EQ(1u, visitor_.ack_frames_.size());
-  QuicAckFrame& processed_ack_frame = *visitor_.ack_frames_[0].get();
+  QuicAckFrame& processed_ack_frame = *visitor_.ack_frames_[0];
   EXPECT_EQ(600u, processed_ack_frame.largest_observed);
   ASSERT_EQ(256u, processed_ack_frame.packets.NumPacketsSlow());
   EXPECT_EQ(90u, processed_ack_frame.packets.Min());
@@ -3946,7 +3946,7 @@
   ASSERT_TRUE(framer_.ProcessPacket(
       QuicEncryptedPacket(buffer, encrypted_length, false)));
   ASSERT_EQ(1u, visitor_.ack_frames_.size());
-  QuicAckFrame& processed_ack_frame = *visitor_.ack_frames_[0].get();
+  QuicAckFrame& processed_ack_frame = *visitor_.ack_frames_[0];
   EXPECT_EQ(600u, processed_ack_frame.largest_observed);
   ASSERT_EQ(239u, processed_ack_frame.packets.NumPacketsSlow());
   EXPECT_EQ(124u, processed_ack_frame.packets.Min());
diff --git a/net/quic/core/quic_header_list.cc b/net/quic/core/quic_header_list.cc
index 0612791e..77b8539 100644
--- a/net/quic/core/quic_header_list.cc
+++ b/net/quic/core/quic_header_list.cc
@@ -4,11 +4,11 @@
 
 #include "net/quic/core/quic_header_list.h"
 
-using std::string;
-
 #include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_packets.h"
 
+using std::string;
+
 namespace net {
 
 QuicHeaderList::QuicHeaderList()
diff --git a/net/quic/core/quic_header_list.h b/net/quic/core/quic_header_list.h
index cd6ba3a7..29b001a2 100644
--- a/net/quic/core/quic_header_list.h
+++ b/net/quic/core/quic_header_list.h
@@ -36,6 +36,7 @@
   void OnHeaderBlockEnd(size_t uncompressed_header_bytes) override;
   void OnHeaderBlockEnd(size_t uncompressed_header_bytes,
                         size_t compressed_header_bytes) override;
+
   void Clear();
 
   const_iterator begin() const { return header_list_.begin(); }
@@ -45,7 +46,6 @@
   size_t uncompressed_header_bytes() const {
     return uncompressed_header_bytes_;
   }
-
   size_t compressed_header_bytes() const { return compressed_header_bytes_; }
 
   void set_max_uncompressed_header_bytes(size_t max_uncompressed_header_bytes) {
diff --git a/net/quic/core/quic_header_list_test.cc b/net/quic/core/quic_header_list_test.cc
index 920c464..d9b0afd 100644
--- a/net/quic/core/quic_header_list_test.cc
+++ b/net/quic/core/quic_header_list_test.cc
@@ -6,8 +6,7 @@
 
 #include "net/quic/core/quic_flags.h"
 #include "net/quic/test_tools/quic_test_utils.h"
-#include "net/test/gtest_util.h"
-#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
 
 using std::string;
 
diff --git a/net/quic/core/quic_headers_stream.cc b/net/quic/core/quic_headers_stream.cc
index c39c94a..21f4c5e 100644
--- a/net/quic/core/quic_headers_stream.cc
+++ b/net/quic/core/quic_headers_stream.cc
@@ -5,6 +5,7 @@
 #include "net/quic/core/quic_headers_stream.h"
 
 #include <algorithm>
+#include <cstdint>
 #include <string>
 #include <utility>
 
@@ -21,7 +22,6 @@
 #include "net/spdy/spdy_protocol.h"
 
 using base::StringPiece;
-using net::SpdyFrameType;
 using std::string;
 
 namespace net {
@@ -115,6 +115,21 @@
  public:
   explicit SpdyFramerVisitor(QuicHeadersStream* stream) : stream_(stream) {}
 
+  SpdyHeadersHandlerInterface* OnHeaderFrameStart(
+      SpdyStreamId /* stream_id */) override {
+    return &header_list_;
+  }
+
+  void OnHeaderFrameEnd(SpdyStreamId /* stream_id */,
+                        bool end_headers) override {
+    if (end_headers) {
+      if (stream_->IsConnected()) {
+        stream_->OnHeaderList(header_list_);
+      }
+      header_list_.Clear();
+    }
+  }
+
   void OnStreamFrameData(SpdyStreamId stream_id,
                          const char* data,
                          size_t len) override {
@@ -133,21 +148,6 @@
     CloseConnection("SPDY frame padding received.");
   }
 
-  SpdyHeadersHandlerInterface* OnHeaderFrameStart(
-      SpdyStreamId /* stream_id */) override {
-    return &header_list_;
-  }
-
-  void OnHeaderFrameEnd(SpdyStreamId /* stream_id */,
-                        bool end_headers) override {
-    if (end_headers) {
-      if (stream_->IsConnected()) {
-        stream_->OnHeaderList(header_list_);
-      }
-      header_list_.Clear();
-    }
-  }
-
   void OnError(SpdyFramer* framer) override {
     CloseConnection(base::StringPrintf(
         "SPDY framing error: %s",
@@ -229,8 +229,8 @@
   void OnHeaders(SpdyStreamId stream_id,
                  bool has_priority,
                  int weight,
-                 SpdyStreamId parent_stream_id,
-                 bool exclusive,
+                 SpdyStreamId /*parent_stream_id*/,
+                 bool /*exclusive*/,
                  bool fin,
                  bool end) override {
     if (!stream_->IsConnected()) {
diff --git a/net/quic/core/quic_headers_stream.h b/net/quic/core/quic_headers_stream.h
index 1dff775f..6c66b11 100644
--- a/net/quic/core/quic_headers_stream.h
+++ b/net/quic/core/quic_headers_stream.h
@@ -5,8 +5,7 @@
 #ifndef NET_QUIC_CORE_QUIC_HEADERS_STREAM_H_
 #define NET_QUIC_CORE_QUIC_HEADERS_STREAM_H_
 
-#include <stddef.h>
-
+#include <cstddef>
 #include <memory>
 
 #include "base/macros.h"
@@ -24,10 +23,9 @@
 class QuicHeadersStreamPeer;
 }  // namespace test
 
-// Headers in QUIC are sent as HTTP/2 HEADERS or PUSH_PROMISE frames
-// over a reserved reliable stream with the id 3.  Each endpoint
-// (client and server) will allocate an instance of QuicHeadersStream
-// to send and receive headers.
+// Headers in QUIC are sent as HTTP/2 HEADERS or PUSH_PROMISE frames over a
+// reserved stream with the id 3.  Each endpoint (client and server) will
+// allocate an instance of QuicHeadersStream to send and receive headers.
 class QUIC_EXPORT_PRIVATE QuicHeadersStream : public QuicStream {
  public:
   class QUIC_EXPORT_PRIVATE HpackDebugVisitor {
diff --git a/net/quic/core/quic_headers_stream_test.cc b/net/quic/core/quic_headers_stream_test.cc
index d27c08b..67f4c108 100644
--- a/net/quic/core/quic_headers_stream_test.cc
+++ b/net/quic/core/quic_headers_stream_test.cc
@@ -4,6 +4,7 @@
 
 #include "net/quic/core/quic_headers_stream.h"
 
+#include <cstdint>
 #include <ostream>
 #include <string>
 #include <tuple>
@@ -11,6 +12,7 @@
 
 #include "base/strings/string_number_conversions.h"
 #include "net/quic/core/quic_bug_tracker.h"
+#include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_utils.h"
 #include "net/quic/core/spdy_utils.h"
 #include "net/quic/test_tools/quic_connection_peer.h"
@@ -27,7 +29,6 @@
 
 using base::StringPiece;
 using std::string;
-using testing::ElementsAre;
 using testing::_;
 using testing::AtLeast;
 using testing::HasSubstr;
@@ -36,7 +37,6 @@
 using testing::Return;
 using testing::StrictMock;
 using testing::WithArgs;
-using testing::_;
 
 // TODO(bnc): Merge these correctly.
 bool FLAGS_use_http2_frame_decoder_adapter;
@@ -556,7 +556,7 @@
 
 TEST_P(QuicHeadersStreamTest, EmptyHeaderHOLBlockedTime) {
   EXPECT_CALL(session_, OnHeadersHeadOfLineBlocking(_)).Times(0);
-  testing::InSequence seq;
+  InSequence seq;
   bool fin = true;
   for (int stream_num = 0; stream_num < 10; stream_num++) {
     QuicStreamId stream_id = QuicClientDataStreamId(stream_num);
@@ -861,7 +861,7 @@
   headers_["key1"] = string(1 << 2, '.');
   headers_["key2"] = string(1 << 3, '.');
   {
-    testing::InSequence seq;
+    InSequence seq;
     // Number of indexed representations generated in headers below.
     for (int i = 1; i < 28; i++) {
       EXPECT_CALL(*hpack_decoder_visitor,
@@ -908,13 +908,13 @@
       std::move(hpack_encoder_visitor_));
 
   if (perspective() == Perspective::IS_SERVER) {
-    testing::InSequence seq;
+    InSequence seq;
     for (int i = 1; i < 4; i++) {
       EXPECT_CALL(*hpack_encoder_visitor,
                   OnUseEntry(QuicTime::Delta::FromMilliseconds(i)));
     }
   } else {
-    testing::InSequence seq;
+    InSequence seq;
     for (int i = 1; i < 28; i++) {
       EXPECT_CALL(*hpack_encoder_visitor,
                   OnUseEntry(QuicTime::Delta::FromMilliseconds(i)));
diff --git a/net/quic/core/quic_multipath_received_packet_manager.cc b/net/quic/core/quic_multipath_received_packet_manager.cc
index 7a1b2f3..44562186 100644
--- a/net/quic/core/quic_multipath_received_packet_manager.cc
+++ b/net/quic/core/quic_multipath_received_packet_manager.cc
@@ -4,8 +4,9 @@
 
 #include "net/quic/core/quic_multipath_received_packet_manager.h"
 
-#include "base/memory/ptr_util.h"
+#include <cstdint>
 
+#include "base/memory/ptr_util.h"
 #include "net/quic/core/quic_bug_tracker.h"
 
 namespace net {
diff --git a/net/quic/core/quic_multipath_received_packet_manager_test.cc b/net/quic/core/quic_multipath_received_packet_manager_test.cc
index effae4d..bd3de52 100644
--- a/net/quic/core/quic_multipath_received_packet_manager_test.cc
+++ b/net/quic/core/quic_multipath_received_packet_manager_test.cc
@@ -6,9 +6,7 @@
 
 #include "base/memory/ptr_util.h"
 #include "net/quic/core/quic_connection_stats.h"
-#include "net/quic/core/quic_flags.h"
 #include "net/quic/test_tools/quic_test_utils.h"
-#include "net/test/gtest_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/net/quic/core/quic_multipath_sent_packet_manager.h b/net/quic/core/quic_multipath_sent_packet_manager.h
index 8de992f8..c968352 100644
--- a/net/quic/core/quic_multipath_sent_packet_manager.h
+++ b/net/quic/core/quic_multipath_sent_packet_manager.h
@@ -9,6 +9,7 @@
 
 #include "net/quic/core/quic_connection_close_delegate_interface.h"
 #include "net/quic/core/quic_packets.h"
+#include "net/quic/core/quic_pending_retransmission.h"
 #include "net/quic/core/quic_sent_packet_manager.h"
 #include "net/quic/core/quic_sent_packet_manager_interface.h"
 #include "net/quic/platform/api/quic_export.h"
diff --git a/net/quic/core/quic_multipath_sent_packet_manager_test.cc b/net/quic/core/quic_multipath_sent_packet_manager_test.cc
index fdb5979..bfbf09eb 100644
--- a/net/quic/core/quic_multipath_sent_packet_manager_test.cc
+++ b/net/quic/core/quic_multipath_sent_packet_manager_test.cc
@@ -5,9 +5,9 @@
 #include "net/quic/core/quic_multipath_sent_packet_manager.h"
 
 #include "net/quic/core/quic_bug_tracker.h"
+#include "net/quic/core/quic_pending_retransmission.h"
 #include "net/quic/test_tools/quic_multipath_sent_packet_manager_peer.h"
 #include "net/quic/test_tools/quic_test_utils.h"
-#include "net/test/gtest_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/net/quic/core/quic_one_block_arena.h b/net/quic/core/quic_one_block_arena.h
index 6bf8c17..66f29b39 100644
--- a/net/quic/core/quic_one_block_arena.h
+++ b/net/quic/core/quic_one_block_arena.h
@@ -10,9 +10,11 @@
 #ifndef NET_QUIC_CORE_QUIC_ONE_BLOCK_ARENA_H_
 #define NET_QUIC_CORE_QUIC_ONE_BLOCK_ARENA_H_
 
+#include <cstdint>
+
 #include "net/quic/core/quic_arena_scoped_ptr.h"
-#include "net/quic/core/quic_flags.h"
-#include "net/quic/core/quic_utils.h"
+#include "net/quic/core/quic_bug_tracker.h"
+#include "net/quic/core/quic_types.h"
 
 #define PREDICT_FALSE(x) x
 
@@ -59,9 +61,9 @@
   static_assert(QUIC_ALIGN_OF(T) > 1,
                 "Objects added to the arena must be at least 2B aligned.");
   if (PREDICT_FALSE(offset_ > ArenaSize - AlignedSize<T>())) {
-    LOG(DFATAL) << "Ran out of space in QuicOneBlockArena at " << this
-                << ", max size was " << ArenaSize << ", failing request was "
-                << AlignedSize<T>() << ", end of arena was " << offset_;
+    QUIC_BUG << "Ran out of space in QuicOneBlockArena at " << this
+             << ", max size was " << ArenaSize << ", failing request was "
+             << AlignedSize<T>() << ", end of arena was " << offset_;
     return QuicArenaScopedPtr<T>(new T(std::forward<Args>(args)...));
   }
 
diff --git a/net/quic/core/quic_one_block_arena_test.cc b/net/quic/core/quic_one_block_arena_test.cc
index 15ff0c67..2f060252 100644
--- a/net/quic/core/quic_one_block_arena_test.cc
+++ b/net/quic/core/quic_one_block_arena_test.cc
@@ -4,11 +4,10 @@
 
 #include "net/quic/core/quic_one_block_arena.h"
 
+#include <cstdint>
+
 #include "net/quic/core/interval_set.h"
-#include "net/quic/core/quic_flags.h"
-#include "net/quic/core/quic_utils.h"
 #include "net/quic/test_tools/quic_test_utils.h"
-#include "net/test/gtest_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/net/quic/core/quic_packet_creator.cc b/net/quic/core/quic_packet_creator.cc
index c44091e..c22bad53 100644
--- a/net/quic/core/quic_packet_creator.cc
+++ b/net/quic/core/quic_packet_creator.cc
@@ -5,6 +5,7 @@
 #include "net/quic/core/quic_packet_creator.h"
 
 #include <algorithm>
+#include <cstdint>
 
 #include "base/logging.h"
 #include "base/macros.h"
@@ -131,7 +132,7 @@
       frame->stream_frame->data_length >= sizeof(kCHLO) &&
       strncmp(frame->stream_frame->data_buffer,
               reinterpret_cast<const char*>(&kCHLO), sizeof(kCHLO)) == 0) {
-    DCHECK_EQ(static_cast<size_t>(0), iov_offset);
+    DCHECK_EQ(0u, iov_offset);
     if (FLAGS_quic_enforce_single_packet_chlo &&
         frame->stream_frame->data_length < iov.iov->iov_len) {
       const string error_details = "Client hello won't fit in a single packet.";
diff --git a/net/quic/core/quic_packet_creator.h b/net/quic/core/quic_packet_creator.h
index b04aa0f1..232b31d 100644
--- a/net/quic/core/quic_packet_creator.h
+++ b/net/quic/core/quic_packet_creator.h
@@ -10,8 +10,7 @@
 #ifndef NET_QUIC_CORE_QUIC_PACKET_CREATOR_H_
 #define NET_QUIC_CORE_QUIC_PACKET_CREATOR_H_
 
-#include <stddef.h>
-
+#include <cstddef>
 #include <memory>
 #include <string>
 #include <unordered_map>
diff --git a/net/quic/core/quic_packet_creator_test.cc b/net/quic/core/quic_packet_creator_test.cc
index 96b9c76..9f40b9e6 100644
--- a/net/quic/core/quic_packet_creator_test.cc
+++ b/net/quic/core/quic_packet_creator_test.cc
@@ -14,16 +14,15 @@
 #include "net/quic/core/crypto/null_encrypter.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
-#include "net/quic/core/quic_flags.h"
+#include "net/quic/core/quic_pending_retransmission.h"
 #include "net/quic/core/quic_simple_buffer_allocator.h"
 #include "net/quic/core/quic_utils.h"
 #include "net/quic/platform/api/quic_socket_address.h"
-#include "net/quic/test_tools/mock_random.h"
 #include "net/quic/test_tools/quic_framer_peer.h"
 #include "net/quic/test_tools/quic_packet_creator_peer.h"
 #include "net/quic/test_tools/quic_test_utils.h"
-#include "net/test/gtest_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
 
 using base::StringPiece;
 using std::string;
@@ -195,8 +194,8 @@
                                              true);
   }
 
-  QuicIOVector MakeIOVector(StringPiece s) {
-    return ::net::test::MakeIOVector(s, &iov_);
+  QuicIOVector MakeIOVectorFromStringPiece(StringPiece s) {
+    return MakeIOVector(s, &iov_);
   }
 
   QuicPendingRetransmission CreateRetransmission(
@@ -344,7 +343,8 @@
 
 TEST_P(QuicPacketCreatorTest, ReserializeFramesWithFullPadding) {
   QuicFrame frame;
-  QuicIOVector io_vector(MakeIOVector("fake handshake message data"));
+  QuicIOVector io_vector(
+      MakeIOVectorFromStringPiece("fake handshake message data"));
   QuicPacketCreatorPeer::CreateStreamFrame(&creator_, kCryptoStreamId,
                                            io_vector, 0u, 0u, false, &frame);
   QuicFrames frames;
@@ -363,7 +363,7 @@
 
 TEST_P(QuicPacketCreatorTest, ReserializeFramesWithSpecifiedPadding) {
   QuicFrame frame;
-  QuicIOVector io_vector(MakeIOVector("fake message data"));
+  QuicIOVector io_vector(MakeIOVectorFromStringPiece("fake message data"));
   QuicPacketCreatorPeer::CreateStreamFrame(&creator_, kCryptoStreamId,
                                            io_vector, 0u, 0u, false, &frame);
 
@@ -409,7 +409,7 @@
     size_t bytes_free = 0 - delta;
 
     QuicFrame frame;
-    QuicIOVector io_vector(MakeIOVector(data));
+    QuicIOVector io_vector(MakeIOVectorFromStringPiece(data));
     QuicPacketCreatorPeer::CreateStreamFrame(
         &creator_, kCryptoStreamId, io_vector, 0, kOffset, false, &frame);
     QuicFrames frames;
@@ -464,7 +464,7 @@
 
 TEST_P(QuicPacketCreatorTest, ConsumeData) {
   QuicFrame frame;
-  QuicIOVector io_vector(MakeIOVector("test"));
+  QuicIOVector io_vector(MakeIOVectorFromStringPiece("test"));
   ASSERT_TRUE(creator_.ConsumeData(kCryptoStreamId, io_vector, 0u, 0u, false,
                                    false, &frame));
   ASSERT_TRUE(frame.stream_frame);
@@ -476,7 +476,7 @@
 
 TEST_P(QuicPacketCreatorTest, ConsumeDataFin) {
   QuicFrame frame;
-  QuicIOVector io_vector(MakeIOVector("test"));
+  QuicIOVector io_vector(MakeIOVectorFromStringPiece("test"));
   ASSERT_TRUE(creator_.ConsumeData(kCryptoStreamId, io_vector, 0u, 10u, true,
                                    false, &frame));
   ASSERT_TRUE(frame.stream_frame);
@@ -509,7 +509,7 @@
               creator_.HasRoomForStreamFrame(kClientDataStreamId1, kOffset));
     if (should_have_room) {
       QuicFrame frame;
-      QuicIOVector io_vector(MakeIOVector("testdata"));
+      QuicIOVector io_vector(MakeIOVectorFromStringPiece("testdata"));
       EXPECT_CALL(delegate_, OnSerializedPacket(_))
           .WillRepeatedly(Invoke(
               this, &QuicPacketCreatorTest::ClearSerializedPacketForTests));
@@ -534,7 +534,7 @@
     string data(capacity + delta, 'A');
     size_t bytes_free = delta > 0 ? 0 : 0 - delta;
     QuicFrame frame;
-    QuicIOVector io_vector(MakeIOVector(data));
+    QuicIOVector io_vector(MakeIOVectorFromStringPiece(data));
     ASSERT_TRUE(creator_.ConsumeData(kClientDataStreamId1, io_vector, 0u,
                                      kOffset, false, false, &frame));
     ASSERT_TRUE(frame.stream_frame);
@@ -564,7 +564,7 @@
     size_t bytes_free = delta > 0 ? 0 : 0 - delta;
 
     QuicFrame frame;
-    QuicIOVector io_vector(MakeIOVector(data));
+    QuicIOVector io_vector(MakeIOVectorFromStringPiece(data));
     EXPECT_CALL(delegate_, OnSerializedPacket(_))
         .WillRepeatedly(
             Invoke(this, &QuicPacketCreatorTest::SaveSerializedPacket));
@@ -601,7 +601,7 @@
     size_t bytes_free = delta > 0 ? 0 : 0 - delta;
 
     QuicFrame frame;
-    QuicIOVector io_vector(MakeIOVector(data));
+    QuicIOVector io_vector(MakeIOVectorFromStringPiece(data));
     EXPECT_CALL(delegate_, OnSerializedPacket(_))
         .WillOnce(Invoke(this, &QuicPacketCreatorTest::SaveSerializedPacket));
     ASSERT_TRUE(creator_.ConsumeData(kClientDataStreamId1, io_vector, 0u,
@@ -727,7 +727,7 @@
       PACKET_1BYTE_PACKET_NUMBER, &payload_length));
   QuicFrame frame;
   const string too_long_payload(payload_length * 2, 'a');
-  QuicIOVector io_vector(MakeIOVector(too_long_payload));
+  QuicIOVector io_vector(MakeIOVectorFromStringPiece(too_long_payload));
   EXPECT_CALL(delegate_, OnSerializedPacket(_))
       .WillOnce(Invoke(this, &QuicPacketCreatorTest::SaveSerializedPacket));
   ASSERT_TRUE(creator_.ConsumeData(kCryptoStreamId, io_vector, 0u, 0u, true,
@@ -762,7 +762,7 @@
   EXPECT_TRUE(creator_.HasPendingFrames());
 
   QuicFrame frame;
-  QuicIOVector io_vector(MakeIOVector("test"));
+  QuicIOVector io_vector(MakeIOVectorFromStringPiece("test"));
   ASSERT_TRUE(creator_.ConsumeData(kCryptoStreamId, io_vector, 0u, 0u, false,
                                    false, &frame));
   ASSERT_TRUE(frame.stream_frame);
@@ -805,13 +805,13 @@
   }
   EXPECT_FALSE(creator_.HasPendingFrames());
 
-  QuicIOVector iov(MakeIOVector("test"));
+  QuicIOVector iov(MakeIOVectorFromStringPiece("test"));
   EXPECT_CALL(delegate_, OnSerializedPacket(_))
       .WillOnce(Invoke(this, &QuicPacketCreatorTest::SaveSerializedPacket));
   size_t num_bytes_consumed;
   creator_.CreateAndSerializeStreamFrame(kHeadersStreamId, iov, 0, 0, true,
                                          nullptr, &num_bytes_consumed);
-  EXPECT_EQ(static_cast<size_t>(4), num_bytes_consumed);
+  EXPECT_EQ(4u, num_bytes_consumed);
 
   // Ensure the packet is successfully created.
   ASSERT_TRUE(serialized_packet_.encrypted_buffer);
@@ -833,7 +833,7 @@
             QuicPacketCreatorPeer::GetPacketNumberLength(&creator_));
   // Add a stream frame to the creator.
   QuicFrame frame;
-  QuicIOVector io_vector(MakeIOVector("test"));
+  QuicIOVector io_vector(MakeIOVectorFromStringPiece("test"));
   ASSERT_TRUE(creator_.ConsumeData(kCryptoStreamId, io_vector, 0u, 0u, false,
                                    false, &frame));
   ASSERT_TRUE(frame.stream_frame);
@@ -888,7 +888,7 @@
   EXPECT_EQ(0u, creator_.packet_number());
   // Add a stream frame to the creator and flush the packet.
   QuicFrame frame;
-  QuicIOVector io_vector(MakeIOVector("test"));
+  QuicIOVector io_vector(MakeIOVectorFromStringPiece("test"));
   ASSERT_TRUE(creator_.ConsumeData(kCryptoStreamId, io_vector, 0u, 0u, false,
                                    false, &frame));
   ASSERT_TRUE(frame.stream_frame);
@@ -946,7 +946,7 @@
   message_data.reset(framer.ConstructHandshakeMessage(message));
 
   struct iovec iov;
-  QuicIOVector data_iovec(::net::test::MakeIOVector(
+  QuicIOVector data_iovec(MakeIOVector(
       StringPiece(message_data->data(), message_data->length()), &iov));
   QuicFrame frame;
   EXPECT_CALL(delegate_,
diff --git a/net/quic/core/quic_packet_generator.cc b/net/quic/core/quic_packet_generator.cc
index 9d896f6..b94a54c 100644
--- a/net/quic/core/quic_packet_generator.cc
+++ b/net/quic/core/quic_packet_generator.cc
@@ -4,9 +4,10 @@
 
 #include "net/quic/core/quic_packet_generator.h"
 
+#include <cstdint>
+
 #include "base/logging.h"
 #include "net/quic/core/quic_bug_tracker.h"
-#include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_utils.h"
 
 using base::StringPiece;
@@ -199,7 +200,7 @@
                << " number of queued_control_frames: "
                << queued_control_frames_.size();
       if (!queued_control_frames_.empty()) {
-        DVLOG(1) << queued_control_frames_[0];
+        VLOG(1) << queued_control_frames_[0];
       }
       delegate_->OnUnrecoverableError(QUIC_FAILED_TO_SERIALIZE_PACKET,
                                       "Single frame cannot fit into a packet",
diff --git a/net/quic/core/quic_packet_generator.h b/net/quic/core/quic_packet_generator.h
index c451a46..0ae2e9e 100644
--- a/net/quic/core/quic_packet_generator.h
+++ b/net/quic/core/quic_packet_generator.h
@@ -40,9 +40,8 @@
 #ifndef NET_QUIC_CORE_QUIC_PACKET_GENERATOR_H_
 #define NET_QUIC_CORE_QUIC_PACKET_GENERATOR_H_
 
-#include <stddef.h>
-#include <stdint.h>
-
+#include <cstddef>
+#include <cstdint>
 #include <list>
 
 #include "base/macros.h"
diff --git a/net/quic/core/quic_packet_generator_test.cc b/net/quic/core/quic_packet_generator_test.cc
index 17ae9901..4486fc5 100644
--- a/net/quic/core/quic_packet_generator_test.cc
+++ b/net/quic/core/quic_packet_generator_test.cc
@@ -9,11 +9,11 @@
 #include <string>
 
 #include "base/macros.h"
+#include "base/stl_util.h"
 #include "net/quic/core/crypto/crypto_protocol.h"
 #include "net/quic/core/crypto/null_encrypter.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
-#include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_simple_buffer_allocator.h"
 #include "net/quic/core/quic_utils.h"
 #include "net/quic/platform/api/quic_socket_address.h"
@@ -21,7 +21,6 @@
 #include "net/quic/test_tools/quic_packet_generator_peer.h"
 #include "net/quic/test_tools/quic_test_utils.h"
 #include "net/quic/test_tools/simple_quic_framer.h"
-#include "net/test/gtest_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -204,8 +203,8 @@
     return QuicIOVector(&iov_, 1, len);
   }
 
-  QuicIOVector MakeIOVector(StringPiece s) {
-    return ::net::test::MakeIOVector(s, &iov_);
+  QuicIOVector MakeIOVectorFromStringPiece(StringPiece s) {
+    return MakeIOVector(s, &iov_);
   }
 
   QuicFramer framer_;
@@ -344,7 +343,7 @@
   delegate_.SetCanNotWrite();
 
   QuicConsumedData consumed = generator_.ConsumeData(
-      kHeadersStreamId, MakeIOVector("foo"), 2, true, nullptr);
+      kHeadersStreamId, MakeIOVectorFromStringPiece("foo"), 2, true, nullptr);
   EXPECT_EQ(0u, consumed.bytes_consumed);
   EXPECT_FALSE(consumed.fin_consumed);
   EXPECT_FALSE(generator_.HasQueuedFrames());
@@ -355,7 +354,7 @@
   generator_.StartBatchOperations();
 
   QuicConsumedData consumed = generator_.ConsumeData(
-      kHeadersStreamId, MakeIOVector("foo"), 2, true, nullptr);
+      kHeadersStreamId, MakeIOVectorFromStringPiece("foo"), 2, true, nullptr);
   EXPECT_EQ(3u, consumed.bytes_consumed);
   EXPECT_TRUE(consumed.fin_consumed);
   EXPECT_TRUE(generator_.HasQueuedFrames());
@@ -367,7 +366,7 @@
   EXPECT_CALL(delegate_, OnSerializedPacket(_))
       .WillOnce(Invoke(this, &QuicPacketGeneratorTest::SavePacket));
   QuicConsumedData consumed = generator_.ConsumeData(
-      kHeadersStreamId, MakeIOVector("foo"), 2, true, nullptr);
+      kHeadersStreamId, MakeIOVectorFromStringPiece("foo"), 2, true, nullptr);
   EXPECT_EQ(3u, consumed.bytes_consumed);
   EXPECT_TRUE(consumed.fin_consumed);
   EXPECT_FALSE(generator_.HasQueuedFrames());
@@ -387,7 +386,7 @@
   EXPECT_CALL(delegate_, OnSerializedPacket(_))
       .WillOnce(Invoke(this, &QuicPacketGeneratorTest::SavePacket));
   QuicConsumedData consumed = generator_.ConsumeData(
-      kCryptoStreamId, MakeIOVector("foo"), 0, false, nullptr);
+      kCryptoStreamId, MakeIOVectorFromStringPiece("foo"), 0, false, nullptr);
   EXPECT_EQ(3u, consumed.bytes_consumed);
   EXPECT_FALSE(generator_.HasQueuedFrames());
 
@@ -401,9 +400,10 @@
 }
 
 TEST_F(QuicPacketGeneratorTest, ConsumeData_EmptyData) {
-  EXPECT_QUIC_BUG(generator_.ConsumeData(kHeadersStreamId, MakeIOVector(""), 0,
-                                         false, nullptr),
-                  "Attempt to consume empty data without FIN.");
+  EXPECT_QUIC_BUG(
+      generator_.ConsumeData(kHeadersStreamId, MakeIOVectorFromStringPiece(""),
+                             0, false, nullptr),
+      "Attempt to consume empty data without FIN.");
 }
 
 TEST_F(QuicPacketGeneratorTest,
@@ -411,10 +411,10 @@
   delegate_.SetCanWriteAnything();
   generator_.StartBatchOperations();
 
-  generator_.ConsumeData(kHeadersStreamId, MakeIOVector("foo"), 2, true,
-                         nullptr);
-  QuicConsumedData consumed =
-      generator_.ConsumeData(3, MakeIOVector("quux"), 7, false, nullptr);
+  generator_.ConsumeData(kHeadersStreamId, MakeIOVectorFromStringPiece("foo"),
+                         2, true, nullptr);
+  QuicConsumedData consumed = generator_.ConsumeData(
+      3, MakeIOVectorFromStringPiece("quux"), 7, false, nullptr);
   EXPECT_EQ(4u, consumed.bytes_consumed);
   EXPECT_FALSE(consumed.fin_consumed);
   EXPECT_TRUE(generator_.HasQueuedFrames());
@@ -424,10 +424,10 @@
   delegate_.SetCanWriteAnything();
   generator_.StartBatchOperations();
 
-  generator_.ConsumeData(kHeadersStreamId, MakeIOVector("foo"), 2, true,
-                         nullptr);
-  QuicConsumedData consumed =
-      generator_.ConsumeData(3, MakeIOVector("quux"), 7, false, nullptr);
+  generator_.ConsumeData(kHeadersStreamId, MakeIOVectorFromStringPiece("foo"),
+                         2, true, nullptr);
+  QuicConsumedData consumed = generator_.ConsumeData(
+      3, MakeIOVectorFromStringPiece("quux"), 7, false, nullptr);
   EXPECT_EQ(4u, consumed.bytes_consumed);
   EXPECT_FALSE(consumed.fin_consumed);
   EXPECT_TRUE(generator_.HasQueuedFrames());
@@ -469,15 +469,15 @@
   // Queue enough data to prevent a stream frame with a non-zero offset from
   // fitting.
   QuicConsumedData consumed = generator_.ConsumeData(
-      kHeadersStreamId, MakeIOVector("foo"), 0, false, nullptr);
+      kHeadersStreamId, MakeIOVectorFromStringPiece("foo"), 0, false, nullptr);
   EXPECT_EQ(3u, consumed.bytes_consumed);
   EXPECT_FALSE(consumed.fin_consumed);
   EXPECT_TRUE(generator_.HasQueuedFrames());
 
   // This frame will not fit with the existing frame, causing the queued frame
   // to be serialized, and it will be added to a new open packet.
-  consumed = generator_.ConsumeData(kHeadersStreamId, MakeIOVector("bar"), 3,
-                                    true, nullptr);
+  consumed = generator_.ConsumeData(
+      kHeadersStreamId, MakeIOVectorFromStringPiece("bar"), 3, true, nullptr);
   EXPECT_EQ(3u, consumed.bytes_consumed);
   EXPECT_TRUE(consumed.fin_consumed);
   EXPECT_TRUE(generator_.HasQueuedFrames());
@@ -525,7 +525,8 @@
       .WillOnce(Return(QuicFrame(&ack_frame_)));
 
   // Send some data and a control frame
-  generator_.ConsumeData(3, MakeIOVector("quux"), 7, false, nullptr);
+  generator_.ConsumeData(3, MakeIOVectorFromStringPiece("quux"), 7, false,
+                         nullptr);
   generator_.AddControlFrame(QuicFrame(CreateGoAwayFrame()));
 
   // All five frames will be flushed out in a single packet.
@@ -852,7 +853,7 @@
   generator_.StartBatchOperations();
 
   QuicConsumedData consumed = generator_.ConsumeData(
-      kHeadersStreamId, MakeIOVector("foo"), 2, true, nullptr);
+      kHeadersStreamId, MakeIOVectorFromStringPiece("foo"), 2, true, nullptr);
   EXPECT_EQ(3u, consumed.bytes_consumed);
   EXPECT_TRUE(consumed.fin_consumed);
   EXPECT_TRUE(generator_.HasQueuedFrames());
diff --git a/net/quic/core/quic_packet_writer.h b/net/quic/core/quic_packet_writer.h
index eb30264..5f63a03f 100644
--- a/net/quic/core/quic_packet_writer.h
+++ b/net/quic/core/quic_packet_writer.h
@@ -5,7 +5,7 @@
 #ifndef NET_QUIC_CORE_QUIC_PACKET_WRITER_H_
 #define NET_QUIC_CORE_QUIC_PACKET_WRITER_H_
 
-#include <stddef.h>
+#include <cstddef>
 
 #include "net/quic/core/quic_packets.h"
 #include "net/quic/platform/api/quic_export.h"
diff --git a/net/quic/core/quic_packets.cc b/net/quic/core/quic_packets.cc
index a8873e9..2c7eb0e 100644
--- a/net/quic/core/quic_packets.cc
+++ b/net/quic/core/quic_packets.cc
@@ -5,7 +5,6 @@
 #include "net/quic/core/quic_packets.h"
 
 #include "base/memory/ptr_util.h"
-#include "base/strings/string_number_conversions.h"
 #include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_utils.h"
 #include "net/quic/core/quic_versions.h"
diff --git a/net/quic/core/quic_packets.h b/net/quic/core/quic_packets.h
index 9b34792..1ed4610 100644
--- a/net/quic/core/quic_packets.h
+++ b/net/quic/core/quic_packets.h
@@ -5,6 +5,7 @@
 #ifndef NET_QUIC_CORE_QUIC_PACKETS_H_
 #define NET_QUIC_CORE_QUIC_PACKETS_H_
 
+#include <cstdint>
 #include <limits>
 #include <list>
 #include <memory>
@@ -16,7 +17,6 @@
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/strings/string_piece.h"
-#include "net/base/int128.h"
 #include "net/base/iovec.h"
 #include "net/quic/core/frames/quic_frame.h"
 #include "net/quic/core/quic_ack_listener_interface.h"
@@ -60,7 +60,7 @@
 
 struct QUIC_EXPORT_PRIVATE QuicPacketPublicHeader {
   QuicPacketPublicHeader();
-  explicit QuicPacketPublicHeader(const QuicPacketPublicHeader& other);
+  QuicPacketPublicHeader(const QuicPacketPublicHeader& other);
   ~QuicPacketPublicHeader();
 
   // Universal header. All QuicPacket headers will have a connection_id and
diff --git a/net/quic/core/quic_received_packet_manager.cc b/net/quic/core/quic_received_packet_manager.cc
index 2c8fce0..5aab86c 100644
--- a/net/quic/core/quic_received_packet_manager.cc
+++ b/net/quic/core/quic_received_packet_manager.cc
@@ -13,8 +13,6 @@
 #include "net/quic/core/crypto/crypto_protocol.h"
 #include "net/quic/core/quic_bug_tracker.h"
 #include "net/quic/core/quic_connection_stats.h"
-#include "net/quic/core/quic_flags.h"
-
 
 namespace net {
 
@@ -80,19 +78,6 @@
                                  peer_least_packet_awaiting_ack_);
 }
 
-namespace {
-struct isTooLarge {
-  explicit isTooLarge(QuicPacketNumber n) : largest_observed_(n) {}
-  QuicPacketNumber largest_observed_;
-
-  // Return true if the packet in p is too different from largest_observed_
-  // to express.
-  bool operator()(const std::pair<QuicPacketNumber, QuicTime>& p) const {
-    return largest_observed_ - p.first >= std::numeric_limits<uint8_t>::max();
-  }
-};
-}  // namespace
-
 const QuicFrame QuicReceivedPacketManager::GetUpdatedAckFrame(
     QuicTime approximate_now) {
   ack_frame_updated_ = false;
diff --git a/net/quic/core/quic_received_packet_manager.h b/net/quic/core/quic_received_packet_manager.h
index 87ad150..140a825f 100644
--- a/net/quic/core/quic_received_packet_manager.h
+++ b/net/quic/core/quic_received_packet_manager.h
@@ -5,10 +5,6 @@
 #ifndef NET_QUIC_CORE_QUIC_RECEIVED_PACKET_MANAGER_H_
 #define NET_QUIC_CORE_QUIC_RECEIVED_PACKET_MANAGER_H_
 
-#include <stddef.h>
-
-#include <deque>
-
 #include "base/macros.h"
 #include "net/quic/core/quic_config.h"
 #include "net/quic/core/quic_framer.h"
diff --git a/net/quic/core/quic_received_packet_manager_test.cc b/net/quic/core/quic_received_packet_manager_test.cc
index 8b21b4d..6a2e020 100644
--- a/net/quic/core/quic_received_packet_manager_test.cc
+++ b/net/quic/core/quic_received_packet_manager_test.cc
@@ -9,9 +9,7 @@
 #include <vector>
 
 #include "net/quic/core/quic_connection_stats.h"
-#include "net/quic/core/quic_flags.h"
 #include "net/quic/test_tools/quic_received_packet_manager_peer.h"
-#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
diff --git a/net/quic/core/quic_tag.h b/net/quic/core/quic_tag.h
index f79d63b68..c2803cd 100644
--- a/net/quic/core/quic_tag.h
+++ b/net/quic/core/quic_tag.h
@@ -44,8 +44,7 @@
                                            QuicTag* out_result,
                                            size_t* out_index);
 
-// A utility function that converts a tag to a std::string. It will try to
-// maintain
+// A utility function that converts a tag to a string. It will try to maintain
 // the human friendly name if possible (i.e. kABCD -> "ABCD"), or will just
 // treat it as a number if not.
 QUIC_EXPORT_PRIVATE std::string QuicTagToString(QuicTag tag);
diff --git a/net/quic/core/quic_time.cc b/net/quic/core/quic_time.cc
index c9e72ce..a954b57 100644
--- a/net/quic/core/quic_time.cc
+++ b/net/quic/core/quic_time.cc
@@ -12,10 +12,11 @@
 #include "base/strings/stringprintf.h"
 
 using base::StringPrintf;
+using std::string;
 
 namespace net {
 
-std::string QuicTime::Delta::ToDebugValue() const {
+string QuicTime::Delta::ToDebugValue() const {
   const int64_t one_ms = 1000;
   const int64_t one_s = 1000 * one_ms;
 
diff --git a/net/quic/core/quic_unacked_packet_map.cc b/net/quic/core/quic_unacked_packet_map.cc
index ce0829e..6319462 100644
--- a/net/quic/core/quic_unacked_packet_map.cc
+++ b/net/quic/core/quic_unacked_packet_map.cc
@@ -6,13 +6,10 @@
 
 #include "base/logging.h"
 #include "base/stl_util.h"
-#include "net/quic/chromium/quic_utils_chromium.h"
 #include "net/quic/core/quic_bug_tracker.h"
 #include "net/quic/core/quic_connection_stats.h"
-#include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_utils.h"
 
-
 namespace net {
 
 QuicUnackedPacketMap::QuicUnackedPacketMap()
diff --git a/net/quic/core/quic_unacked_packet_map.h b/net/quic/core/quic_unacked_packet_map.h
index 7980443..1901f49e 100644
--- a/net/quic/core/quic_unacked_packet_map.h
+++ b/net/quic/core/quic_unacked_packet_map.h
@@ -5,8 +5,7 @@
 #ifndef NET_QUIC_CORE_QUIC_UNACKED_PACKET_MAP_H_
 #define NET_QUIC_CORE_QUIC_UNACKED_PACKET_MAP_H_
 
-#include <stddef.h>
-
+#include <cstddef>
 #include <deque>
 
 #include "base/macros.h"
diff --git a/net/quic/core/quic_unacked_packet_map_test.cc b/net/quic/core/quic_unacked_packet_map_test.cc
index 9096fc7..443cae6 100644
--- a/net/quic/core/quic_unacked_packet_map_test.cc
+++ b/net/quic/core/quic_unacked_packet_map_test.cc
@@ -4,12 +4,9 @@
 
 #include "net/quic/core/quic_unacked_packet_map.h"
 
-#include "net/quic/core/quic_flags.h"
-#include "net/quic/core/quic_utils.h"
 #include "net/quic/test_tools/quic_test_utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-
 namespace net {
 namespace test {
 namespace {
diff --git a/net/quic/core/quic_utils_test.cc b/net/quic/core/quic_utils_test.cc
index beac31b..a6d794e 100644
--- a/net/quic/core/quic_utils_test.cc
+++ b/net/quic/core/quic_utils_test.cc
@@ -4,7 +4,7 @@
 
 #include "net/quic/core/quic_utils.h"
 
-#include "net/quic/core/quic_flags.h"
+#include "net/quic/core/crypto/crypto_protocol.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using base::StringPiece;
diff --git a/net/quic/test_tools/quic_connection_peer.cc b/net/quic/test_tools/quic_connection_peer.cc
index a4d58f1..7c176e7 100644
--- a/net/quic/test_tools/quic_connection_peer.cc
+++ b/net/quic/test_tools/quic_connection_peer.cc
@@ -6,6 +6,7 @@
 
 #include "base/stl_util.h"
 #include "net/quic/core/congestion_control/send_algorithm_interface.h"
+#include "net/quic/core/quic_flags.h"
 #include "net/quic/core/quic_multipath_sent_packet_manager.h"
 #include "net/quic/core/quic_packet_writer.h"
 #include "net/quic/core/quic_received_packet_manager.h"
diff --git a/net/quic/test_tools/quic_test_utils.h b/net/quic/test_tools/quic_test_utils.h
index a2d4848f..55faee5 100644
--- a/net/quic/test_tools/quic_test_utils.h
+++ b/net/quic/test_tools/quic_test_utils.h
@@ -34,6 +34,7 @@
 #include "net/quic/test_tools/mock_clock.h"
 #include "net/quic/test_tools/mock_random.h"
 #include "net/spdy/spdy_framer.h"
+#include "net/test/gtest_util.h"
 #include "net/tools/quic/quic_dispatcher.h"
 #include "net/tools/quic/quic_per_connection_packet_writer.h"
 #include "net/tools/quic/test_tools/mock_quic_server_session_visitor.h"
diff --git a/skia/ext/bitmap_platform_device_cairo.cc b/skia/ext/bitmap_platform_device_cairo.cc
index 093719e..261228b 100644
--- a/skia/ext/bitmap_platform_device_cairo.cc
+++ b/skia/ext/bitmap_platform_device_cairo.cc
@@ -166,11 +166,12 @@
 
 // PlatformCanvas impl
 
-std::unique_ptr<SkCanvas> CreatePlatformCanvas(int width,
-                                               int height,
-                                               bool is_opaque,
-                                               uint8_t* data,
-                                               OnFailureType failureType) {
+std::unique_ptr<SkCanvas> CreatePlatformCanvasWithPixels(
+    int width,
+    int height,
+    bool is_opaque,
+    uint8_t* data,
+    OnFailureType failureType) {
   sk_sp<SkBaseDevice> dev(
       BitmapPlatformDevice::Create(width, height, is_opaque, data));
   return CreateCanvas(dev, failureType);
diff --git a/skia/ext/bitmap_platform_device_mac.cc b/skia/ext/bitmap_platform_device_mac.cc
index bf02a89..ba5f81b 100644
--- a/skia/ext/bitmap_platform_device_mac.cc
+++ b/skia/ext/bitmap_platform_device_mac.cc
@@ -260,22 +260,12 @@
 
 // PlatformCanvas impl
 
-std::unique_ptr<SkCanvas> CreatePlatformCanvas(CGContextRef ctx,
-                                               int width,
-                                               int height,
-                                               bool is_opaque,
-                                               OnFailureType failureType) {
-  const bool do_clear = false;
-  sk_sp<SkBaseDevice> dev(
-      BitmapPlatformDevice::Create(ctx, width, height, is_opaque, do_clear));
-  return CreateCanvas(dev, failureType);
-}
-
-std::unique_ptr<SkCanvas> CreatePlatformCanvas(int width,
-                                               int height,
-                                               bool is_opaque,
-                                               uint8_t* data,
-                                               OnFailureType failureType) {
+std::unique_ptr<SkCanvas> CreatePlatformCanvasWithPixels(
+    int width,
+    int height,
+    bool is_opaque,
+    uint8_t* data,
+    OnFailureType failureType) {
   sk_sp<SkBaseDevice> dev(
       BitmapPlatformDevice::CreateWithData(data, width, height, is_opaque));
   return CreateCanvas(dev, failureType);
diff --git a/skia/ext/bitmap_platform_device_skia.cc b/skia/ext/bitmap_platform_device_skia.cc
index d19810b..a39e5d71 100644
--- a/skia/ext/bitmap_platform_device_skia.cc
+++ b/skia/ext/bitmap_platform_device_skia.cc
@@ -60,11 +60,12 @@
 
 // PlatformCanvas impl
 
-std::unique_ptr<SkCanvas> CreatePlatformCanvas(int width,
-                                               int height,
-                                               bool is_opaque,
-                                               uint8_t* data,
-                                               OnFailureType failureType) {
+std::unique_ptr<SkCanvas> CreatePlatformCanvasWithPixels(
+    int width,
+    int height,
+    bool is_opaque,
+    uint8_t* data,
+    OnFailureType failureType) {
   sk_sp<SkBaseDevice> dev(
       BitmapPlatformDevice::Create(width, height, is_opaque, data));
   return CreateCanvas(dev, failureType);
diff --git a/skia/ext/bitmap_platform_device_win.cc b/skia/ext/bitmap_platform_device_win.cc
index 44a3ea5..b792c0fd 100644
--- a/skia/ext/bitmap_platform_device_win.cc
+++ b/skia/ext/bitmap_platform_device_win.cc
@@ -207,11 +207,12 @@
 
 // PlatformCanvas impl
 
-std::unique_ptr<SkCanvas> CreatePlatformCanvas(int width,
-                                               int height,
-                                               bool is_opaque,
-                                               HANDLE shared_section,
-                                               OnFailureType failureType) {
+std::unique_ptr<SkCanvas> CreatePlatformCanvasWithSharedSection(
+    int width,
+    int height,
+    bool is_opaque,
+    HANDLE shared_section,
+    OnFailureType failureType) {
   sk_sp<SkBaseDevice> dev(
       BitmapPlatformDevice::Create(width, height, is_opaque, shared_section));
   return CreateCanvas(dev, failureType);
diff --git a/skia/ext/platform_canvas.h b/skia/ext/platform_canvas.h
index 04a4d17..20b958b 100644
--- a/skia/ext/platform_canvas.h
+++ b/skia/ext/platform_canvas.h
@@ -45,7 +45,7 @@
 #if defined(WIN32)
   // The shared_section parameter is passed to gfx::PlatformDevice::create.
   // See it for details.
-SK_API std::unique_ptr<SkCanvas> CreatePlatformCanvas(
+SK_API std::unique_ptr<SkCanvas> CreatePlatformCanvasWithSharedSection(
     int width,
     int height,
     bool is_opaque,
@@ -61,27 +61,11 @@
                                 int x,
                                 int y,
                                 const RECT* src_rect);
-#elif defined(__APPLE__)
-SK_API std::unique_ptr<SkCanvas> CreatePlatformCanvas(
-    CGContextRef context,
-    int width,
-    int height,
-    bool is_opaque,
-    OnFailureType failure_type);
-
-SK_API std::unique_ptr<SkCanvas> CreatePlatformCanvas(
-    int width,
-    int height,
-    bool is_opaque,
-    uint8_t* context,
-    OnFailureType failure_type);
 #elif defined(__linux__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \
-      defined(__sun) || defined(ANDROID)
-  // Linux ---------------------------------------------------------------------
-
+      defined(__sun) || defined(ANDROID) || defined(__APPLE__)
   // Construct a canvas from the given memory region. The memory is not cleared
   // first. @data must be, at least, @height * StrideForWidth(@width) bytes.
-SK_API std::unique_ptr<SkCanvas> CreatePlatformCanvas(
+SK_API std::unique_ptr<SkCanvas> CreatePlatformCanvasWithPixels(
     int width,
     int height,
     bool is_opaque,
@@ -92,23 +76,28 @@
 static inline std::unique_ptr<SkCanvas> CreatePlatformCanvas(int width,
                                                              int height,
                                                              bool is_opaque) {
-  return CreatePlatformCanvas(width, height, is_opaque, 0, CRASH_ON_FAILURE);
+#if defined(WIN32)
+  return CreatePlatformCanvasWithSharedSection(width, height, is_opaque, 0,
+                                               CRASH_ON_FAILURE);
+#else
+  return CreatePlatformCanvasWithPixels(width, height, is_opaque, 0,
+                                        CRASH_ON_FAILURE);
+#endif
 }
 
 SK_API std::unique_ptr<SkCanvas> CreateCanvas(const sk_sp<SkBaseDevice>& device,
                                               OnFailureType failure_type);
 
-static inline std::unique_ptr<SkCanvas> CreateBitmapCanvas(int width,
-                                                           int height,
-                                                           bool is_opaque) {
-  return CreatePlatformCanvas(width, height, is_opaque, 0, CRASH_ON_FAILURE);
-}
-
 static inline std::unique_ptr<SkCanvas> TryCreateBitmapCanvas(int width,
                                                               int height,
                                                               bool is_opaque) {
-  return CreatePlatformCanvas(width, height, is_opaque, 0,
-                              RETURN_NULL_ON_FAILURE);
+#if defined(WIN32)
+  return CreatePlatformCanvasWithSharedSection(width, height, is_opaque, 0,
+                                               RETURN_NULL_ON_FAILURE);
+#else
+  return CreatePlatformCanvasWithPixels(width, height, is_opaque, 0,
+                                        RETURN_NULL_ON_FAILURE);
+#endif
 }
 
 // Return the stride (length of a line in bytes) for the given width. Because
diff --git a/skia/ext/skia_utils_mac.mm b/skia/ext/skia_utils_mac.mm
index 57fb707..e2dbb80 100644
--- a/skia/ext/skia_utils_mac.mm
+++ b/skia/ext/skia_utils_mac.mm
@@ -190,8 +190,8 @@
   int width = CGImageGetWidth(image);
   int height = CGImageGetHeight(image);
 
-  std::unique_ptr<SkCanvas> canvas(skia::CreatePlatformCanvas(
-      nullptr, width, height, false, RETURN_NULL_ON_FAILURE));
+  std::unique_ptr<SkCanvas> canvas(
+      skia::TryCreateBitmapCanvas(width, height, false));
   ScopedPlatformPaint p(canvas.get());
   CGContextRef context = p.GetNativeDrawingContext();
 
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index c66a62bc..ad45cf2 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -775,9 +775,7 @@
 crbug.com/567837 virtual/scalefactor150/fast/hidpi/static/mousewheel-scroll-amount.html [ Skip ]
 crbug.com/567837 virtual/scalefactor150/fast/hidpi/static/gesture-scroll-amount.html [ Skip ]
 
-crbug.com/676233 [ Linux ] virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance.html [ Failure ]
-crbug.com/676233 [ Linux ] virtual/scalefactor150/fast/hidpi/static/popup-menu-with-scrollbar-appearance.html [ Failure ]
-crbug.com/676233 virtual/scalefactor200/fast/hidpi/static/popup-menu-with-scrollbar-appearance.html [ Skip ]
+crbug.com/676754 [ Linux ] virtual/scalefactor200/fast/hidpi/static/popup-menu-with-scrollbar-appearance.html [ Pass Failure ]
 
 # TODO(ojan): These tests aren't flaky. See crbug.com/517144.
 # Release trybots run asserts, but the main waterfall ones don't. So, even
diff --git a/third_party/WebKit/LayoutTests/fast/css/invalidation/reschedule-for-removed-sibling.html b/third_party/WebKit/LayoutTests/fast/css/invalidation/reschedule-for-removed-sibling.html
new file mode 100644
index 0000000..49b1249
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/invalidation/reschedule-for-removed-sibling.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<style>
+    div {
+        background-color: green;
+        width: 100px;
+        height: 100px;
+    }
+    .red + div { background-color: red }
+</style>
+<p>You should see a green square below.</p>
+<div id="toRemove" class="red"></div>
+<div id="sibling"></div>
+<script>
+    test(() => {
+        assert_equals(getComputedStyle(sibling).backgroundColor, "rgb(255, 0, 0)", "Background is initially red.");
+    }, "Initial background color.");
+
+    test(() => {
+        toRemove.className = "";
+        toRemove.remove();
+        assert_equals(getComputedStyle(sibling).backgroundColor, "rgb(0, 128, 0)", "Background is green after sibling is removed.");
+    }, "Background color changed after sibling removed.");
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point-readonly.html b/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point-readonly.html
index c71e8e1..285cc0a 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point-readonly.html
+++ b/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point-readonly.html
@@ -21,4 +21,8 @@
   assert_readonly(point, 'w');
 }, 'DOMPointReadOnly readonly test');
 
+test(() => {
+  var point = new DOMPointReadOnly(1, 2, 3, 4);
+  assert_object_equals(point.toJSON(), {x: 1, y: 2, z: 3, w: 4});
+}, 'DOMPointReadOnly toJSON');
 </script>
diff --git a/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point.html b/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point.html
index 9c6fa14..49a00c7 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point.html
+++ b/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-point.html
@@ -62,4 +62,9 @@
   assert_dom_point_equals(point, [10, 20, 30, 40]);
 }, 'DOMPoint setter');
 
+test(() => {
+  var point = new DOMPoint(1, 2, 3, 4);
+  assert_object_equals(point.toJSON(), {x: 1, y: 2, z: 3, w: 4});
+}, 'DOMPoint toJSON');
+
 </script>
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/scalefactor150/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.txt b/third_party/WebKit/LayoutTests/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/virtual/scalefactor150/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.txt
rename to third_party/WebKit/LayoutTests/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor150/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png b/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor150/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
index c8c76f28..8d2c616 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor150/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor150/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png b/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
index 9b9c725..cd257f7 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png b/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
index 9b9c725..cf94df6 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.txt
deleted file mode 100644
index b1a3c54..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/virtual/scalefactor200withzoom/fast/hidpi/static/popup-menu-with-scrollbar-appearance-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-The scrollbar width should be properly scaled..
-
-
-
diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index ce5fa74..daa8b06 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
@@ -1126,6 +1126,7 @@
     getter y
     getter z
     method constructor
+    method toJSON
 interface DOMRect : DOMRectReadOnly
     attribute @@toStringTag
     getter height
diff --git a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
index 5a57a75c..7c48d69 100644
--- a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
+++ b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
@@ -132,6 +132,25 @@
   }
 }
 
+void StyleInvalidator::rescheduleSiblingInvalidationsAsDescendants(
+    Element& element) {
+  DCHECK(element.parentNode());
+  PendingInvalidations* pendingInvalidations =
+      m_pendingInvalidationMap.get(&element);
+  if (!pendingInvalidations || pendingInvalidations->siblings().isEmpty())
+    return;
+
+  InvalidationLists invalidationLists;
+  for (const auto& invalidationSet : pendingInvalidations->siblings()) {
+    invalidationLists.descendants.push_back(invalidationSet);
+    if (DescendantInvalidationSet* descendants =
+            toSiblingInvalidationSet(*invalidationSet).siblingDescendants()) {
+      invalidationLists.descendants.push_back(descendants);
+    }
+  }
+  scheduleInvalidationSetsForNode(invalidationLists, *element.parentNode());
+}
+
 void StyleInvalidator::clearInvalidation(ContainerNode& node) {
   if (!node.needsStyleInvalidation())
     return;
diff --git a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h
index aaaa1f95..b806ee82 100644
--- a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h
+++ b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h
@@ -31,6 +31,7 @@
   void scheduleSiblingInvalidationsAsDescendants(
       const InvalidationLists&,
       ContainerNode& schedulingParent);
+  void rescheduleSiblingInvalidationsAsDescendants(Element&);
   void clearInvalidation(ContainerNode&);
 
   DEFINE_INLINE_TRACE() { visitor->trace(m_pendingInvalidationMap); }
diff --git a/third_party/WebKit/Source/core/dom/DOMPointReadOnly.cpp b/third_party/WebKit/Source/core/dom/DOMPointReadOnly.cpp
index e62791e..024d062 100644
--- a/third_party/WebKit/Source/core/dom/DOMPointReadOnly.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMPointReadOnly.cpp
@@ -4,6 +4,9 @@
 
 #include "core/dom/DOMPointReadOnly.h"
 
+#include "bindings/core/v8/ScriptValue.h"
+#include "bindings/core/v8/V8ObjectBuilder.h"
+
 namespace blink {
 
 DOMPointReadOnly* DOMPointReadOnly::create(double x,
@@ -13,6 +16,16 @@
   return new DOMPointReadOnly(x, y, z, w);
 }
 
+ScriptValue DOMPointReadOnly::toJSONForBinding(
+    ScriptState* scriptState) const {
+  V8ObjectBuilder result(scriptState);
+  result.addNumber("x", x());
+  result.addNumber("y", y());
+  result.addNumber("z", z());
+  result.addNumber("w", w());
+  return result.scriptValue();
+}
+
 DOMPointReadOnly::DOMPointReadOnly(double x, double y, double z, double w)
     : m_x(x), m_y(y), m_z(z), m_w(w) {}
 
diff --git a/third_party/WebKit/Source/core/dom/DOMPointReadOnly.h b/third_party/WebKit/Source/core/dom/DOMPointReadOnly.h
index 0c2f98a2..f2544d9 100644
--- a/third_party/WebKit/Source/core/dom/DOMPointReadOnly.h
+++ b/third_party/WebKit/Source/core/dom/DOMPointReadOnly.h
@@ -11,6 +11,9 @@
 
 namespace blink {
 
+class ScriptValue;
+class ScriptState;
+
 class CORE_EXPORT DOMPointReadOnly : public GarbageCollected<DOMPointReadOnly>,
                                      public ScriptWrappable {
   DEFINE_WRAPPERTYPEINFO();
@@ -24,7 +27,9 @@
   double w() const { return m_w; }
 
   DEFINE_INLINE_TRACE() {}
-
+  
+  ScriptValue toJSONForBinding(ScriptState*) const;
+ 
  protected:
   DOMPointReadOnly(double x, double y, double z, double w);
 
diff --git a/third_party/WebKit/Source/core/dom/DOMPointReadOnly.idl b/third_party/WebKit/Source/core/dom/DOMPointReadOnly.idl
index d80c8252..e94259e 100644
--- a/third_party/WebKit/Source/core/dom/DOMPointReadOnly.idl
+++ b/third_party/WebKit/Source/core/dom/DOMPointReadOnly.idl
@@ -17,4 +17,5 @@
 
     // FIXME: Implement matrixTransform.
     // DOMPoint matrixTransform(DOMMatrixReadOnly matrix);
+    serializer = { attribute };
 };
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index c673093..3bc2657a5 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -4217,6 +4217,9 @@
 
   if (containsV1ShadowTree())
     n.checkSlotChangeBeforeRemoved();
+
+  if (n.inActiveDocument() && n.isElementNode())
+    styleEngine().elementWillBeRemoved(toElement(n));
 }
 
 void Document::dataWillChange(const CharacterData& characterData) {
diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.h b/third_party/WebKit/Source/core/dom/StyleEngine.h
index 7f1027ba..6bc6201 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.h
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.h
@@ -240,6 +240,10 @@
   void scheduleInvalidationsForRuleSets(TreeScope&,
                                         const HeapHashSet<Member<RuleSet>>&);
 
+  void elementWillBeRemoved(Element& element) {
+    m_styleInvalidator.rescheduleSiblingInvalidationsAsDescendants(element);
+  }
+
   unsigned styleForElementCount() const { return m_styleForElementCount; }
   void incStyleForElementCount() { m_styleForElementCount++; }
 
diff --git a/third_party/WebKit/Source/devtools/front_end/profiler/CPUProfileFlameChart.js b/third_party/WebKit/Source/devtools/front_end/profiler/CPUProfileFlameChart.js
index 2be15e8..60e19a7 100644
--- a/third_party/WebKit/Source/devtools/front_end/profiler/CPUProfileFlameChart.js
+++ b/third_party/WebKit/Source/devtools/front_end/profiler/CPUProfileFlameChart.js
@@ -58,30 +58,6 @@
    * @override
    * @return {number}
    */
-  barHeight() {
-    return 15;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  textBaseline() {
-    return 4;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  textPadding() {
-    return 2;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
   minimumBoundary() {
     return this._cpuProfile.profileStartTime;
   }
@@ -162,10 +138,10 @@
    */
   entryFont(entryIndex) {
     if (!this._font) {
-      this._font = (this.barHeight() - 4) + 'px ' + Host.fontFamily();
+      this._font = '11px ' + Host.fontFamily();
       this._boldFont = 'bold ' + this._font;
     }
-    var node = this._entryNodes[entryIndex];
+    const node = this._entryNodes[entryIndex];
     return node.deoptReason ? this._boldFont : this._font;
   }
 
@@ -207,14 +183,6 @@
 
   /**
    * @override
-   * @return {number}
-   */
-  paddingLeft() {
-    return 0;
-  }
-
-  /**
-   * @override
    * @param {number} entryIndex
    * @return {string}
    */
@@ -242,6 +210,9 @@
     this._overviewPane.show(this.element);
 
     this._mainPane = new UI.FlameChart(dataProvider, this._overviewPane);
+    this._mainPane.setBarHeight(15);
+    this._mainPane.setTextBaseline(4);
+    this._mainPane.setTextPadding(2);
     this._mainPane.show(this.element);
     this._mainPane.addEventListener(UI.FlameChart.Events.EntrySelected, this._onEntrySelected, this);
     this._overviewPane.addEventListener(UI.OverviewGrid.Events.WindowChanged, this._onWindowChanged, this);
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChart.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChart.js
index 714fe66..2f92428 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChart.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChart.js
@@ -754,14 +754,6 @@
   }
 
   /**
-   * @override
-   * @return {number}
-   */
-  paddingLeft() {
-    return 0;
-  }
-
-  /**
    * @param {?Timeline.TimelineSelection} selection
    * @return {number}
    */
@@ -789,30 +781,6 @@
   }
 
   /**
-   * @override
-   * @return {number}
-   */
-  barHeight() {
-    return Timeline.FlameChartStyle.barHeight;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  textBaseline() {
-    return Timeline.FlameChartStyle.textBaseline;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  textPadding() {
-    return Timeline.FlameChartStyle.textPadding;
-  }
-
-  /**
    * @param {!SDK.TracingModel.Event} event
    * @return {boolean}
    */
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
index eb9a684..0b4d4d7 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
@@ -2,11 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-Timeline.FlameChartStyle = {};
-Timeline.FlameChartStyle.barHeight = 17;
-Timeline.FlameChartStyle.textBaseline = 5;
-Timeline.FlameChartStyle.textPadding = 5;
-Timeline.FlameChartStyle.textColor = '#333';
+Timeline.FlameChartStyle = {
+  textColor: '#333'
+};
+
 /**
  * @enum {symbol}
  */
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineNetworkFlameChart.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineNetworkFlameChart.js
index 75b81b4..99b668d 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineNetworkFlameChart.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineNetworkFlameChart.js
@@ -223,13 +223,14 @@
     const textStart = Math.max(sendStart, 0);
     const textWidth = finish - textStart;
     const minTextWidthPx = 20;
-    const textPadding = 4;
     if (textWidth >= minTextWidthPx) {
       text = this.entryTitle(index) || '';
       if (request.fromServiceWorker)
         text = '⚙ ' + text;
       if (text) {
-        const textBaseHeight = barHeight - this.textBaseline();
+        const textPadding = 4;
+        const textBaseline = 5;
+        const textBaseHeight = barHeight - textBaseline;
         const trimmedText = UI.trimTextEnd(context, text, textWidth - 2 * textPadding);
         context.fillStyle = '#333';
         context.fillText(trimmedText, textStart + textPadding, barY + textBaseHeight);
@@ -369,36 +370,4 @@
   canJumpToEntry(entryIndex) {
     return false;
   }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  paddingLeft() {
-    return 0;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  barHeight() {
-    return Timeline.FlameChartStyle.barHeight;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  textBaseline() {
-    return Timeline.FlameChartStyle.textBaseline;
-  }
-
-  /**
-   * @override
-   * @return {number}
-   */
-  textPadding() {
-    return Timeline.FlameChartStyle.textPadding;
-  }
 };
diff --git a/third_party/WebKit/Source/devtools/front_end/ui_lazy/FlameChart.js b/third_party/WebKit/Source/devtools/front_end/ui_lazy/FlameChart.js
index b04e141..d3479bb 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui_lazy/FlameChart.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui_lazy/FlameChart.js
@@ -27,6 +27,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 /**
  * @interface
  */
@@ -86,8 +87,10 @@
     this._timeWindowRight = Infinity;
     this._rangeSelectionStart = 0;
     this._rangeSelectionEnd = 0;
-    this._barHeight = dataProvider.barHeight();
-    this._paddingLeft = this._dataProvider.paddingLeft();
+    this._barHeight = 17;
+    this._textBaseline = 5;
+    this._textPadding = 5;
+    this._paddingLeft = 0;
     var markerPadding = 2;
     this._markerRadius = this._barHeight / 2 - markerPadding;
 
@@ -120,6 +123,34 @@
   }
 
   /**
+   * @param {number} value
+   */
+  setBarHeight(value) {
+    this._barHeight = value;
+  }
+
+  /**
+   * @param {number} value
+   */
+  setTextBaseline(value) {
+    this._textBaseline = value;
+  }
+
+  /**
+   * @param {number} value
+   */
+  setTextPadding(value) {
+    this._textPadding = value;
+  }
+
+  /**
+   * @param {number} value
+   */
+  setPaddingLeft(value) {
+    this._paddingLeft = value;
+  }
+
+  /**
    * @param {boolean} enable
    */
   enableRuler(enable) {
@@ -557,7 +588,7 @@
 
     var titleIndices = [];
     var markerIndices = [];
-    var textPadding = this._dataProvider.textPadding();
+    var textPadding = this._textPadding;
     var minTextWidth = 2 * textPadding + UI.measureTextWidth(context, '\u2026');
     var barHeight = this._barHeight;
     var minVisibleBarLevel = Math.max(this._visibleLevelOffsets.upperBound(top) - 1, 0);
@@ -641,7 +672,7 @@
     context.stroke();
 
     context.textBaseline = 'alphabetic';
-    var textBaseHeight = this._barHeight - this._dataProvider.textBaseline();
+    var textBaseHeight = this._barHeight - this._textBaseline;
 
     for (var i = 0; i < titleIndices.length; ++i) {
       var entryIndex = titleIndices[i];
@@ -687,7 +718,7 @@
     var top = this.getScrollOffset();
     var ratio = window.devicePixelRatio;
     var barHeight = this._barHeight;
-    var textBaseHeight = barHeight - this._dataProvider.textBaseline();
+    var textBaseHeight = barHeight - this._textBaseline;
     var groups = this._rawTimelineData.groups || [];
     if (!groups.length)
       return;
@@ -1223,11 +1254,6 @@
   /**
    * @return {number}
    */
-  barHeight() {},
-
-  /**
-   * @return {number}
-   */
   minimumBoundary() {},
 
   /**
@@ -1307,21 +1333,6 @@
    * @return {string}
    */
   textColor(entryIndex) {},
-
-  /**
-   * @return {number}
-   */
-  textBaseline() {},
-
-  /**
-   * @return {number}
-   */
-  textPadding() {},
-
-  /**
-   * @return {number}
-   */
-  paddingLeft() {},
 };
 
 /**
diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index a974f2ab..7f7fe873 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn
@@ -1517,6 +1517,14 @@
       "/wd4334",  # Result of 32-bit shift implicitly converted to 64 bits.
       "/wd4724",  # Modulo by 0.
     ]
+
+    # crbug.com/654776: Suppress symbol import warnings.
+    if (is_component_build) {
+      ldflags = [
+        "/ignore:4217",
+        "/ignore:4049",
+      ]
+    }
   } else {
     sources -= [
       "clipboard/ClipboardUtilitiesWin.cpp",
diff --git a/tools/clang/empty_string/EmptyStringConverter.cpp b/tools/clang/empty_string/EmptyStringConverter.cpp
index fce692f..c2da652 100644
--- a/tools/clang/empty_string/EmptyStringConverter.cpp
+++ b/tools/clang/empty_string/EmptyStringConverter.cpp
@@ -94,11 +94,17 @@
                            &constructor_callback_);
   match_finder->addMatcher(cxxNewExpr(has(constructor_call)),
                            &constructor_callback_);
-  match_finder->addMatcher(cxxBindTemporaryExpr(has(constructor_call)),
-                           &temporary_callback_);
+  // The implicitly generated constructor for temporary could be wrapped by
+  // implicitCastExpr, so ignoringParenImpCasts is needed.
   match_finder->addMatcher(
-      cxxConstructorDecl(forEach(expr(has(constructor_call)))),
-      &initializer_callback_);
+      cxxBindTemporaryExpr(ignoringParenImpCasts(forEach(constructor_call))),
+      &temporary_callback_);
+  // Note that forEachConstructorInitializer is needed. The std::string
+  // constructor is wrapped by exprWithCleanups and cxxCtorInitializer.
+  // forEach() would not work.
+  match_finder->addMatcher(cxxConstructorDecl(forEachConstructorInitializer(
+                               withInitializer(expr(has(constructor_call))))),
+                           &initializer_callback_);
 }
 
 void ConstructorCallback::run(const MatchFinder::MatchResult& result) {
@@ -111,7 +117,8 @@
       result.Nodes.getNodeAs<clang::CXXConstructExpr>("call");
   clang::CharSourceRange range =
       clang::CharSourceRange::getTokenRange(call->getParenOrBraceRange());
-  replacements_->insert(Replacement(*result.SourceManager, range, ""));
+  auto err = replacements_->add(Replacement(*result.SourceManager, range, ""));
+  assert(!err);
 }
 
 void InitializerCallback::run(const MatchFinder::MatchResult& result) {
@@ -122,7 +129,8 @@
 
   const clang::CXXConstructExpr* call =
       result.Nodes.getNodeAs<clang::CXXConstructExpr>("call");
-  replacements_->insert(Replacement(*result.SourceManager, call, ""));
+  auto err = replacements_->add(Replacement(*result.SourceManager, call, ""));
+  assert(!err);
 }
 
 void TemporaryCallback::run(const MatchFinder::MatchResult& result) {
@@ -139,11 +147,14 @@
   // for |call| in the explicit case doesn't include the closing parenthesis.
   clang::SourceRange range = call->getParenOrBraceRange();
   if (range.isValid()) {
-    replacements_->insert(Replacement(*result.SourceManager, literal, ""));
+    auto err =
+        replacements_->add(Replacement(*result.SourceManager, literal, ""));
+    assert(!err);
   } else {
-    replacements_->insert(
+    auto err = replacements_->add(
         Replacement(*result.SourceManager, call,
                     literal->isWide() ? "std::wstring()" : "std::string()"));
+    assert(!err);
   }
 }
 
diff --git a/tools/clang/pass_to_move/PassToMove.cpp b/tools/clang/pass_to_move/PassToMove.cpp
index c5858f4..48d4aae 100644
--- a/tools/clang/pass_to_move/PassToMove.cpp
+++ b/tools/clang/pass_to_move/PassToMove.cpp
@@ -49,22 +49,22 @@
   const char kMoveRefText[] = "std::move(";
   const char kMovePtrText[] = "std::move(*";
 
-  replacements_->emplace(*result.SourceManager,
-                         result.SourceManager->getSpellingLoc(
-                             arg->getLocStart()),
-                         0,
-                         is_arrow ? kMovePtrText : kMoveRefText);
+  auto err = replacements_->add(
+      Replacement(*result.SourceManager,
+                  result.SourceManager->getSpellingLoc(arg->getLocStart()), 0,
+                  is_arrow ? kMovePtrText : kMoveRefText));
+  assert(!err);
 
   // Delete everything but the closing parentheses from the original call to
   // Pass(): the closing parantheses is left to match up with the parantheses
   // just inserted with std::move.
-  replacements_->emplace(*result.SourceManager,
-                         clang::CharSourceRange::getCharRange(
-                             result.SourceManager->getSpellingLoc(
-                                 callee->getOperatorLoc()),
-                             result.SourceManager->getSpellingLoc(
-                                 call_expr->getRParenLoc())),
-                         "");
+  err = replacements_->add(Replacement(
+      *result.SourceManager,
+      clang::CharSourceRange::getCharRange(
+          result.SourceManager->getSpellingLoc(callee->getOperatorLoc()),
+          result.SourceManager->getSpellingLoc(call_expr->getRParenLoc())),
+      ""));
+  assert(!err);
 }
 
 }  // namespace
diff --git a/tools/clang/pass_to_move/tests/test-expected.cc b/tools/clang/pass_to_move/tests/test-expected.cc
index 65003f8..4da848d4 100644
--- a/tools/clang/pass_to_move/tests/test-expected.cc
+++ b/tools/clang/pass_to_move/tests/test-expected.cc
@@ -54,9 +54,7 @@
   A a5;
   F f = std::move(F(std::move(a5)));
 
-  // Chained Pass is handled (mostly) correctly. The replacement applier dedupes
-  // the insertion of std::move, so the result is not completely correct...
-  // ... but hopefully there's very little code following this broken pattern.
+  // Chained Pass is handled correctly.
   A a6;
-  A a7 = std::move(a6));
+  A a7 = std::move(std::move(a6));
 }
diff --git a/tools/clang/pass_to_move/tests/test-original.cc b/tools/clang/pass_to_move/tests/test-original.cc
index 1e2a96d..c561e125 100644
--- a/tools/clang/pass_to_move/tests/test-original.cc
+++ b/tools/clang/pass_to_move/tests/test-original.cc
@@ -54,9 +54,7 @@
   A a5;
   F f = F(a5.Pass()).Pass();
 
-  // Chained Pass is handled (mostly) correctly. The replacement applier dedupes
-  // the insertion of std::move, so the result is not completely correct...
-  // ... but hopefully there's very little code following this broken pattern.
+  // Chained Pass is handled correctly.
   A a6;
   A a7 = a6.Pass().Pass();
 }
diff --git a/tools/clang/rewrite_scoped_refptr/RewriteScopedRefptr.cpp b/tools/clang/rewrite_scoped_refptr/RewriteScopedRefptr.cpp
index d6a3d042..f334231 100644
--- a/tools/clang/rewrite_scoped_refptr/RewriteScopedRefptr.cpp
+++ b/tools/clang/rewrite_scoped_refptr/RewriteScopedRefptr.cpp
@@ -167,7 +167,9 @@
 void GetRewriterCallback::run(const MatchFinder::MatchResult& result) {
   const clang::Expr* arg = result.Nodes.getNodeAs<clang::Expr>("arg");
   assert(arg && "Unexpected match! No Expr captured!");
-  replacements_->insert(RewriteImplicitToExplicitConversion(result, arg));
+  auto err =
+      replacements_->add(RewriteImplicitToExplicitConversion(result, arg));
+  assert(!err);
 }
 
 class VarRewriterCallback : public MatchFinder::MatchCallback {
@@ -199,8 +201,9 @@
   // In this case, it will only rewrite the .cc definition. Oh well. This should
   // be rare enough that these cases can be manually handled, since the style
   // guide prohibits globals of non-POD type.
-  replacements_->insert(RewriteRawPtrToScopedRefptr(
+  auto err = replacements_->add(RewriteRawPtrToScopedRefptr(
       result, tsi->getTypeLoc().getBeginLoc(), tsi->getTypeLoc().getEndLoc()));
+  assert(!err);
 }
 
 class FunctionRewriterCallback : public MatchFinder::MatchCallback {
@@ -230,8 +233,9 @@
 
   for (clang::FunctionDecl* f : function_decl->redecls()) {
     clang::SourceRange range = f->getReturnTypeSourceRange();
-    replacements_->insert(
+    auto err = replacements_->add(
         RewriteRawPtrToScopedRefptr(result, range.getBegin(), range.getEnd()));
+    assert(!err);
   }
 }
 
@@ -248,7 +252,9 @@
 void MacroRewriterCallback::run(const MatchFinder::MatchResult& result) {
   const clang::Expr* const expr = result.Nodes.getNodeAs<clang::Expr>("expr");
   assert(expr && "Unexpected match! No Expr captured!");
-  replacements_->insert(RewriteImplicitToExplicitConversion(result, expr));
+  auto err =
+      replacements_->add(RewriteImplicitToExplicitConversion(result, expr));
+  assert(!err);
 }
 
 }  // namespace
@@ -352,12 +358,12 @@
 
   // Find temporary scoped_refptr<T>'s being unsafely assigned to a T*.
   VarRewriterCallback var_callback(&replacements);
-  auto initialized_with_temporary = ignoringImpCasts(exprWithCleanups(
-      has(cxxMemberCallExpr(base_matcher, is_unsafe_temporary_conversion))));
-  match_finder.addMatcher(id("var",
-                             varDecl(hasInitializer(initialized_with_temporary),
-                                     hasType(pointerType()))),
-                          &var_callback);
+  auto initialized_with_temporary = has(ignoringImpCasts(
+      cxxMemberCallExpr(base_matcher, is_unsafe_temporary_conversion)));
+  match_finder.addMatcher(
+      id("var", varDecl(hasInitializer(initialized_with_temporary),
+                        hasType(pointerType()))),
+      &var_callback);
   match_finder.addMatcher(
       cxxConstructorDecl(forEachConstructorInitializer(
           allOf(withInitializer(initialized_with_temporary),
@@ -380,10 +386,10 @@
   MacroRewriterCallback macro_callback(&replacements);
   // CHECK_EQ/CHECK_NE helpers.
   match_finder.addMatcher(
-      callExpr(callee(is_logging_helper),
-               argumentCountIs(3),
-               hasAnyArgument(id("expr", expr(hasType(is_scoped_refptr)))),
-               hasAnyArgument(hasType(pointerType())),
+      callExpr(callee(is_logging_helper), argumentCountIs(3),
+               hasAnyArgument(ignoringParenImpCasts(
+                   id("expr", expr(hasType(is_scoped_refptr))))),
+               hasAnyArgument(ignoringParenImpCasts(hasType(pointerType()))),
                hasArgument(2, stringLiteral())),
       &macro_callback);
   // ASSERT_EQ/ASSERT_NE/EXPECT_EQ/EXPECT_EQ, which use the same underlying
diff --git a/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-expected.cc b/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-expected.cc
index 8608120..2e63f50c 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-expected.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-expected.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/memory/ref_counted.h"
+#include "scoped_refptr.h"
 
-struct Foo : public base::RefCounted<Foo> {
+struct Foo {
   int dummy;
 };
 
diff --git a/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc b/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc
index 8608120..2e63f50c 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/memory/ref_counted.h"
+#include "scoped_refptr.h"
 
-struct Foo : public base::RefCounted<Foo> {
+struct Foo {
   int dummy;
 };
 
diff --git a/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-expected.cc b/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-expected.cc
index 1987bbb3..ee58c085 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-expected.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-expected.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/memory/ref_counted.h"
+#include "scoped_refptr.h"
 
-struct Foo : public base::RefCounted<Foo> {
+struct Foo {
   int dummy;
 };
 
diff --git a/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-original.cc b/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-original.cc
index e0fd791..9acc0de 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-original.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/temp-returned-as-raw-original.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/memory/ref_counted.h"
+#include "scoped_refptr.h"
 
-struct Foo : public base::RefCounted<Foo> {
+struct Foo {
   int dummy;
 };
 
diff --git a/tools/clang/rewrite_scoped_refptr/tests/test11-expected.cc b/tools/clang/rewrite_scoped_refptr/tests/test11-expected.cc
index 4557b52..9e3dec8 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/test11-expected.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/test11-expected.cc
@@ -10,7 +10,7 @@
   int dummy;
 };
 
-typedef std::vector<scoped_refptr<Foo> > FooList;
+typedef std::vector<scoped_refptr<Foo>> FooList;
 
 void TestsAScopedRefptr() {
   FooList list;
diff --git a/tools/clang/rewrite_scoped_refptr/tests/test11-original.cc b/tools/clang/rewrite_scoped_refptr/tests/test11-original.cc
index c79148b..452f3b0 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/test11-original.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/test11-original.cc
@@ -10,7 +10,7 @@
   int dummy;
 };
 
-typedef std::vector<scoped_refptr<Foo> > FooList;
+typedef std::vector<scoped_refptr<Foo>> FooList;
 
 void TestsAScopedRefptr() {
   FooList list;
diff --git a/tools/clang/rewrite_scoped_refptr/tests/test12-expected.cc b/tools/clang/rewrite_scoped_refptr/tests/test12-expected.cc
index fdaa80e..c36582836 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/test12-expected.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/test12-expected.cc
@@ -12,10 +12,10 @@
   int dummy;
 };
 
-typedef std::map<std::string, scoped_refptr<const Foo> > MyMap;
+typedef std::map<std::string, scoped_refptr<const Foo>> MyMap;
 
 class MyIter
-    : public std::iterator<std::input_iterator_tag, scoped_refptr<const Foo> > {
+    : public std::iterator<std::input_iterator_tag, scoped_refptr<const Foo>> {
  public:
   MyIter() {}
   MyIter(const MyIter& other) : it_(other.it_) {}
diff --git a/tools/clang/rewrite_scoped_refptr/tests/test12-original.cc b/tools/clang/rewrite_scoped_refptr/tests/test12-original.cc
index 33f1eb12..8f30ee2 100644
--- a/tools/clang/rewrite_scoped_refptr/tests/test12-original.cc
+++ b/tools/clang/rewrite_scoped_refptr/tests/test12-original.cc
@@ -12,10 +12,10 @@
   int dummy;
 };
 
-typedef std::map<std::string, scoped_refptr<const Foo> > MyMap;
+typedef std::map<std::string, scoped_refptr<const Foo>> MyMap;
 
 class MyIter
-    : public std::iterator<std::input_iterator_tag, scoped_refptr<const Foo> > {
+    : public std::iterator<std::input_iterator_tag, scoped_refptr<const Foo>> {
  public:
   MyIter() {}
   MyIter(const MyIter& other) : it_(other.it_) {}
diff --git a/tools/clang/value_cleanup/tests/list-value-append-expected.cc b/tools/clang/value_cleanup/tests/list-value-append-expected.cc
index 1de3ff6..8d7a57a 100644
--- a/tools/clang/value_cleanup/tests/list-value-append-expected.cc
+++ b/tools/clang/value_cleanup/tests/list-value-append-expected.cc
@@ -4,7 +4,7 @@
 
 #include <memory>
 
-#include "base/values.h"
+#include "values.h"
 
 #define true true
 
diff --git a/tools/clang/value_cleanup/tests/list-value-append-original.cc b/tools/clang/value_cleanup/tests/list-value-append-original.cc
index b28b169..2a1a03b 100644
--- a/tools/clang/value_cleanup/tests/list-value-append-original.cc
+++ b/tools/clang/value_cleanup/tests/list-value-append-original.cc
@@ -4,7 +4,7 @@
 
 #include <memory>
 
-#include "base/values.h"
+#include "values.h"
 
 #define true true
 
diff --git a/tools/clang/value_cleanup/tests/values.h b/tools/clang/value_cleanup/tests/values.h
new file mode 100644
index 0000000..e3c63a0
--- /dev/null
+++ b/tools/clang/value_cleanup/tests/values.h
@@ -0,0 +1,57 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef VALUES_H_
+#define VALUES_H_
+
+#include <vector>
+
+#include "base/strings/string16.h"
+#include "base/strings/string_piece.h"
+
+namespace base {
+
+class Value {};
+
+// FundamentalValue represents the simple fundamental types of values.
+class FundamentalValue : public Value {
+ public:
+  explicit FundamentalValue(bool in_value);
+  explicit FundamentalValue(int in_value);
+  explicit FundamentalValue(double in_value);
+};
+
+class StringValue : public Value {
+ public:
+  // Initializes a StringValue with a UTF-8 narrow character string.
+  explicit StringValue(StringPiece in_value);
+
+  // Initializes a StringValue with a string16.
+  explicit StringValue(const string16& in_value);
+};
+
+// Stub base::ListValue class that supports Append(Value*).
+class ListValue : public Value {
+ public:
+  ListValue();
+
+  // Appends a Value to the end of the list.
+  void Append(std::unique_ptr<Value> in_value);
+
+  // Deprecated version of the above.
+  void Append(Value* in_value);
+
+  // Convenience forms of Append.
+  void AppendBoolean(bool in_value);
+  void AppendInteger(int in_value);
+  void AppendDouble(double in_value);
+  void AppendString(StringPiece in_value);
+  void AppendString(const string16& in_value);
+  void AppendStrings(const std::vector<std::string>& in_values);
+  void AppendStrings(const std::vector<string16>& in_values);
+};
+
+}  // namespace base
+
+#endif  // VALUES_H_
\ No newline at end of file
diff --git a/ui/base/ime/chromeos/mock_ime_engine_handler.cc b/ui/base/ime/chromeos/mock_ime_engine_handler.cc
index e920e37e..10a527f 100644
--- a/ui/base/ime/chromeos/mock_ime_engine_handler.cc
+++ b/ui/base/ime/chromeos/mock_ime_engine_handler.cc
@@ -49,6 +49,9 @@
   ++reset_call_count_;
 }
 
+void MockIMEEngineHandler::MaybeSwitchEngine() {
+}
+
 bool MockIMEEngineHandler::IsInterestedInKeyEvent() const {
   return true;
 }
diff --git a/ui/base/ime/chromeos/mock_ime_engine_handler.h b/ui/base/ime/chromeos/mock_ime_engine_handler.h
index 840b5ec8..795559d 100644
--- a/ui/base/ime/chromeos/mock_ime_engine_handler.h
+++ b/ui/base/ime/chromeos/mock_ime_engine_handler.h
@@ -26,6 +26,7 @@
   void Disable() override;
   void PropertyActivate(const std::string& property_name) override;
   void Reset() override;
+  void MaybeSwitchEngine() override;
   bool IsInterestedInKeyEvent() const override;
   void ProcessKeyEvent(const ui::KeyEvent& key_event,
                        KeyEventDoneCallback& callback) override;
diff --git a/ui/base/ime/ime_engine_handler_interface.h b/ui/base/ime/ime_engine_handler_interface.h
index 3987085..242f1c7 100644
--- a/ui/base/ime/ime_engine_handler_interface.h
+++ b/ui/base/ime/ime_engine_handler_interface.h
@@ -71,6 +71,10 @@
   // Called when the IME is reset.
   virtual void Reset() = 0;
 
+  // Called when the top-level-window is changed, which could switch the engine
+  // handler.
+  virtual void MaybeSwitchEngine() = 0;
+
   // Called when the key event is received.
   // Actual implementation must call |callback| after key event handling.
   virtual void ProcessKeyEvent(const KeyEvent& key_event,
diff --git a/ui/base/ime/input_method_base.cc b/ui/base/ime/input_method_base.cc
index 9d43d852..492d7f9a 100644
--- a/ui/base/ime/input_method_base.cc
+++ b/ui/base/ime/input_method_base.cc
@@ -34,8 +34,13 @@
 }
 
 void InputMethodBase::OnFocus() {
-  if (ui::IMEBridge::Get())
+  if (ui::IMEBridge::Get()) {
     ui::IMEBridge::Get()->SetInputContextHandler(this);
+    ui::IMEEngineHandlerInterface* engine =
+        ui::IMEBridge::Get()->GetCurrentEngineHandler();
+    if (engine)
+      engine->MaybeSwitchEngine();
+  }
 }
 
 void InputMethodBase::OnBlur() {
diff --git a/ui/gfx/blit_unittest.cc b/ui/gfx/blit_unittest.cc
index 50e7952..2bce0dc 100644
--- a/ui/gfx/blit_unittest.cc
+++ b/ui/gfx/blit_unittest.cc
@@ -152,9 +152,10 @@
   base::SharedMemory shared_mem;
   ASSERT_TRUE(shared_mem.CreateAnonymous(kCanvasWidth * kCanvasHeight));
   base::SharedMemoryHandle section = shared_mem.handle();
-  std::unique_ptr<SkCanvas> canvas = skia::CreatePlatformCanvas(
-      kCanvasWidth, kCanvasHeight, true, section.GetHandle(),
-      skia::RETURN_NULL_ON_FAILURE);
+  std::unique_ptr<SkCanvas> canvas =
+      skia::CreatePlatformCanvasWithSharedSection(kCanvasWidth, kCanvasHeight,
+                                                  true, section.GetHandle(),
+                                                  skia::RETURN_NULL_ON_FAILURE);
   ASSERT_TRUE(canvas);
   shared_mem.Close();
 
diff --git a/ui/surface/transport_dib_posix.cc b/ui/surface/transport_dib_posix.cc
index 8beba1f..5f68581 100644
--- a/ui/surface/transport_dib_posix.cc
+++ b/ui/surface/transport_dib_posix.cc
@@ -63,9 +63,9 @@
                                                           bool opaque) {
   if ((!memory() && !Map()) || !VerifyCanvasSize(w, h))
     return NULL;
-  return skia::CreatePlatformCanvas(w, h, opaque,
-                                    reinterpret_cast<uint8_t*>(memory()),
-                                    skia::RETURN_NULL_ON_FAILURE);
+  return skia::CreatePlatformCanvasWithPixels(
+      w, h, opaque, reinterpret_cast<uint8_t*>(memory()),
+      skia::RETURN_NULL_ON_FAILURE);
 }
 
 bool TransportDIB::Map() {
diff --git a/ui/surface/transport_dib_win.cc b/ui/surface/transport_dib_win.cc
index 61f5a1b..f845480 100644
--- a/ui/surface/transport_dib_win.cc
+++ b/ui/surface/transport_dib_win.cc
@@ -68,9 +68,10 @@
   // We can't check the canvas size before mapping, but it's safe because
   // Windows will fail to map the section if the dimensions of the canvas
   // are too large.
-  std::unique_ptr<SkCanvas> canvas = skia::CreatePlatformCanvas(
-      w, h, opaque, shared_memory_.handle().GetHandle(),
-      skia::RETURN_NULL_ON_FAILURE);
+  std::unique_ptr<SkCanvas> canvas =
+      skia::CreatePlatformCanvasWithSharedSection(
+          w, h, opaque, shared_memory_.handle().GetHandle(),
+          skia::RETURN_NULL_ON_FAILURE);
 
   // Calculate the size for the memory region backing the canvas.
   if (canvas)