diff --git a/DEPS b/DEPS
index 0bf7eb4..15ea04a 100644
--- a/DEPS
+++ b/DEPS
@@ -43,7 +43,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '5a20badccc9161e2146695d37270536e51957a3d',
+  'v8_revision': '09c6e1a2fe05b24e34ba8829a760a90c085fe59e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/ash/accelerators/accelerator_controller.cc b/ash/accelerators/accelerator_controller.cc
index d409feec..23fa5d27 100644
--- a/ash/accelerators/accelerator_controller.cc
+++ b/ash/accelerators/accelerator_controller.cc
@@ -1415,7 +1415,7 @@
           actions_allowed_in_app_mode_.end()) {
     return RESTRICTION_PREVENT_PROCESSING;
   }
-  if (shell->IsSystemModalWindowOpen() &&
+  if (WmShell::Get()->IsSystemModalWindowOpen() &&
       actions_allowed_at_modal_window_.find(action) ==
           actions_allowed_at_modal_window_.end()) {
     // Note we prevent the shortcut from propagating so it will not
diff --git a/ash/accelerators/accelerator_controller_unittest.cc b/ash/accelerators/accelerator_controller_unittest.cc
index 1497e86..df6ec6b 100644
--- a/ash/accelerators/accelerator_controller_unittest.cc
+++ b/ash/accelerators/accelerator_controller_unittest.cc
@@ -1205,7 +1205,7 @@
   std::unique_ptr<aura::Window> window(
       CreateTestWindowInShellWithBounds(gfx::Rect(5, 5, 20, 20)));
   wm::ActivateWindow(window.get());
-  Shell::GetInstance()->SimulateModalWindowOpenForTesting(true);
+  WmShell::Get()->SimulateModalWindowOpenForTesting(true);
   for (std::set<AcceleratorAction>::const_iterator it = all_actions.begin();
        it != all_actions.end(); ++it) {
     if (actionsAllowedAtModalWindow.find(*it) ==
diff --git a/ash/common/wm_shell.cc b/ash/common/wm_shell.cc
index 626eabe0..f0d1b68 100644
--- a/ash/common/wm_shell.cc
+++ b/ash/common/wm_shell.cc
@@ -5,8 +5,10 @@
 #include "ash/common/wm_shell.h"
 
 #include "ash/common/focus_cycler.h"
+#include "ash/common/shell_window_ids.h"
 #include "ash/common/system/tray/system_tray_delegate.h"
 #include "ash/common/system/tray/wm_system_tray_notifier.h"
+#include "ash/common/wm_window.h"
 #include "base/logging.h"
 
 namespace ash {
@@ -30,6 +32,26 @@
 
 WmShell::~WmShell() {}
 
+bool WmShell::IsSystemModalWindowOpen() {
+  if (simulate_modal_window_open_for_testing_)
+    return true;
+
+  // Traverse all system modal containers, and find its direct child window
+  // with "SystemModal" setting, and visible.
+  for (WmWindow* root : GetAllRootWindows()) {
+    WmWindow* system_modal =
+        root->GetChildByShellWindowId(kShellWindowId_SystemModalContainer);
+    if (!system_modal)
+      continue;
+    for (const WmWindow* child : system_modal->GetChildren()) {
+      if (child->IsSystemModal() && child->GetTargetVisibility()) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
 void WmShell::SetSystemTrayDelegate(
     std::unique_ptr<SystemTrayDelegate> delegate) {
   if (delegate) {
diff --git a/ash/common/wm_shell.h b/ash/common/wm_shell.h
index fbc418a..704a075b 100644
--- a/ash/common/wm_shell.h
+++ b/ash/common/wm_shell.h
@@ -78,6 +78,14 @@
   // the window size.
   virtual bool IsForceMaximizeOnFirstRun() = 0;
 
+  // Returns true if a system-modal dialog window is currently open.
+  bool IsSystemModalWindowOpen();
+
+  // For testing only: set simulation that a modal window is open
+  void SimulateModalWindowOpenForTesting(bool modal_window_open) {
+    simulate_modal_window_open_for_testing_ = modal_window_open;
+  }
+
   // Returns true if |window| can be shown for the current user. This is
   // intended to check if the current user matches the user associated with
   // |window|.
@@ -146,6 +154,8 @@
   std::unique_ptr<FocusCycler> focus_cycler_;
   std::unique_ptr<WmSystemTrayNotifier> system_tray_notifier_;
   std::unique_ptr<SystemTrayDelegate> system_tray_delegate_;
+
+  bool simulate_modal_window_open_for_testing_ = false;
 };
 
 }  // namespace ash
diff --git a/ash/shelf/shelf_layout_manager_unittest.cc b/ash/shelf/shelf_layout_manager_unittest.cc
index bac8917..4bfafa3 100644
--- a/ash/shelf/shelf_layout_manager_unittest.cc
+++ b/ash/shelf/shelf_layout_manager_unittest.cc
@@ -13,6 +13,7 @@
 #include "ash/common/shell_window_ids.h"
 #include "ash/common/system/tray/system_tray_item.h"
 #include "ash/common/wm/window_state.h"
+#include "ash/common/wm_shell.h"
 #include "ash/display/display_manager.h"
 #include "ash/display/window_tree_host_manager.h"
 #include "ash/root_window_controller.h"
@@ -1532,8 +1533,9 @@
   wm::ActivateWindow(window);
 
   // Enable system modal dialog, and make sure shelf is still hidden.
-  shell->SimulateModalWindowOpenForTesting(true);
-  EXPECT_TRUE(shell->IsSystemModalWindowOpen());
+  WmShell* wm_shell = WmShell::Get();
+  wm_shell->SimulateModalWindowOpenForTesting(true);
+  EXPECT_TRUE(wm_shell->IsSystemModalWindowOpen());
   EXPECT_FALSE(wm::CanActivateWindow(window));
   shell->UpdateShelfVisibility();
   EXPECT_EQ(SHELF_AUTO_HIDE, shelf->GetVisibilityState());
@@ -1587,8 +1589,9 @@
   EXPECT_TRUE(window_2->IsVisible());
 
   // Enable system modal dialog, and make sure both shelves are still hidden.
-  shell->SimulateModalWindowOpenForTesting(true);
-  EXPECT_TRUE(shell->IsSystemModalWindowOpen());
+  WmShell* wm_shell = WmShell::Get();
+  wm_shell->SimulateModalWindowOpenForTesting(true);
+  EXPECT_TRUE(wm_shell->IsSystemModalWindowOpen());
   EXPECT_FALSE(wm::CanActivateWindow(window_1));
   EXPECT_FALSE(wm::CanActivateWindow(window_2));
   shell->UpdateShelfVisibility();
diff --git a/ash/shell.cc b/ash/shell.cc
index f01d2298..e17a8da 100644
--- a/ash/shell.cc
+++ b/ash/shell.cc
@@ -342,24 +342,6 @@
   return delegate_->GetAppListPresenter()->GetTargetVisibility();
 }
 
-bool Shell::IsSystemModalWindowOpen() const {
-  if (simulate_modal_window_open_for_testing_)
-    return true;
-  const std::vector<aura::Window*> containers = GetContainersFromAllRootWindows(
-      kShellWindowId_SystemModalContainer, nullptr);
-  for (std::vector<aura::Window*>::const_iterator cit = containers.begin();
-       cit != containers.end(); ++cit) {
-    for (aura::Window::Windows::const_iterator wit = (*cit)->children().begin();
-         wit != (*cit)->children().end(); ++wit) {
-      if ((*wit)->GetProperty(aura::client::kModalKey) ==
-          ui::MODAL_TYPE_SYSTEM && (*wit)->TargetVisibility()) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-
 views::NonClientFrameView* Shell::CreateDefaultNonClientFrameView(
     views::Widget* widget) {
   // Use translucent-style window frames for dialogs.
diff --git a/ash/shell.h b/ash/shell.h
index cf49731..159838aa 100644
--- a/ash/shell.h
+++ b/ash/shell.h
@@ -256,14 +256,6 @@
   // Returns app list target visibility.
   bool GetAppListTargetVisibility() const;
 
-  // Returns true if a system-modal dialog window is currently open.
-  bool IsSystemModalWindowOpen() const;
-
-  // For testing only: set simulation that a modal window is open
-  void SimulateModalWindowOpenForTesting(bool modal_window_open) {
-    simulate_modal_window_open_for_testing_ = modal_window_open;
-  }
-
   // Creates a default views::NonClientFrameView for use by windows in the
   // Ash environment.
   views::NonClientFrameView* CreateDefaultNonClientFrameView(
diff --git a/ash/system/overview/overview_button_tray_unittest.cc b/ash/system/overview/overview_button_tray_unittest.cc
index d9db8a7b..c398123 100644
--- a/ash/system/overview/overview_button_tray_unittest.cc
+++ b/ash/system/overview/overview_button_tray_unittest.cc
@@ -6,6 +6,7 @@
 
 #include "ash/ash_switches.h"
 #include "ash/common/shelf/shelf_types.h"
+#include "ash/common/wm_shell.h"
 #include "ash/display/display_manager.h"
 #include "ash/root_window_controller.h"
 #include "ash/rotator/screen_rotation_animator.h"
@@ -266,7 +267,7 @@
   window->Show();
   ParentWindowInPrimaryRootWindow(window.get());
 
-  ASSERT_TRUE(Shell::GetInstance()->IsSystemModalWindowOpen());
+  ASSERT_TRUE(WmShell::Get()->IsSystemModalWindowOpen());
   Shell::GetInstance()
       ->maximize_mode_controller()
       ->EnableMaximizeModeWindowManager(true);
diff --git a/ash/system/tray/system_tray_bubble.cc b/ash/system/tray/system_tray_bubble.cc
index e523b52..b66e601 100644
--- a/ash/system/tray/system_tray_bubble.cc
+++ b/ash/system/tray/system_tray_bubble.cc
@@ -285,7 +285,7 @@
   std::vector<views::View*> item_views;
   // If a system modal dialog is present, create the same tray as
   // in locked state.
-  if (Shell::GetInstance()->IsSystemModalWindowOpen() &&
+  if (WmShell::Get()->IsSystemModalWindowOpen() &&
       login_status != LoginStatus::NOT_LOGGED_IN) {
     login_status = LoginStatus::LOCKED;
   }
diff --git a/ash/system/user/tray_user.cc b/ash/system/user/tray_user.cc
index d180427..9f5a619 100644
--- a/ash/system/user/tray_user.cc
+++ b/ash/system/user/tray_user.cc
@@ -97,7 +97,7 @@
   // If the screen is locked or a system modal dialog box is shown, show only
   // the currently active user.
   if (user_index_ && (session_state_delegate->IsUserSessionBlocked() ||
-                      Shell::GetInstance()->IsSystemModalWindowOpen()))
+                      WmShell::Get()->IsSystemModalWindowOpen()))
     return nullptr;
 
   CHECK(user_ == nullptr);
diff --git a/ash/system/user/tray_user_separator.cc b/ash/system/user/tray_user_separator.cc
index 6473f03..1a2d71e9 100644
--- a/ash/system/user/tray_user_separator.cc
+++ b/ash/system/user/tray_user_separator.cc
@@ -5,6 +5,7 @@
 #include "ash/system/user/tray_user_separator.h"
 
 #include "ash/common/session/session_state_delegate.h"
+#include "ash/common/wm_shell.h"
 #include "ash/shell.h"
 #include "ui/views/view.h"
 
@@ -29,7 +30,7 @@
   // If the screen is locked, a system modal dialog or a single user is shown,
   // show nothing.
   if (session_state_delegate->IsUserSessionBlocked() ||
-      Shell::GetInstance()->IsSystemModalWindowOpen() ||
+      WmShell::Get()->IsSystemModalWindowOpen() ||
       session_state_delegate->NumberOfLoggedInUsers() < 2)
     return NULL;
 
diff --git a/ash/system/user/user_view.cc b/ash/system/user/user_view.cc
index 8ea6d45..b2ffd0c9 100644
--- a/ash/system/user/user_view.cc
+++ b/ash/system/user/user_view.cc
@@ -376,7 +376,7 @@
   user_card_view_ = new UserCardView(login, max_card_width, user_index_);
   // The entry is clickable when no system modal dialog is open and the multi
   // profile option is active.
-  bool clickable = !Shell::GetInstance()->IsSystemModalWindowOpen() &&
+  bool clickable = !WmShell::Get()->IsSystemModalWindowOpen() &&
                    IsMultiProfileSupportedAndUserActive();
   if (clickable) {
     // To allow the border to start before the icon, reduce the size before and
diff --git a/ash/wm/ash_focus_rules.cc b/ash/wm/ash_focus_rules.cc
index 103c39a..010365a7 100644
--- a/ash/wm/ash_focus_rules.cc
+++ b/ash/wm/ash_focus_rules.cc
@@ -9,6 +9,7 @@
 #include "ash/common/wm/focus_rules.h"
 #include "ash/common/wm/mru_window_tracker.h"
 #include "ash/common/wm/window_state.h"
+#include "ash/common/wm_shell.h"
 #include "ash/shell.h"
 #include "ash/shell_delegate.h"
 #include "ash/wm/window_state_aura.h"
@@ -66,7 +67,7 @@
   if (!BaseFocusRules::CanActivateWindow(window))
     return false;
 
-  if (Shell::GetInstance()->IsSystemModalWindowOpen()) {
+  if (WmShell::Get()->IsSystemModalWindowOpen()) {
     return BelongsToContainerWithEqualOrGreaterId(
         window, kShellWindowId_SystemModalContainer);
   }
diff --git a/ash/wm/maximize_mode/maximize_mode_window_manager_unittest.cc b/ash/wm/maximize_mode/maximize_mode_window_manager_unittest.cc
index c753d7bf09..994788f1 100644
--- a/ash/wm/maximize_mode/maximize_mode_window_manager_unittest.cc
+++ b/ash/wm/maximize_mode/maximize_mode_window_manager_unittest.cc
@@ -11,6 +11,7 @@
 #include "ash/common/wm/switchable_windows.h"
 #include "ash/common/wm/window_state.h"
 #include "ash/common/wm/wm_event.h"
+#include "ash/common/wm_shell.h"
 #include "ash/root_window_controller.h"
 #include "ash/screen_util.h"
 #include "ash/shelf/shelf.h"
@@ -255,8 +256,8 @@
   EXPECT_EQ(rect3.ToString(), w3->bounds().ToString());
 
   // Enable system modal dialog, and make sure both shelves are still hidden.
-  ash::Shell::GetInstance()->SimulateModalWindowOpenForTesting(true);
-  EXPECT_TRUE(ash::Shell::GetInstance()->IsSystemModalWindowOpen());
+  WmShell::Get()->SimulateModalWindowOpenForTesting(true);
+  EXPECT_TRUE(WmShell::Get()->IsSystemModalWindowOpen());
 
   // Create the manager and make sure that all qualifying windows were detected
   // and changed.
diff --git a/ash/wm/overview/window_selector_controller.cc b/ash/wm/overview/window_selector_controller.cc
index 8999d940..a446b887 100644
--- a/ash/wm/overview/window_selector_controller.cc
+++ b/ash/wm/overview/window_selector_controller.cc
@@ -12,7 +12,6 @@
 #include "ash/common/wm/window_state.h"
 #include "ash/common/wm_shell.h"
 #include "ash/common/wm_window.h"
-#include "ash/shell.h"
 #include "ash/wm/overview/window_selector.h"
 #include "base/metrics/histogram.h"
 
@@ -32,7 +31,7 @@
       WmShell::Get()->GetSessionStateDelegate();
   return session_state_delegate->IsActiveUserSessionStarted() &&
          !session_state_delegate->IsScreenLocked() &&
-         !Shell::GetInstance()->IsSystemModalWindowOpen() &&
+         !WmShell::Get()->IsSystemModalWindowOpen() &&
          WmShell::Get()->system_tray_delegate()->GetUserLoginStatus() !=
              LoginStatus::KIOSK_APP;
 }
diff --git a/ash/wm/window_cycle_controller.cc b/ash/wm/window_cycle_controller.cc
index c24b9e9..03acc9f9 100644
--- a/ash/wm/window_cycle_controller.cc
+++ b/ash/wm/window_cycle_controller.cc
@@ -6,6 +6,7 @@
 
 #include "ash/common/session/session_state_delegate.h"
 #include "ash/common/wm/mru_window_tracker.h"
+#include "ash/common/wm_shell.h"
 #include "ash/metrics/user_metrics_recorder.h"
 #include "ash/shell.h"
 #include "ash/wm/window_cycle_list.h"
@@ -73,7 +74,7 @@
   // Don't allow window cycling if the screen is locked or a modal dialog is
   // open.
   return !Shell::GetInstance()->session_state_delegate()->IsScreenLocked() &&
-         !Shell::GetInstance()->IsSystemModalWindowOpen();
+         !WmShell::Get()->IsSystemModalWindowOpen();
 }
 
 void WindowCycleController::HandleCycleWindow(Direction direction) {
diff --git a/build/config/ios/codesign.py b/build/config/ios/codesign.py
index 1dd2db5..dee1cc2 100644
--- a/build/config/ios/codesign.py
+++ b/build/config/ios/codesign.py
@@ -201,9 +201,9 @@
 
   # Select the most specific mobile provisioning profile, i.e. the one with
   # the longest application identifier pattern.
-  valid_provisioning_profiles.sort(
+  return max(
+      valid_provisioning_profiles,
       key=lambda p: len(p.application_identifier_pattern))
-  return valid_provisioning_profiles[0]
 
 
 def CodeSignBundle(binary, bundle, args):
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java
index 860aacf..c105529 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java
@@ -117,14 +117,17 @@
         // Track how the (approx.) position relates to age / score of the snippet that is clicked.
         int ageInMinutes =
                 (int) ((System.currentTimeMillis() - mPublishTimestampMilliseconds) / 60000L);
-        recordAge(histogramPrefix + "Age", ageInMinutes);
-        recordScore(histogramPrefix + "Score", mScore);
+        String histogramAge = histogramPrefix + "Age";
+        String histogramScore = histogramPrefix + "ScoreNew";
+
+        recordAge(histogramAge, ageInMinutes);
+        recordScore(histogramScore, mScore);
         int startPosition = 0;
         for (int endPosition : HISTOGRAM_FOR_POSITIONS) {
             if (mPosition >= startPosition && mPosition <= endPosition) {
                 String suffix = "_" + startPosition + "_" + endPosition;
-                recordAge(histogramPrefix + "Age" + suffix, ageInMinutes);
-                recordScore(histogramPrefix + "Score" + suffix, mScore);
+                recordAge(histogramAge + suffix, ageInMinutes);
+                recordScore(histogramScore + suffix, mScore);
                 break;
             }
             startPosition = endPosition + 1;
@@ -141,7 +144,7 @@
     }
 
     private static void recordScore(String histogramName, float score) {
-        int recordedScore = Math.min((int) Math.ceil(score), 1000);
-        RecordHistogram.recordCount1000Histogram(histogramName, recordedScore);
+        int recordedScore = Math.min((int) Math.ceil(score), 100000);
+        RecordHistogram.recordCustomCountHistogram(histogramName, recordedScore, 1, 100000, 50);
     }
 }
diff --git a/chrome/browser/chromeos/arc/arc_service_launcher.cc b/chrome/browser/chromeos/arc/arc_service_launcher.cc
index 4499c8a..b2cee59 100644
--- a/chrome/browser/chromeos/arc/arc_service_launcher.cc
+++ b/chrome/browser/chromeos/arc/arc_service_launcher.cc
@@ -11,10 +11,12 @@
 #include "chrome/browser/chromeos/arc/arc_policy_bridge.h"
 #include "chrome/browser/chromeos/arc/arc_process_service.h"
 #include "chrome/browser/chromeos/arc/arc_settings_service.h"
+#include "chrome/browser/chromeos/arc/arc_wallpaper_handler.h"
 #include "chrome/browser/chromeos/arc/gpu_arc_video_service_host.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/session_manager_client.h"
 #include "components/arc/arc_bridge_service.h"
+#include "components/arc/intent_helper/arc_intent_helper_bridge.h"
 #include "content/public/browser/browser_thread.h"
 
 namespace arc {
@@ -25,21 +27,24 @@
 
 void ArcServiceLauncher::Initialize() {
   // Create ARC service manager.
-  arc_service_manager_.reset(
-      new ArcServiceManager(content::BrowserThread::GetBlockingPool()));
-  arc_service_manager_->AddService(base::WrapUnique(
-      new ArcAuthService(arc_service_manager_->arc_bridge_service())));
-  arc_service_manager_->AddService(
-      base::WrapUnique(new ArcDownloadsWatcherService(
-          arc_service_manager_->arc_bridge_service())));
-  arc_service_manager_->AddService(base::WrapUnique(
-      new ArcPolicyBridge(arc_service_manager_->arc_bridge_service())));
-  arc_service_manager_->AddService(base::WrapUnique(
-      new ArcProcessService(arc_service_manager_->arc_bridge_service())));
-  arc_service_manager_->AddService(base::WrapUnique(
-      new ArcSettingsService(arc_service_manager_->arc_bridge_service())));
-  arc_service_manager_->AddService(base::WrapUnique(
-      new GpuArcVideoServiceHost(arc_service_manager_->arc_bridge_service())));
+  arc_service_manager_ = base::MakeUnique<ArcServiceManager>(
+      content::BrowserThread::GetBlockingPool());
+  arc_service_manager_->AddService(base::MakeUnique<ArcIntentHelperBridge>(
+      arc_service_manager_->arc_bridge_service(),
+      arc_service_manager_->icon_loader(),
+      base::MakeUnique<ArcWallpaperHandler>()));
+  arc_service_manager_->AddService(base::MakeUnique<ArcAuthService>(
+      arc_service_manager_->arc_bridge_service()));
+  arc_service_manager_->AddService(base::MakeUnique<ArcDownloadsWatcherService>(
+      arc_service_manager_->arc_bridge_service()));
+  arc_service_manager_->AddService(base::MakeUnique<ArcPolicyBridge>(
+      arc_service_manager_->arc_bridge_service()));
+  arc_service_manager_->AddService(base::MakeUnique<ArcProcessService>(
+      arc_service_manager_->arc_bridge_service()));
+  arc_service_manager_->AddService(base::MakeUnique<ArcSettingsService>(
+      arc_service_manager_->arc_bridge_service()));
+  arc_service_manager_->AddService(base::MakeUnique<GpuArcVideoServiceHost>(
+      arc_service_manager_->arc_bridge_service()));
 
   // Detect availability.
   chromeos::SessionManagerClient* session_manager_client =
diff --git a/chrome/browser/chromeos/arc/arc_wallpaper_handler.cc b/chrome/browser/chromeos/arc/arc_wallpaper_handler.cc
new file mode 100644
index 0000000..b7f9390
--- /dev/null
+++ b/chrome/browser/chromeos/arc/arc_wallpaper_handler.cc
@@ -0,0 +1,117 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/arc/arc_wallpaper_handler.h"
+
+#include <string>
+#include <vector>
+
+#include "base/logging.h"
+#include "base/memory/ptr_util.h"
+#include "chrome/browser/chromeos/login/users/wallpaper/wallpaper_manager.h"
+#include "components/signin/core/account_id/account_id.h"
+#include "components/user_manager/user_manager.h"
+#include "components/wallpaper/wallpaper_files_id.h"
+#include "components/wallpaper/wallpaper_layout.h"
+#include "ui/gfx/image/image_skia.h"
+
+namespace arc {
+
+namespace {
+
+constexpr char kAndroidWallpaperFilename[] = "android.jpg";
+
+// Sets a decoded bitmap as the wallpaper.
+void SetBitmapAsWallpaper(const SkBitmap& bitmap) {
+  // Make the SkBitmap immutable as we won't modify it. This is important
+  // because otherwise it gets duplicated during painting, wasting memory.
+  SkBitmap immutable_bitmap(bitmap);
+  immutable_bitmap.setImmutable();
+  gfx::ImageSkia image = gfx::ImageSkia::CreateFrom1xBitmap(immutable_bitmap);
+  image.MakeThreadSafe();
+
+  chromeos::WallpaperManager* wallpaper_manager =
+      chromeos::WallpaperManager::Get();
+
+  const AccountId& account_id =
+      user_manager::UserManager::Get()->GetPrimaryUser()->GetAccountId();
+  wallpaper::WallpaperFilesId wallpaper_files_id =
+      wallpaper_manager->GetFilesId(account_id);
+  bool update_wallpaper =
+      account_id ==
+      user_manager::UserManager::Get()->GetActiveUser()->GetAccountId();
+  // TODO(crbug.com/618922): Allow specifying layout.
+  wallpaper_manager->SetCustomWallpaper(
+      account_id, wallpaper_files_id, kAndroidWallpaperFilename,
+      wallpaper::WALLPAPER_LAYOUT_STRETCH, user_manager::User::CUSTOMIZED,
+      image, update_wallpaper);
+
+  // TODO(crbug.com/618922): Register the wallpaper to Chrome OS wallpaper
+  // picker. Currently the new wallpaper does not appear there. The best way to
+  // make this happen seems to do the same things as wallpaper_api.cc and
+  // wallpaper_private_api.cc.
+}
+
+}  // namespace
+
+// An implementation of ImageDecoder::ImageRequest that just calls back
+// ArcWallpaperHandler.
+class ArcWallpaperHandler::ImageRequestImpl
+    : public ImageDecoder::ImageRequest {
+ public:
+  // |handler| outlives this instance.
+  explicit ImageRequestImpl(ArcWallpaperHandler* handler) : handler_(handler) {}
+
+  // ImageDecoder::ImageRequest implementation.
+  void OnImageDecoded(const SkBitmap& bitmap) override {
+    handler_->OnImageDecoded(this, bitmap);
+  }
+  void OnDecodeImageFailed() override { handler_->OnDecodeImageFailed(this); }
+
+ private:
+  ArcWallpaperHandler* handler_;
+
+  DISALLOW_COPY_AND_ASSIGN(ImageRequestImpl);
+};
+
+ArcWallpaperHandler::ArcWallpaperHandler() = default;
+
+ArcWallpaperHandler::~ArcWallpaperHandler() {
+  DCHECK(thread_checker_.CalledOnValidThread());
+  // Cancel in-flight requests.
+  for (ImageRequestImpl* request : inflight_requests_) {
+    ImageDecoder::Cancel(request);
+    delete request;
+  }
+  inflight_requests_.clear();
+}
+
+void ArcWallpaperHandler::SetWallpaper(const std::vector<uint8_t>& jpeg_data) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+  std::unique_ptr<ImageRequestImpl> request =
+      base::MakeUnique<ImageRequestImpl>(this);
+  // TODO(nya): Improve ImageDecoder to minimize copy.
+  std::string jpeg_data_as_string(reinterpret_cast<const char*>(jpeg_data[0]),
+                                  jpeg_data.size());
+  ImageDecoder::StartWithOptions(request.get(), jpeg_data_as_string,
+                                 ImageDecoder::ROBUST_JPEG_CODEC, true);
+  inflight_requests_.insert(request.release());
+}
+
+void ArcWallpaperHandler::OnImageDecoded(ImageRequestImpl* request,
+                                         const SkBitmap& bitmap) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+  inflight_requests_.erase(request);
+  delete request;
+  SetBitmapAsWallpaper(bitmap);
+}
+
+void ArcWallpaperHandler::OnDecodeImageFailed(ImageRequestImpl* request) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+  inflight_requests_.erase(request);
+  delete request;
+  LOG(ERROR) << "Failed to decode wallpaper image.";
+}
+
+}  // namespace arc
diff --git a/chrome/browser/chromeos/arc/arc_wallpaper_handler.h b/chrome/browser/chromeos/arc/arc_wallpaper_handler.h
new file mode 100644
index 0000000..ace2c47be
--- /dev/null
+++ b/chrome/browser/chromeos/arc/arc_wallpaper_handler.h
@@ -0,0 +1,47 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ARC_ARC_WALLPAPER_HANDLER_H_
+#define CHROME_BROWSER_CHROMEOS_ARC_ARC_WALLPAPER_HANDLER_H_
+
+#include <stdint.h>
+
+#include <set>
+#include <vector>
+
+#include "base/macros.h"
+#include "base/threading/thread_checker.h"
+#include "chrome/browser/image_decoder.h"
+#include "components/arc/set_wallpaper_delegate.h"
+
+class SkBitmap;
+
+namespace arc {
+
+class ArcWallpaperHandler : public SetWallpaperDelegate {
+ public:
+  ArcWallpaperHandler();
+  ~ArcWallpaperHandler() override;
+
+  // SetWallpaperDelegate implementation.
+  void SetWallpaper(const std::vector<uint8_t>& jpeg_data) override;
+
+ private:
+  class ImageRequestImpl;
+
+  // Called from ImageRequestImpl on decode completion.
+  void OnImageDecoded(ImageRequestImpl* request, const SkBitmap& bitmap);
+  void OnDecodeImageFailed(ImageRequestImpl* request);
+
+  base::ThreadChecker thread_checker_;
+
+  // The set of in-flight decode requests. Pointers are owned.
+  std::set<ImageRequestImpl*> inflight_requests_;
+
+  DISALLOW_COPY_AND_ASSIGN(ArcWallpaperHandler);
+};
+
+}  // namespace arc
+
+#endif  // CHROME_BROWSER_CHROMEOS_ARC_ARC_WALLPAPER_HANDLER_H_
diff --git a/chrome/browser/media/encrypted_media_supported_types_browsertest.cc b/chrome/browser/media/encrypted_media_supported_types_browsertest.cc
index 2e96008..91f10c5 100644
--- a/chrome/browser/media/encrypted_media_supported_types_browsertest.cc
+++ b/chrome/browser/media/encrypted_media_supported_types_browsertest.cc
@@ -24,6 +24,7 @@
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
+#include "media/base/media_switches.h"
 #include "media/base/test_data_util.h"
 #include "media/media_features.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
@@ -117,9 +118,7 @@
     video_mp4_codecs_.push_back("avc1.4D000C");  // Main profile.
     video_mp4_codecs_.push_back("avc3.64001F");  // High profile.
 
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
-    video_mp4_codecs_.push_back("vp09.01.01.08.02.01.01.00");
-#endif
+    video_mp4_codecs_.push_back("vp09.00.01.08.02.01.01.00");
 
     video_mp4_hi10p_codecs_.push_back("avc1.6E001E");  // Hi10P profile
 
@@ -151,6 +150,11 @@
     invalid_codecs_.push_back("hvc1.");
   }
 
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    InProcessBrowserTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitch(switches::kEnableVp9InMp4);
+  }
+
   typedef std::vector<std::string> CodecVector;
 
   const CodecVector& no_codecs() const { return no_codecs_; }
diff --git a/chrome/chrome_browser_chromeos.gypi b/chrome/chrome_browser_chromeos.gypi
index b3af55c..0c4590ef 100644
--- a/chrome/chrome_browser_chromeos.gypi
+++ b/chrome/chrome_browser_chromeos.gypi
@@ -78,6 +78,8 @@
         'browser/chromeos/arc/gpu_arc_video_service_host.h',
         'browser/chromeos/arc/arc_optin_uma.cc',
         'browser/chromeos/arc/arc_optin_uma.h',
+        'browser/chromeos/arc/arc_wallpaper_handler.cc',
+        'browser/chromeos/arc/arc_wallpaper_handler.h',
         'browser/chromeos/attestation/attestation_ca_client.cc',
         'browser/chromeos/attestation/attestation_ca_client.h',
         'browser/chromeos/attestation/attestation_policy_observer.cc',
diff --git a/chrome/renderer/media/DEPS b/chrome/renderer/media/DEPS
index 2483926..5475cf4 100644
--- a/chrome/renderer/media/DEPS
+++ b/chrome/renderer/media/DEPS
@@ -3,5 +3,4 @@
   "+media/video",  # For basic video functions.
   "+media/base",  # For basic media functions.
   "+media/cast",  # For cast streaming library.
-  "+media/media_features.h",  # For flag definitions.
 ]
diff --git a/chrome/renderer/media/chrome_key_systems.cc b/chrome/renderer/media/chrome_key_systems.cc
index 8772ff6c..ba65f65 100644
--- a/chrome/renderer/media/chrome_key_systems.cc
+++ b/chrome/renderer/media/chrome_key_systems.cc
@@ -20,8 +20,6 @@
 #include "media/base/eme_constants.h"
 #include "media/base/key_system_properties.h"
 
-#include "media/media_features.h"
-
 #if defined(OS_ANDROID)
 #include "components/cdm/renderer/android_key_systems.h"
 #endif
@@ -242,10 +240,8 @@
 #if defined(USE_PROPRIETARY_CODECS)
     if (codecs[i] == kCdmSupportedCodecAvc1)
       supported_codecs |= media::EME_CODEC_MP4_AVC1;
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
     if (codecs[i] == kCdmSupportedCodecVp9)
       supported_codecs |= media::EME_CODEC_MP4_VP9;
-#endif
 #endif  // defined(USE_PROPRIETARY_CODECS)
   }
 
diff --git a/components/arc.gypi b/components/arc.gypi
index e9db9129..bd274364 100644
--- a/components/arc.gypi
+++ b/components/arc.gypi
@@ -79,6 +79,7 @@
         'arc/obb_mounter/arc_obb_mounter_bridge.h',
         'arc/power/arc_power_bridge.cc',
         'arc/power/arc_power_bridge.h',
+        'arc/set_wallpaper_delegate.h',
         'arc/storage_manager/arc_storage_manager.cc',
         'arc/storage_manager/arc_storage_manager.h',
         'arc/user_data/arc_user_data_service.cc',
diff --git a/components/arc/BUILD.gn b/components/arc/BUILD.gn
index fb277622..836576b 100644
--- a/components/arc/BUILD.gn
+++ b/components/arc/BUILD.gn
@@ -55,6 +55,7 @@
     "obb_mounter/arc_obb_mounter_bridge.h",
     "power/arc_power_bridge.cc",
     "power/arc_power_bridge.h",
+    "set_wallpaper_delegate.h",
     "storage_manager/arc_storage_manager.cc",
     "storage_manager/arc_storage_manager.h",
     "user_data/arc_user_data_service.cc",
diff --git a/components/arc/arc_service_manager.cc b/components/arc/arc_service_manager.cc
index be6d1ee..28669e5 100644
--- a/components/arc/arc_service_manager.cc
+++ b/components/arc/arc_service_manager.cc
@@ -16,7 +16,6 @@
 #include "components/arc/crash_collector/arc_crash_collector_bridge.h"
 #include "components/arc/ime/arc_ime_service.h"
 #include "components/arc/intent_helper/activity_icon_loader.h"
-#include "components/arc/intent_helper/arc_intent_helper_bridge.h"
 #include "components/arc/metrics/arc_metrics_service.h"
 #include "components/arc/net/arc_net_host_impl.h"
 #include "components/arc/obb_mounter/arc_obb_mounter_bridge.h"
@@ -41,7 +40,8 @@
 
 ArcServiceManager::ArcServiceManager(
     scoped_refptr<base::TaskRunner> blocking_task_runner)
-    : blocking_task_runner_(blocking_task_runner) {
+    : blocking_task_runner_(blocking_task_runner),
+      icon_loader_(new ActivityIconLoader) {
   DCHECK(!g_arc_service_manager);
   g_arc_service_manager = this;
 
@@ -59,9 +59,6 @@
   AddService(
       base::WrapUnique(new ArcCrashCollectorBridge(arc_bridge_service())));
   AddService(base::WrapUnique(new ArcImeService(arc_bridge_service())));
-  icon_loader_ = new ActivityIconLoader;
-  AddService(base::WrapUnique(
-      new ArcIntentHelperBridge(arc_bridge_service(), icon_loader_)));
   AddService(base::WrapUnique(new ArcMetricsService(arc_bridge_service())));
   AddService(base::WrapUnique(new ArcNetHostImpl(arc_bridge_service())));
   AddService(base::WrapUnique(new ArcObbMounterBridge(arc_bridge_service())));
diff --git a/components/arc/common/intent_helper.mojom b/components/arc/common/intent_helper.mojom
index 0e190c82..c8d2944 100644
--- a/components/arc/common/intent_helper.mojom
+++ b/components/arc/common/intent_helper.mojom
@@ -1,8 +1,9 @@
 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// Next MinVersion: 9
 
-// Next MinVersion: 8
 module arc.mojom;
 
 import "scale_factor.mojom";
@@ -44,7 +45,7 @@
 };
 
 // Handles intents from ARC in Chrome.
-// Next method ID: 4
+// Next method ID: 5
 interface IntentHelperHost {
   // Called when icons associated with the package are no longer up to date.
   [MinVersion=3] OnIconInvalidated@1(string package_name);
@@ -57,6 +58,10 @@
 
   // Opens the wallpaper picker dialog.
   [MinVersion=6] OpenWallpaperPicker@3();
+
+  // Sets an image as the wallpaper.
+  // |jpeg_data| is a JPEG encoded wallpaper image.
+  [MinVersion=8] SetWallpaper@4(array<uint8> jpeg_data);
 };
 
 // Sends intents to ARC on behalf of Chrome.
diff --git a/components/arc/ime/arc_ime_service.cc b/components/arc/ime/arc_ime_service.cc
index 963ada6..ae7873a4 100644
--- a/components/arc/ime/arc_ime_service.cc
+++ b/components/arc/ime/arc_ime_service.cc
@@ -38,6 +38,7 @@
       ime_bridge_(new ArcImeBridgeImpl(this, bridge_service)),
       ime_type_(ui::TEXT_INPUT_TYPE_NONE),
       has_composition_text_(false),
+      keyboard_controller_(nullptr),
       test_input_method_(nullptr) {
   aura::Env* env = aura::Env::GetInstanceDontCreate();
   if (env)
diff --git a/components/arc/intent_helper/arc_intent_helper_bridge.cc b/components/arc/intent_helper/arc_intent_helper_bridge.cc
index 15814543..7810a3f 100644
--- a/components/arc/intent_helper/arc_intent_helper_bridge.cc
+++ b/components/arc/intent_helper/arc_intent_helper_bridge.cc
@@ -4,6 +4,7 @@
 
 #include "components/arc/intent_helper/arc_intent_helper_bridge.h"
 
+#include <utility>
 #include <vector>
 
 #include "ash/desktop_background/user_wallpaper_delegate.h"
@@ -13,6 +14,7 @@
 #include "base/memory/weak_ptr.h"
 #include "components/arc/intent_helper/activity_icon_loader.h"
 #include "components/arc/intent_helper/link_handler_model_impl.h"
+#include "components/arc/set_wallpaper_delegate.h"
 #include "ui/base/layout.h"
 #include "url/gurl.h"
 
@@ -26,31 +28,41 @@
 
 ArcIntentHelperBridge::ArcIntentHelperBridge(
     ArcBridgeService* bridge_service,
-    const scoped_refptr<ActivityIconLoader>& icon_loader)
-    : ArcService(bridge_service), binding_(this), icon_loader_(icon_loader) {
+    const scoped_refptr<ActivityIconLoader>& icon_loader,
+    std::unique_ptr<SetWallpaperDelegate> set_wallpaper_delegate)
+    : ArcService(bridge_service),
+      binding_(this),
+      icon_loader_(icon_loader),
+      set_wallpaper_delegate_(std::move(set_wallpaper_delegate)) {
+  DCHECK(thread_checker_.CalledOnValidThread());
   arc_bridge_service()->AddObserver(this);
 }
 
 ArcIntentHelperBridge::~ArcIntentHelperBridge() {
+  DCHECK(thread_checker_.CalledOnValidThread());
   arc_bridge_service()->RemoveObserver(this);
 }
 
 void ArcIntentHelperBridge::OnIntentHelperInstanceReady() {
+  DCHECK(thread_checker_.CalledOnValidThread());
   ash::Shell::GetInstance()->set_link_handler_model_factory(this);
   arc_bridge_service()->intent_helper_instance()->Init(
       binding_.CreateInterfacePtrAndBind());
 }
 
 void ArcIntentHelperBridge::OnIntentHelperInstanceClosed() {
+  DCHECK(thread_checker_.CalledOnValidThread());
   ash::Shell::GetInstance()->set_link_handler_model_factory(nullptr);
 }
 
 void ArcIntentHelperBridge::OnIconInvalidated(
     const mojo::String& package_name) {
+  DCHECK(thread_checker_.CalledOnValidThread());
   icon_loader_->InvalidateIcons(package_name);
 }
 
 void ArcIntentHelperBridge::OnOpenDownloads() {
+  DCHECK(thread_checker_.CalledOnValidThread());
   // TODO(607411): If the FileManager is not yet open this will open to
   // downloads by default, which is what we want.  However if it is open it will
   // simply be brought to the forgeground without forcibly being navigated to
@@ -59,16 +71,24 @@
 }
 
 void ArcIntentHelperBridge::OnOpenUrl(const mojo::String& url) {
+  DCHECK(thread_checker_.CalledOnValidThread());
   GURL gurl(url.get());
   ash::Shell::GetInstance()->delegate()->OpenUrl(gurl);
 }
 
 void ArcIntentHelperBridge::OpenWallpaperPicker() {
+  DCHECK(thread_checker_.CalledOnValidThread());
   ash::Shell::GetInstance()->user_wallpaper_delegate()->OpenSetWallpaperPage();
 }
 
+void ArcIntentHelperBridge::SetWallpaper(mojo::Array<uint8_t> jpeg_data) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+  set_wallpaper_delegate_->SetWallpaper(jpeg_data.PassStorage());
+}
+
 std::unique_ptr<ash::LinkHandlerModel> ArcIntentHelperBridge::CreateModel(
     const GURL& url) {
+  DCHECK(thread_checker_.CalledOnValidThread());
   std::unique_ptr<LinkHandlerModelImpl> impl(
       new LinkHandlerModelImpl(icon_loader_));
   if (!impl->Init(url))
diff --git a/components/arc/intent_helper/arc_intent_helper_bridge.h b/components/arc/intent_helper/arc_intent_helper_bridge.h
index a74acf0..1302bea 100644
--- a/components/arc/intent_helper/arc_intent_helper_bridge.h
+++ b/components/arc/intent_helper/arc_intent_helper_bridge.h
@@ -11,6 +11,7 @@
 #include "ash/link_handler_model_factory.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/threading/thread_checker.h"
 #include "components/arc/arc_bridge_service.h"
 #include "components/arc/arc_service.h"
 #include "components/arc/common/intent_helper.mojom.h"
@@ -25,6 +26,7 @@
 namespace arc {
 
 class ActivityIconLoader;
+class SetWallpaperDelegate;
 
 // Receives intents from ARC.
 class ArcIntentHelperBridge : public ArcService,
@@ -32,8 +34,10 @@
                               public mojom::IntentHelperHost,
                               public ash::LinkHandlerModelFactory {
  public:
-  ArcIntentHelperBridge(ArcBridgeService* bridge_service,
-                        const scoped_refptr<ActivityIconLoader>& icon_loader);
+  ArcIntentHelperBridge(
+      ArcBridgeService* bridge_service,
+      const scoped_refptr<ActivityIconLoader>& icon_loader,
+      std::unique_ptr<SetWallpaperDelegate> set_wallpaper_delegate);
   ~ArcIntentHelperBridge() override;
 
   // ArcBridgeService::Observer
@@ -45,6 +49,7 @@
   void OnOpenDownloads() override;
   void OnOpenUrl(const mojo::String& url) override;
   void OpenWallpaperPicker() override;
+  void SetWallpaper(mojo::Array<uint8_t> jpeg_data) override;
 
   // ash::LinkHandlerModelFactory
   std::unique_ptr<ash::LinkHandlerModel> CreateModel(const GURL& url) override;
@@ -60,6 +65,9 @@
  private:
   mojo::Binding<mojom::IntentHelperHost> binding_;
   scoped_refptr<ActivityIconLoader> icon_loader_;
+  std::unique_ptr<SetWallpaperDelegate> set_wallpaper_delegate_;
+
+  base::ThreadChecker thread_checker_;
 
   DISALLOW_COPY_AND_ASSIGN(ArcIntentHelperBridge);
 };
diff --git a/components/arc/set_wallpaper_delegate.h b/components/arc/set_wallpaper_delegate.h
new file mode 100644
index 0000000..45edd37
--- /dev/null
+++ b/components/arc/set_wallpaper_delegate.h
@@ -0,0 +1,25 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_ARC_SET_WALLPAPER_DELEGATE_H_
+#define COMPONENTS_ARC_SET_WALLPAPER_DELEGATE_H_
+
+#include <stdint.h>
+
+#include <vector>
+
+namespace arc {
+
+// Delegate to allow setting the wallpaper.
+class SetWallpaperDelegate {
+ public:
+  virtual ~SetWallpaperDelegate() = default;
+
+  // Sets an image represented in JPEG format as the wallpaper.
+  virtual void SetWallpaper(const std::vector<uint8_t>& jpeg_data) = 0;
+};
+
+}  // namespace arc
+
+#endif  // COMPONENTS_ARC_SET_WALLPAPER_DELEGATE_H_
diff --git a/components/cast_certificate/cast_cert_validator.cc b/components/cast_certificate/cast_cert_validator.cc
index 5fb0ea1..8a4d6eb4 100644
--- a/components/cast_certificate/cast_cert_validator.cc
+++ b/components/cast_certificate/cast_cert_validator.cc
@@ -289,7 +289,7 @@
   // trust anchors and Cast signature policy.
   if (!net::VerifyCertificateChain(input_chain, CastTrustStore::Get(),
                                    signature_policy.get(),
-                                   ConvertExplodedTime(time))) {
+                                   ConvertExplodedTime(time), nullptr)) {
     return false;
   }
 
diff --git a/content/browser/media/media_canplaytype_browsertest.cc b/content/browser/media/media_canplaytype_browsertest.cc
index 19979194..d0c8589c 100644
--- a/content/browser/media/media_canplaytype_browsertest.cc
+++ b/content/browser/media/media_canplaytype_browsertest.cc
@@ -4,12 +4,14 @@
 
 #include <string>
 
+#include "base/command_line.h"
 #include "base/macros.h"
 #include "build/build_config.h"
 #include "content/browser/media/media_browsertest.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
+#include "media/base/media_switches.h"
 #include "media/media_features.h"
 
 #if defined(OS_ANDROID)
@@ -80,14 +82,6 @@
 const char* kHi10pProbably = kPropMaybe;
 #endif
 
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
-const char* kMp4Vp9Probably = kPropProbably;
-const char* kMP4Vp9Maybe = kMaybe;
-#else
-const char* kMp4Vp9Probably = kNot;
-const char* kMP4Vp9Maybe = kNot;
-#endif
-
 namespace content {
 
 class MediaCanPlayTypeTest : public MediaBrowserTest {
@@ -771,8 +765,9 @@
   EXPECT_EQ(kHevcSupported,
             CanPlay("'video/mp4; codecs=\"hvc1.1.6.L93.B0, mp4a.40.5\"'"));
 
-  EXPECT_EQ(kMp4Vp9Probably,
-            CanPlay("'video/mp4; codecs=\"vp09.00.01.08.02.01.01.00\"'"));
+  // Note: set to kPropProbably when switches::kEnableVp9InMp4 is enabled by
+  // default.
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.00.01.08.02.01.01.00\"'"));
 
   TestMPEGUnacceptableCombinations("video/mp4");
   // This result is incorrect. See https://crbug.com/592889.
@@ -1219,37 +1214,6 @@
   EXPECT_EQ(kPropMaybe,    CanPlay("'video/mp4; codecs=\"avc1.42E052\"'"));
 }
 
-IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_Mp4Vp9Variants) {
-  // Malformed codecs string.
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.00.-1.08\"'"));
-
-  // Codecs strings with missing fields.
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09\"'"));
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.00.01.08\"'"));
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01..02.01.01.00\"'"));
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.08.05.01.01\"'"));
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.04\"'"));
-
-  // Unexpected bit depth.
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.09.02.01.01.00\"'"));
-  // Unexpected chroma subsampling.
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.08.04.04.00.00\"'"));
-  // Unexpected transfer function.
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.08.04.03.02.00\"'"));
-
-  EXPECT_EQ(kMp4Vp9Probably,
-            CanPlay("'video/mp4; codecs=\"vp09.00.01.08.02.01.01.00\"'"));
-  EXPECT_EQ(kMp4Vp9Probably,
-            CanPlay("'video/mp4; codecs=\"vp09.00.01.08.04.03.00.00\"'"));
-  EXPECT_EQ(kMP4Vp9Maybe,
-            CanPlay("'video/mp4; codecs=\"vp09.01.01.08.02.01.01.00\"'"));
-  EXPECT_EQ(kMP4Vp9Maybe,
-            CanPlay("'video/mp4; codecs=\"vp09.02.01.08.02.01.01.00\"'"));
-  EXPECT_EQ(kMP4Vp9Maybe,
-            CanPlay("'video/mp4; codecs=\"vp09.03.01.08.02.01.01.00\"'"));
-  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.04.01.08.02.01.01.00\"'"));
-}
-
 IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_HEVCVariants) {
   // Both hev1 and hvc1 should be supported
   EXPECT_EQ(kHevcSupported, CanPlay("'video/mp4; codecs=hev1.1.6.L93.B0'"));
@@ -1754,4 +1718,57 @@
   EXPECT_EQ(kNot, CanPlay("'audio/mp2t; codecs=\"mp4a.40.2\"'"));
 }
 
+class MediaCanPlayTypeTestMp4Vp9Demuxing
+    : public MediaCanPlayTypeTest,
+      public ::testing::WithParamInterface<bool> {
+ public:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    MediaCanPlayTypeTest::SetUpCommandLine(command_line);
+    const bool enable_mp4_vp9_demuxing = GetParam();
+    if (enable_mp4_vp9_demuxing)
+      command_line->AppendSwitch(switches::kEnableVp9InMp4);
+  }
+};
+
+IN_PROC_BROWSER_TEST_P(MediaCanPlayTypeTestMp4Vp9Demuxing,
+                       CodecSupportTest_Mp4Vp9Variants) {
+  // Malformed codecs string.
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.00.-1.08\"'"));
+
+  // Codecs strings with missing fields.
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.00.01.08\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01..02.01.01.00\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.08.05.01.01\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.04\"'"));
+
+  // Unexpected bit depth.
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.09.02.01.01.00\"'"));
+  // Unexpected chroma subsampling.
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.08.04.04.00.00\"'"));
+  // Unexpected transfer function.
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.01.01.08.04.03.02.00\"'"));
+  // Unexpected profile.
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"vp09.04.01.08.02.01.01.00\"'"));
+
+  const bool enable_mp4_vp9_demuxing = GetParam();
+  const char* mp4_vp9_probably = enable_mp4_vp9_demuxing ? kPropProbably : kNot;
+  const char* mp4_vp9_maybe = enable_mp4_vp9_demuxing ? kPropMaybe : kNot;
+
+  EXPECT_EQ(mp4_vp9_probably,
+            CanPlay("'video/mp4; codecs=\"vp09.00.01.08.02.01.01.00\"'"));
+  EXPECT_EQ(mp4_vp9_probably,
+            CanPlay("'video/mp4; codecs=\"vp09.00.01.08.04.03.00.00\"'"));
+  EXPECT_EQ(mp4_vp9_maybe,
+            CanPlay("'video/mp4; codecs=\"vp09.01.01.08.02.01.01.00\"'"));
+  EXPECT_EQ(mp4_vp9_maybe,
+            CanPlay("'video/mp4; codecs=\"vp09.02.01.08.02.01.01.00\"'"));
+  EXPECT_EQ(mp4_vp9_maybe,
+            CanPlay("'video/mp4; codecs=\"vp09.03.01.08.02.01.01.00\"'"));
+}
+
+INSTANTIATE_TEST_CASE_P(EnableDisableMp4Vp9Demuxing,
+                        MediaCanPlayTypeTestMp4Vp9Demuxing,
+                        ::testing::Bool());
+
 }  // namespace content
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 8fb5648..b1085f4d 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -1421,6 +1421,7 @@
     switches::kEnableUnsafeES3APIs,
     switches::kEnableUseZoomForDSF,
     switches::kEnableViewport,
+    switches::kEnableVp9InMp4,
     switches::kEnableVtune,
     switches::kEnableWebBluetooth,
     switches::kEnableWebFontsInterventionTrigger,
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 69bc8e7..a659caf6 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -7068,19 +7068,29 @@
   NavigateFrameToURL(child2, embedded_test_server()->GetURL(
       "c.com", "/site_isolation/page-with-select.html"));
 
-  // Open both <select> menus.  This creates a popup widget in both processes.
+  // Open both <select> menus by focusing each item and sending a space key
+  // at the focused node. This creates a popup widget in both processes.
   // Wait for and then drop the ViewHostMsg_ShowWidget messages, so that both
   // widgets are left in pending-but-not-shown state.
+  NativeWebKeyboardEvent event;
+  event.text[0] = ' ';
+  event.timeStampSeconds = 100;
+  event.type = blink::WebKeyboardEvent::Char;
+
   scoped_refptr<PendingWidgetMessageFilter> filter1 =
       new PendingWidgetMessageFilter();
   process1->AddFilter(filter1.get());
-  EXPECT_TRUE(ExecuteScript(child1, "openSelectMenu();"));
+  EXPECT_TRUE(ExecuteScript(child1, "focusSelectMenu();"));
+  child1->current_frame_host()->GetRenderWidgetHost()->ForwardKeyboardEvent(
+      event);
   filter1->Wait();
 
   scoped_refptr<PendingWidgetMessageFilter> filter2 =
       new PendingWidgetMessageFilter();
   process2->AddFilter(filter2.get());
-  EXPECT_TRUE(ExecuteScript(child2, "openSelectMenu();"));
+  EXPECT_TRUE(ExecuteScript(child2, "focusSelectMenu();"));
+  child2->current_frame_host()->GetRenderWidgetHost()->ForwardKeyboardEvent(
+      event);
   filter2->Wait();
 
   // At this point, we should have two pending widgets.
diff --git a/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java b/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
index defe535..4107dd9 100644
--- a/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
+++ b/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
@@ -24,7 +24,6 @@
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.test.util.CommandLineFlags;
 import org.chromium.base.test.util.Feature;
-import org.chromium.base.test.util.FlakyTest;
 import org.chromium.content.browser.ContentViewCore;
 import org.chromium.content.browser.test.util.Criteria;
 import org.chromium.content.browser.test.util.CriteriaHelper;
@@ -110,7 +109,6 @@
 
     @MediumTest
     @Feature({"TextInput", "Main"})
-    @FlakyTest
     public void testDoesNotHang_getTextAfterKeyboardHides() throws Throwable {
         setComposingText("hello", 1);
         waitAndVerifyUpdateSelection(0, 5, 5, 0, 5);
@@ -238,7 +236,6 @@
 
     @SmallTest
     @Feature({"TextInput"})
-    @FlakyTest(message = "crbug.com/603991")
     public void testImeCopy() throws Exception {
         commitText("hello", 1);
         waitAndVerifyUpdateSelection(0, 5, 5, -1, -1);
@@ -579,7 +576,6 @@
 
     @SmallTest
     @Feature({"TextInput"})
-    @FlakyTest(message = "crbug.com/603991")
     public void testImeCut() throws Exception {
         commitText("snarful", 1);
         waitAndVerifyUpdateSelection(0, 7, 7, -1, -1);
@@ -633,16 +629,6 @@
     @MediumTest
     @Feature({"TextInput"})
     public void testPasteLongText() throws Exception {
-        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
-            @Override
-            public void run() {
-                ClipboardManager clipboardManager =
-                        (ClipboardManager) getActivity().getSystemService(
-                                Context.CLIPBOARD_SERVICE);
-                clipboardManager.setPrimaryClip(ClipData.newPlainText("blarg", "blarg"));
-            }
-        });
-
         int textLength = 25000;
         String text = new String(new char[textLength]).replace("\0", "a");
 
@@ -671,7 +657,6 @@
 
     @SmallTest
     @Feature({"TextInput"})
-    @FlakyTest(message = "crbug.com/598482")
     public void testImeSelectAndUnSelectAll() throws Exception {
         commitText("hello", 1);
         waitAndVerifyUpdateSelection(0, 5, 5, -1, -1);
@@ -771,7 +756,6 @@
 
     @SmallTest
     @Feature({"TextInput", "Main"})
-    @FlakyTest
     public void testSwipingText() throws Throwable {
         focusElement("textarea");
 
@@ -1083,7 +1067,6 @@
 
     @SmallTest
     @Feature({"TextInput"})
-    @FlakyTest(message = "crbug.com/598482")
     public void testPastePopupShowAndHide() throws Throwable {
         commitText("hello", 1);
         waitAndVerifyUpdateSelection(0, 5, 5, -1, -1);
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 31da8d1d..defc118 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -151,7 +151,7 @@
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
 #include "third_party/WebKit/public/web/WebKit.h"
-#include "third_party/WebKit/public/web/WebMemoryPressureListener.h"
+#include "third_party/WebKit/public/web/WebMemoryCoordinator.h"
 #include "third_party/WebKit/public/web/WebNetworkStateNotifier.h"
 #include "third_party/WebKit/public/web/WebRuntimeFeatures.h"
 #include "third_party/WebKit/public/web/WebScriptController.h"
@@ -1916,7 +1916,7 @@
 
   // Do not call into blink if it is not initialized.
   if (blink_platform_impl_) {
-    blink::WebMemoryPressureListener::onMemoryPressure(
+    blink::WebMemoryCoordinator::onMemoryPressure(
         static_cast<blink::WebMemoryPressureLevel>(memory_pressure_level));
 
     if (memory_pressure_level ==
diff --git a/content/test/data/site_isolation/page-with-select.html b/content/test/data/site_isolation/page-with-select.html
index c8282d4f..46591057 100644
--- a/content/test/data/site_isolation/page-with-select.html
+++ b/content/test/data/site_isolation/page-with-select.html
@@ -10,10 +10,8 @@
 </style>
 <script>
 
-function openSelectMenu(target) {
-  var evt = document.createEvent("MouseEvents");
-  evt.initMouseEvent("mousedown", true, true, window);
-  document.querySelector('select').dispatchEvent(evt);
+function focusSelectMenu() {
+  document.querySelector('select').focus();
 }
 
 </script>
@@ -25,4 +23,4 @@
   <option>Banana</option>
 </select>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/media/BUILD.gn b/media/BUILD.gn
index de0824e..fb4c400 100644
--- a/media/BUILD.gn
+++ b/media/BUILD.gn
@@ -19,7 +19,6 @@
     "ENABLE_AC3_EAC3_AUDIO_DEMUXING=$enable_ac3_eac3_audio_demuxing",
     "ENABLE_HEVC_DEMUXING=$enable_hevc_demuxing",
     "ENABLE_MSE_MPEG2TS_STREAM_PARSER=$enable_mse_mpeg2ts_stream_parser",
-    "ENABLE_MP4_VP9_DEMUXING=0",
   ]
 }
 
diff --git a/media/base/key_systems.cc b/media/base/key_systems.cc
index b593ab14..e970f0a4 100644
--- a/media/base/key_systems.cc
+++ b/media/base/key_systems.cc
@@ -20,7 +20,6 @@
 #include "media/base/key_system_properties.h"
 #include "media/base/media.h"
 #include "media/base/media_client.h"
-#include "media/media_features.h"
 #include "third_party/widevine/cdm/widevine_cdm_common.h"
 
 namespace media {
@@ -57,9 +56,7 @@
     {"vp9", EME_CODEC_WEBM_VP9},        // VP9.
     {"vp9.0", EME_CODEC_WEBM_VP9},      // VP9.
 #if defined(USE_PROPRIETARY_CODECS)
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
-    {"vp09", EME_CODEC_MP4_VP9},  // VP9 in MP4.
-#endif
+    {"vp09", EME_CODEC_MP4_VP9},   // VP9 in MP4.
     {"mp4a", EME_CODEC_MP4_AAC},   // AAC.
     {"avc1", EME_CODEC_MP4_AVC1},  // AVC1.
     {"avc3", EME_CODEC_MP4_AVC1},  // AVC3.
diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
index 8497131..14a86df 100644
--- a/media/base/media_switches.cc
+++ b/media/base/media_switches.cc
@@ -119,6 +119,10 @@
 const char kDisableRTCSmoothnessAlgorithm[] =
     "disable-rtc-smoothness-algorithm";
 
+// Enables demuxing of vp9 in mp4. Note that this flag will not have any effect
+// if MP4 demuxing is not enabled in the build.
+const char kEnableVp9InMp4[] = "enable-vp9-in-mp4";
+
 }  // namespace switches
 
 namespace media {
diff --git a/media/base/media_switches.h b/media/base/media_switches.h
index 3b260001..8edd7ec 100644
--- a/media/base/media_switches.h
+++ b/media/base/media_switches.h
@@ -63,6 +63,8 @@
 
 MEDIA_EXPORT extern const char kDisableRTCSmoothnessAlgorithm[];
 
+MEDIA_EXPORT extern const char kEnableVp9InMp4[];
+
 }  // namespace switches
 
 namespace media {
diff --git a/media/base/mime_util_internal.cc b/media/base/mime_util_internal.cc
index 8840cc78..5bd7c7f0 100644
--- a/media/base/mime_util_internal.cc
+++ b/media/base/mime_util_internal.cc
@@ -12,7 +12,6 @@
 #include "media/base/media.h"
 #include "media/base/media_switches.h"
 #include "media/base/video_codecs.h"
-#include "media/media_features.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/build_info.h"
@@ -168,7 +167,11 @@
     return false;
   }
 
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableVp9InMp4)) {
+    return false;
+  }
+
   std::vector<std::string> fields = base::SplitString(
       codec_id, ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
   if (fields.size() < 1)
@@ -237,9 +240,6 @@
     return false;
 
   return true;
-#else
-  return false;
-#endif  // #if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
 }
 
 MimeUtil::MimeUtil() : allow_proprietary_codecs_(false) {
@@ -360,11 +360,9 @@
 #if BUILDFLAG(ENABLE_HEVC_DEMUXING)
   mp4_video_codecs.insert(HEVC);
 #endif  // BUILDFLAG(ENABLE_HEVC_DEMUXING)
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
   // Only VP9 with valid codec string vp09.xx.xx.xx.xx.xx.xx.xx is supported.
   // See ParseVp9CodecID for details.
   mp4_video_codecs.insert(VP9);
-#endif  // BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
   CodecSet mp4_codecs(mp4_audio_codecs);
   mp4_codecs.insert(mp4_video_codecs.begin(), mp4_video_codecs.end());
 #endif  // defined(USE_PROPRIETARY_CODECS)
diff --git a/media/filters/stream_parser_factory.cc b/media/filters/stream_parser_factory.cc
index 4a36875..0609688e 100644
--- a/media/filters/stream_parser_factory.cc
+++ b/media/filters/stream_parser_factory.cc
@@ -108,6 +108,12 @@
 }
 
 #if defined(USE_PROPRIETARY_CODECS)
+bool CheckIfMp4Vp9DemuxingEnabled(const std::string& codec_id,
+                                  const scoped_refptr<MediaLog>& media_log) {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableVp9InMp4);
+}
+
 // AAC Object Type IDs that Chrome supports.
 static const int kAACLCObjectType = 2;
 static const int kAACSBRObjectType = 5;
@@ -162,10 +168,9 @@
 static const CodecInfo kHEVCHVC1CodecInfo = { "hvc1.*", CodecInfo::VIDEO, NULL,
                                               CodecInfo::HISTOGRAM_HEVC };
 #endif
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
-static const CodecInfo kMPEG4VP09CodecInfo = {"vp09.*", CodecInfo::VIDEO, NULL,
+static const CodecInfo kMPEG4VP09CodecInfo = {"vp09.*", CodecInfo::VIDEO,
+                                              &CheckIfMp4Vp9DemuxingEnabled,
                                               CodecInfo::HISTOGRAM_VP9};
-#endif
 static const CodecInfo kMPEG4AACCodecInfo = { "mp4a.40.*", CodecInfo::AUDIO,
                                               &ValidateMP4ACodecID,
                                               CodecInfo::HISTOGRAM_MPEG4AAC };
@@ -198,9 +203,7 @@
 #if BUILDFLAG(ENABLE_HEVC_DEMUXING)
     &kHEVCHEV1CodecInfo,  &kHEVCHVC1CodecInfo,
 #endif
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
     &kMPEG4VP09CodecInfo,
-#endif
     &kMPEG4AACCodecInfo,  &kMPEG2AACLCCodecInfo, NULL};
 
 static const CodecInfo* kAudioMP4Codecs[] = {&kMPEG4AACCodecInfo,
diff --git a/media/formats/mp4/box_definitions.cc b/media/formats/mp4/box_definitions.cc
index f8d5a3e..776da645 100644
--- a/media/formats/mp4/box_definitions.cc
+++ b/media/formats/mp4/box_definitions.cc
@@ -7,8 +7,10 @@
 #include <memory>
 #include <utility>
 
+#include "base/command_line.h"
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
+#include "media/base/media_switches.h"
 #include "media/base/video_types.h"
 #include "media/base/video_util.h"
 #include "media/formats/mp4/avc.h"
@@ -683,18 +685,22 @@
       break;
     }
 #endif
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
-    case FOURCC_VP09: {
-      DVLOG(2) << __FUNCTION__ << " parsing VPCodecConfigurationRecord (vpcC)";
-      std::unique_ptr<VPCodecConfigurationRecord> vp_config(
-          new VPCodecConfigurationRecord());
-      RCHECK(reader->ReadChild(vp_config.get()));
-      frame_bitstream_converter = nullptr;
-      video_codec = kCodecVP9;
-      video_codec_profile = vp_config->profile;
+    case FOURCC_VP09:
+      if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kEnableVp9InMp4)) {
+        DVLOG(2) << __FUNCTION__
+                 << " parsing VPCodecConfigurationRecord (vpcC)";
+        std::unique_ptr<VPCodecConfigurationRecord> vp_config(
+            new VPCodecConfigurationRecord());
+        RCHECK(reader->ReadChild(vp_config.get()));
+        frame_bitstream_converter = nullptr;
+        video_codec = kCodecVP9;
+        video_codec_profile = vp_config->profile;
+      } else {
+        MEDIA_LOG(ERROR, reader->media_log()) << "VP9 in MP4 is not enabled.";
+        return false;
+      }
       break;
-    }
-#endif
     default:
       // Unknown/unsupported format
       MEDIA_LOG(ERROR, reader->media_log()) << __FUNCTION__
@@ -716,10 +722,10 @@
     case FOURCC_HEV1:
     case FOURCC_HVC1:
 #endif
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
-    case FOURCC_VP09:
-#endif
       return true;
+    case FOURCC_VP09:
+      return base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableVp9InMp4);
     default:
       return false;
   }
diff --git a/media/media.gyp b/media/media.gyp
index afcb0d3..a553800 100644
--- a/media/media.gyp
+++ b/media/media.gyp
@@ -65,7 +65,6 @@
           "ENABLE_AC3_EAC3_AUDIO_DEMUXING=<(enable_ac3_eac3_audio_demuxing)",
           "ENABLE_HEVC_DEMUXING=<(enable_hevc_demuxing)",
           "ENABLE_MSE_MPEG2TS_STREAM_PARSER=<(enable_mse_mpeg2ts_stream_parser)",
-          "ENABLE_MP4_VP9_DEMUXING=0",
         ],
       },
     },
diff --git a/media/test/pipeline_integration_test.cc b/media/test/pipeline_integration_test.cc
index c18f5b0..d940a4a 100644
--- a/media/test/pipeline_integration_test.cc
+++ b/media/test/pipeline_integration_test.cc
@@ -32,7 +32,6 @@
 #include "media/cdm/aes_decryptor.h"
 #include "media/cdm/json_web_key.h"
 #include "media/filters/chunk_demuxer.h"
-#include "media/media_features.h"
 #include "media/renderers/renderer_impl.h"
 #include "media/test/pipeline_integration_test_base.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -106,9 +105,7 @@
 const char kADTS[] = "audio/aac";
 const char kMP4[] = "video/mp4; codecs=\"avc1.4D4041,mp4a.40.2\"";
 const char kMP4VideoAVC3[] = "video/mp4; codecs=\"avc3.64001f\"";
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
 const char kMP4VideoVP9[] = "video/mp4; codecs=\"vp09.00.00.08.01.01.00.00\"";
-#endif
 const char kMP4Video[] = "video/mp4; codecs=\"avc1.4D4041\"";
 const char kMP4Audio[] = "audio/mp4; codecs=\"mp4a.40.2\"";
 const char kMP3[] = "audio/mpeg";
@@ -606,6 +603,15 @@
   }
 
   void DemuxerOpenedTask() {
+    CHECK_EQ(ChunkDemuxer::kOk, AddId());
+    chunk_demuxer_->SetTracksWatcher(
+        kSourceId, base::Bind(&MockMediaSource::InitSegmentReceived,
+                              base::Unretained(this)));
+
+    AppendData(initial_append_size_);
+  }
+
+  ChunkDemuxer::Status AddId() {
     // This code assumes that |mimetype_| is one of the following forms.
     // 1. audio/mpeg
     // 2. video/webm;codec="vorbis,vp8".
@@ -630,12 +636,7 @@
                                  base::SPLIT_WANT_NONEMPTY);
     }
 
-    CHECK_EQ(chunk_demuxer_->AddId(kSourceId, type, codecs), ChunkDemuxer::kOk);
-    chunk_demuxer_->SetTracksWatcher(
-        kSourceId, base::Bind(&MockMediaSource::InitSegmentReceived,
-                              base::Unretained(this)));
-
-    AppendData(initial_append_size_);
+    return chunk_demuxer_->AddId(kSourceId, type, codecs);
   }
 
   void OnEncryptedMediaInitData(EmeInitDataType init_data_type,
@@ -1898,10 +1899,16 @@
   Stop();
 }
 
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
-TEST_F(PipelineIntegrationTest, EncryptedPlayback_MP4_VP9_CENC_VideoOnly) {
+TEST_F(PipelineIntegrationTest,
+       MAYBE_EME(EncryptedPlayback_MP4_VP9_CENC_VideoOnly)) {
   MockMediaSource source("bear-320x240-v_frag-vp9-cenc.mp4", kMP4VideoVP9,
                          kAppendWholeFile);
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableVp9InMp4)) {
+    ASSERT_EQ(ChunkDemuxer::kNotSupported, source.AddId());
+    return;
+  }
+
   FakeEncryptedMedia encrypted_media(new KeyProvidingApp());
   EXPECT_EQ(PIPELINE_OK,
             StartPipelineWithEncryptedMedia(&source, &encrypted_media));
@@ -1914,7 +1921,6 @@
   source.Shutdown();
   Stop();
 }
-#endif  // #if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
 
 TEST_F(PipelineIntegrationTest, BasicPlayback_MediaSource_VideoOnly_MP4_AVC3) {
   MockMediaSource source("bear-1280x720-v_frag-avc3.mp4", kMP4VideoAVC3,
@@ -1934,10 +1940,15 @@
   Stop();
 }
 
-#if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
 TEST_F(PipelineIntegrationTest, BasicPlayback_MediaSource_VideoOnly_MP4_VP9) {
   MockMediaSource source("bear-320x240-v_frag-vp9.mp4", kMP4VideoVP9,
                          kAppendWholeFile);
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableVp9InMp4)) {
+    ASSERT_EQ(ChunkDemuxer::kNotSupported, source.AddId());
+    return;
+  }
+
   EXPECT_EQ(PIPELINE_OK, StartPipelineWithMediaSource(&source));
   source.EndOfStream();
   ASSERT_EQ(PIPELINE_OK, pipeline_status_);
@@ -1948,7 +1959,6 @@
   source.Shutdown();
   Stop();
 }
-#endif  // #if BUILDFLAG(ENABLE_MP4_VP9_DEMUXING)
 
 #endif  // defined(USE_PROPRIETARY_CODECS)
 
diff --git a/net/cert/internal/verify_certificate_chain.cc b/net/cert/internal/verify_certificate_chain.cc
index f6a45b24..73bd6f13 100644
--- a/net/cert/internal/verify_certificate_chain.cc
+++ b/net/cert/internal/verify_certificate_chain.cc
@@ -483,7 +483,8 @@
     const std::vector<scoped_refptr<ParsedCertificate>>& cert_chain,
     const TrustStore& trust_store,
     const SignaturePolicy* signature_policy,
-    const der::GeneralizedTime& time) {
+    const der::GeneralizedTime& time,
+    std::vector<scoped_refptr<ParsedCertificate>>* trusted_chain_out) {
   if (cert_chain.empty())
     return false;
 
@@ -494,8 +495,11 @@
     return false;
 
   // Verify the chain.
-  return VerifyCertificateChainAssumingTrustedRoot(full_chain, trust_store,
-                                                   signature_policy, time);
+  bool success = VerifyCertificateChainAssumingTrustedRoot(
+      full_chain, trust_store, signature_policy, time);
+  if (success && trusted_chain_out != nullptr)
+    *trusted_chain_out = std::move(full_chain);
+  return success;
 }
 
 }  // namespace net
diff --git a/net/cert/internal/verify_certificate_chain.h b/net/cert/internal/verify_certificate_chain.h
index 4d85eb6..291c843 100644
--- a/net/cert/internal/verify_certificate_chain.h
+++ b/net/cert/internal/verify_certificate_chain.h
@@ -51,6 +51,16 @@
 //   time:
 //     The UTC time to use for expiration checks.
 //
+//   trusted_chain_out:
+//     The vector to populate with the verified trusted certificate chain.
+//      * trusted_chain_out[0] is the target certificate verified.
+//      * trusted_chain_out[i+1] holds the certificate that issued
+//        trusted_chain_out[i].
+//      * trusted_chain_out[N-1] is the trust anchor.
+//     If a nullptr is passed, this parameter is ignored.
+//     If the target certificate can not be verified, this parameter is
+//     ignored.
+//
 // ---------
 // Outputs
 // ---------
@@ -60,7 +70,9 @@
     const std::vector<scoped_refptr<ParsedCertificate>>& cert_chain,
     const TrustStore& trust_store,
     const SignaturePolicy* signature_policy,
-    const der::GeneralizedTime& time) WARN_UNUSED_RESULT;
+    const der::GeneralizedTime& time,
+    std::vector<scoped_refptr<ParsedCertificate>>* trusted_chain_out)
+    WARN_UNUSED_RESULT;
 
 }  // namespace net
 
diff --git a/net/cert/internal/verify_certificate_chain_pkits_unittest.cc b/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
index 1a2fc78..6925f64 100644
--- a/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
+++ b/net/cert/internal/verify_certificate_chain_pkits_unittest.cc
@@ -80,7 +80,7 @@
     der::GeneralizedTime time = {2011, 4, 15, 0, 0, 0};
 
     return VerifyCertificateChain(input_chain, trust_store, &signature_policy,
-                                  time);
+                                  time, nullptr);
   }
 };
 
diff --git a/net/cert/internal/verify_certificate_chain_unittest.cc b/net/cert/internal/verify_certificate_chain_unittest.cc
index 11323f8..4cd03c0 100644
--- a/net/cert/internal/verify_certificate_chain_unittest.cc
+++ b/net/cert/internal/verify_certificate_chain_unittest.cc
@@ -114,8 +114,17 @@
 
   SimpleSignaturePolicy signature_policy(1024);
 
-  bool result =
-      VerifyCertificateChain(input_chain, trust_store, &signature_policy, time);
+  std::vector<scoped_refptr<ParsedCertificate>> trusted_chain;
+  bool result = VerifyCertificateChain(input_chain, trust_store,
+                                       &signature_policy, time, &trusted_chain);
+  if (result) {
+    ASSERT_EQ(trusted_chain.size(), input_chain.size() + 1);
+    ASSERT_TRUE(std::equal(input_chain.begin(), input_chain.end(),
+                           trusted_chain.begin()));
+    ASSERT_TRUE(trust_store.IsTrustedCertificate(trusted_chain.back().get()));
+  } else {
+    ASSERT_EQ(trusted_chain.size(), 0u);
+  }
 
   ASSERT_EQ(expected_result, result);
 }
@@ -235,8 +244,8 @@
   std::vector<scoped_refptr<ParsedCertificate>> chain;
   SimpleSignaturePolicy signature_policy(2048);
 
-  ASSERT_FALSE(
-      VerifyCertificateChain(chain, trust_store, &signature_policy, time));
+  ASSERT_FALSE(VerifyCertificateChain(chain, trust_store, &signature_policy,
+                                      time, nullptr));
 }
 
 // TODO(eroman): Add test that invalidate validity dates where the day or month
diff --git a/net/data/url_request_unittest/gzip-encoded b/net/data/url_request_unittest/gzip-encoded
new file mode 100644
index 0000000..46509c7
--- /dev/null
+++ b/net/data/url_request_unittest/gzip-encoded
Binary files differ
diff --git a/net/data/url_request_unittest/gzip-encoded.mock-http-headers b/net/data/url_request_unittest/gzip-encoded.mock-http-headers
new file mode 100644
index 0000000..a7ebb3d
--- /dev/null
+++ b/net/data/url_request_unittest/gzip-encoded.mock-http-headers
@@ -0,0 +1,4 @@
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Encoding: gzip
+Content-Length: 30
diff --git a/net/net.gypi b/net/net.gypi
index 1cc7d277..9834007 100644
--- a/net/net.gypi
+++ b/net/net.gypi
@@ -2390,6 +2390,8 @@
       'data/url_request_unittest/expect-ct-header.html',
       'data/url_request_unittest/expect-ct-header.html.mock-http-headers',
       'data/url_request_unittest/filedir-sentinel',
+      'data/url_request_unittest/gzip-encoded',
+      'data/url_request_unittest/gzip-encoded.mock-http-headers',
       'data/url_request_unittest/hpkp-headers-report-only.html',
       'data/url_request_unittest/hpkp-headers-report-only.html.mock-http-headers',
       'data/url_request_unittest/hpkp-headers.html',
diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
index ff9b188..3cd5e9a5 100644
--- a/net/url_request/url_request.cc
+++ b/net/url_request/url_request.cc
@@ -247,6 +247,13 @@
   return job_->GetTotalSentBytes();
 }
 
+int64_t URLRequest::GetRawBodyBytes() const {
+  if (!job_.get())
+    return 0;
+
+  return job_->prefilter_bytes_read();
+}
+
 LoadStateWithParam URLRequest::GetLoadState() const {
   // The !blocked_by_.empty() check allows |this| to report it's blocked on a
   // delegate before it has been started.
diff --git a/net/url_request/url_request.h b/net/url_request/url_request.h
index a4dba71b..1aa0dba74b 100644
--- a/net/url_request/url_request.h
+++ b/net/url_request/url_request.h
@@ -385,6 +385,12 @@
   // are used for range requests or auth.
   int64_t GetTotalSentBytes() const;
 
+  // The size of the response body before removing any content encodings.
+  // Does not include redirects or sub-requests issued at lower levels (range
+  // requests or auth). Only includes bytes which have been read so far,
+  // including bytes from the cache.
+  int64_t GetRawBodyBytes() const;
+
   // Returns the current load state for the request. The returned value's
   // |param| field is an optional parameter describing details related to the
   // load state. Not all load states have a parameter.
diff --git a/net/url_request/url_request_job.h b/net/url_request/url_request_job.h
index bcdd607..0124f85 100644
--- a/net/url_request/url_request_job.h
+++ b/net/url_request/url_request_job.h
@@ -216,6 +216,10 @@
   // Whether we have processed the response for that request yet.
   bool has_response_started() const { return has_handled_response_; }
 
+  // The number of bytes read before passing to the filter. This value reflects
+  // bytes read even when there is no filter.
+  int64_t prefilter_bytes_read() const { return prefilter_bytes_read_; }
+
   // These methods are not applicable to all connections.
   virtual bool GetMimeType(std::string* mime_type) const;
   virtual int GetResponseCode() const;
@@ -334,10 +338,6 @@
   // Set the proxy server that was used, if any.
   void SetProxyServer(const HostPortPair& proxy_server);
 
-  // The number of bytes read before passing to the filter. This value reflects
-  // bytes read even when there is no filter.
-  int64_t prefilter_bytes_read() const { return prefilter_bytes_read_; }
-
   // The number of bytes read after passing through the filter. This value
   // reflects bytes read even when there is no filter.
   int64_t postfilter_bytes_read() const { return postfilter_bytes_read_; }
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 996b481..f9d197c 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -7952,6 +7952,30 @@
   EXPECT_FALSE(req->response_info().network_accessed);
 }
 
+TEST_F(URLRequestTestHTTP, RawBodyBytesNoContentEncoding) {
+  ASSERT_TRUE(http_test_server()->Start());
+
+  TestDelegate d;
+  std::unique_ptr<URLRequest> req(default_context().CreateRequest(
+      http_test_server()->GetURL("/simple.html"), DEFAULT_PRIORITY, &d));
+  req->Start();
+  base::RunLoop().Run();
+
+  EXPECT_EQ(5, req->GetRawBodyBytes());
+}
+
+TEST_F(URLRequestTestHTTP, RawBodyBytesGzipEncoding) {
+  ASSERT_TRUE(http_test_server()->Start());
+
+  TestDelegate d;
+  std::unique_ptr<URLRequest> req(default_context().CreateRequest(
+      http_test_server()->GetURL("/gzip-encoded"), DEFAULT_PRIORITY, &d));
+  req->Start();
+  base::RunLoop().Run();
+
+  EXPECT_EQ(30, req->GetRawBodyBytes());
+}
+
 class URLRequestInterceptorTestHTTP : public URLRequestTestHTTP {
  public:
   // TODO(bengr): Merge this with the URLRequestInterceptorHTTPTest fixture,
@@ -10035,6 +10059,19 @@
     EXPECT_EQ(GetTestFileContents(), d->data_received());
   }
 }
+
+TEST_F(URLRequestTestFTP, RawBodyBytes) {
+  ASSERT_TRUE(ftp_test_server_.Start());
+
+  TestDelegate d;
+  std::unique_ptr<URLRequest> req(default_context().CreateRequest(
+      ftp_test_server_.GetURL("simple.html"), DEFAULT_PRIORITY, &d));
+  req->Start();
+  base::RunLoop().Run();
+
+  EXPECT_EQ(6, req->GetRawBodyBytes());
+}
+
 #endif  // !defined(DISABLE_FTP_SUPPORT)
 
 TEST_F(URLRequestTest, NetworkAccessedClearBeforeNetworkStart) {
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 27e6c3e..ed3605d 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -1190,6 +1190,9 @@
 crbug.com/445194 [ Debug ] fast/dom/shadow/focus-controller-recursion-crash.html [ Skip ]
 crbug.com/505387 [ Win ] virtual/prefer_compositing_to_lcd_text/scrollbars/rtl/overflow-scroll-rtl.html [ Failure ]
 
+# Failure on Mac 10.9, temporarily disabled.
+crbug.com/621024 [ Mac10.9 ] svg/custom/pointer-events-image.svg [ Failure ]
+
 # Mac10.10-specific failures that still need triaging.
 # Form controls need rebaseline because of the default font change.
 # If you see wider INPUT elements or narrower TEXTAREA elements, you may do just
@@ -1316,6 +1319,11 @@
 
 crbug.com/320139 fast/repaint/block-layout-inline-children-replaced.html [ Pass Failure ]
 
+crbug.com/620786 webaudio/audioparam-setTargetAtTime-continuous.html [ NeedsManualRebaseline ]
+crbug.com/620786 webaudio/audioparam-setTargetAtTime-limit.html [ NeedsManualRebaseline ]
+crbug.com/620786 webaudio/audioparam-setTargetAtTime-sampling.html [ NeedsManualRebaseline ]
+crbug.com/620786 webaudio/stereopannernode-no-glitch.html [ NeedsManualRebaseline ]
+
 crbug.com/575766 http/tests/inspector/resource-tree/resource-tree-frame-add.html [ Timeout Pass ]
 crbug.com/581468 http/tests/inspector/resource-tree/resource-tree-non-unique-url.html [ Pass Failure ]
 
@@ -1430,6 +1438,9 @@
 crbug.com/620126 svg/custom/js-late-clipPath-and-object-creation.svg [ NeedsManualRebaseline ]
 crbug.com/620126 svg/custom/js-late-clipPath-creation.svg [ NeedsManualRebaseline ]
 
+# Failure on Linux Trusty, temporarily disabled.
+crbug.com/621025 [ Linux ] svg/custom/text-match-highlight.html [ Failure ]
+
 # TODO(jlebel): Remove when methods are implemented.
 crbug.com/609065 [ Mac ] bluetooth/characteristicProperties.html [ Skip ]
 crbug.com/609064 [ Mac ] bluetooth/connect/connect-disconnected-connect.html [ Skip ]
@@ -1528,25 +1539,6 @@
 crbug.com/606302 [ Linux Debug ] transforms/3d/point-mapping/3d-point-mapping-preserve-3d.html [ Failure ]
 crbug.com/613497 [ Linux Release ] transforms/3d/point-mapping/3d-point-mapping-preserve-3d.html [ Failure ]
 
-crbug.com/619987 [ Win7 ] fast/images/drag-image.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] fast/images/paint-subrect-grid.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] fast/images/png-color-profile-ignore-gamma.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] fast/images/png-suite/test.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] fast/images/repaint-subrect-grid.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/dynamic-updates/SVGFEBlendElement-dom-in-attr.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/dynamic-updates/SVGFEBlendElement-dom-in2-attr.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/dynamic-updates/SVGFEBlendElement-dom-mode-attr.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/dynamic-updates/SVGFEBlendElement-svgdom-in-prop.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/dynamic-updates/SVGFEBlendElement-svgdom-in2-prop.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/dynamic-updates/SVGFEBlendElement-svgdom-mode-prop.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] virtual/gpu-rasterization/fast/images/drag-image.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] virtual/gpu-rasterization/fast/images/paint-subrect-grid.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] virtual/gpu-rasterization/fast/images/png-color-profile-ignore-gamma.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] virtual/gpu-rasterization/fast/images/png-suite/test.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] virtual/gpu-rasterization/fast/images/repaint-subrect-grid.html [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/W3C-SVG-1.1/masking-path-04-b.svg [ NeedsRebaseline ]
-crbug.com/619987 [ Win7 ] svg/W3C-SVG-1.1/filters-blend-01-b.svg [ NeedsRebaseline ]
-
 crbug.com/613659 imported/wpt/quirks-mode/percentage-height-calculation.html [ Failure ]
 crbug.com/613661 imported/wpt/quirks-mode/table-cell-nowrap-minimum-width-calculation.html [ Failure ]
 crbug.com/613663 imported/wpt/quirks-mode/table-cell-width-calculation.html [ Failure ]
@@ -1558,9 +1550,5 @@
 
 crbug.com/484632 css3/flexbox/stretch-input-in-column.html [ Failure ]
 
-crbug.com/619973 [ Linux ] fast/forms/select/listbox-appearance-basic.html [ NeedsRebaseline ]
-crbug.com/619973 [ Linux ] fast/forms/number/number-appearance-spinbutton-disabled-readonly.html [ NeedsRebaseline ]
-crbug.com/619973 [ Linux ] fast/forms/select/menulist-appearance-basic.html [ NeedsRebaseline ]
-
 # Note: this test was previously marked as slow on Debug builds. Skipping until crash is fixed
 crbug.com/619978 fast/css/giant-stylesheet-crash.html [ Skip ]
diff --git a/third_party/WebKit/LayoutTests/custom-elements/spec/insert-a-node-try-to-upgrade.html b/third_party/WebKit/LayoutTests/custom-elements/spec/insert-a-node-try-to-upgrade.html
new file mode 100644
index 0000000..bfc2cc2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/custom-elements/spec/insert-a-node-try-to-upgrade.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<title>Custom Elements: Insert a node should try to upgrade</title>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="resources/custom-elements-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// Insert a node
+// https://dom.spec.whatwg.org/#concept-node-insert
+// 6.5.2.2. try to upgrade inclusiveDescendant.
+// Try to upgrade an element
+// https://html.spec.whatwg.org/multipage/scripting.html#concept-try-upgrade
+test_with_window(w => {
+  let element = w.document.createElement('a-a');
+
+  w.customElements.define('a-a', class extends w.HTMLElement {
+    constructor() {
+      super();
+      this.is_upgraded = true;
+    }
+  });
+  assert_false('is_upgraded' in element);
+  assert_false(element.matches(':defined'));
+
+  w.document.body.appendChild(element);
+  assert_true(element.is_upgraded);
+  assert_true(element.matches(':defined'));
+}, 'Insert a node should try to upgrade');
+</script>
+</body>
diff --git a/third_party/WebKit/LayoutTests/fast/forms/select/menulist-emptify-option-expected.html b/third_party/WebKit/LayoutTests/fast/forms/select/menulist-emptify-option-expected.html
new file mode 100644
index 0000000..1f33f77
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/select/menulist-emptify-option-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<select>
+<option></option>
+</select>
diff --git a/third_party/WebKit/LayoutTests/fast/forms/select/menulist-emptify-option.html b/third_party/WebKit/LayoutTests/fast/forms/select/menulist-emptify-option.html
new file mode 100644
index 0000000..3aa512d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/select/menulist-emptify-option.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<select>
+<option id="opt">FAIL</option>
+</select>
+<script>
+testRunner.waitUntilDone();
+requestAnimationFrame(() => {
+  document.querySelector('#opt').textContent = '';
+  requestAnimationFrame(() => { testRunner.notifyDone(); });
+});
+</script>
diff --git a/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/disabled-worker.js b/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/disabled-worker.js
index 3599e2a2..57619855 100644
--- a/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/disabled-worker.js
+++ b/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/disabled-worker.js
@@ -5,4 +5,8 @@
     assert_not_exists(self.internals, 'frobulate');
     assert_equals(self.internals.frobulate, undefined);
   }, 'Attribute should not exist in worker');
+test(() => {
+    assert_not_exists(self.internals, 'FROBULATE_CONST');
+    assert_equals(self.internals.FROBULATE_CONST, undefined);
+  }, 'Constant should not exist in worker');
 done();
diff --git a/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/enabled-worker.js b/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/enabled-worker.js
index 198384e..fcf4733 100644
--- a/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/enabled-worker.js
+++ b/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/enabled-worker.js
@@ -5,4 +5,13 @@
     assert_idl_attribute(self.internals, 'frobulate');
     assert_true(self.internals.frobulate, 'Attribute should return boolean value');
   }, 'Attribute should exist and return value in worker');
+test(() => {
+    assert_idl_attribute(self.internals, 'FROBULATE_CONST');
+    assert_equals(self.internals.FROBULATE_CONST, 1, 'Constant should return integer value');
+  }, 'Constant should exist and return value in worker');
+test(() => {
+    assert_idl_attribute(self.internals, 'FROBULATE_CONST');
+    self.internals.FROBULATE_CONST = 10;
+    assert_equals(self.internals.FROBULATE_CONST, 1, 'Constant should not be modifiable');
+  }, 'Constant should exist and not be modifiable in worker');
 done();
diff --git a/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/origin_trials.js b/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/origin_trials.js
index a16f1f2..a5105dd 100644
--- a/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/origin_trials.js
+++ b/third_party/WebKit/LayoutTests/http/tests/origin_trials/resources/origin_trials.js
@@ -19,9 +19,17 @@
   }, {
     desc: 'Attribute should not exist, with trial disabled',
     code: () => {
+        assert_false('frobulateBindings' in window.internals);
         assert_not_exists(window.internals, 'frobulateBindings');
         assert_equals(window.internals['frobulateBindings'], undefined);
       }
+  }, {
+    desc: 'Constant should not exist, with trial disabled',
+    code: () => {
+        assert_false('FROBULATE_CONST' in window.internals);
+        assert_not_exists(window.internals, 'FROBULATE_CONST');
+        assert_equals(window.internals['FROBULATE_CONST'], undefined);
+      }
   }];
 
   fetch_tests_from_worker(new Worker('resources/disabled-worker.js'));
@@ -47,5 +55,16 @@
     assert_true(window.internals.frobulateBindings, 'Attribute should return boolean value');
   }, 'Attribute should exist and return value');
 
+test(() => {
+    assert_idl_attribute(window.internals, 'FROBULATE_CONST');
+    assert_equals(window.internals.FROBULATE_CONST, 1, 'Constant should return integer value');
+  }, 'Constant should exist and return value');
+
+test(() => {
+    assert_idl_attribute(window.internals, 'FROBULATE_CONST');
+    window.internals.FROBULATE_CONST = 10;
+    assert_equals(window.internals.FROBULATE_CONST, 1, 'Constant should not be modifiable');
+  }, 'Constant should exist and not be modifiable');
+
 fetch_tests_from_worker(new Worker('resources/enabled-worker.js'));
 };
diff --git a/third_party/WebKit/LayoutTests/media/track/media-element-enqueue-event-crash-expected.txt b/third_party/WebKit/LayoutTests/media/track/media-element-enqueue-event-crash-expected.txt
deleted file mode 100644
index 8fbc0510..0000000
--- a/third_party/WebKit/LayoutTests/media/track/media-element-enqueue-event-crash-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Tests that appending events for dispatching doesn't crash
-
-** No crash. Pass **
-
diff --git a/third_party/WebKit/LayoutTests/media/track/media-element-enqueue-event-crash.html b/third_party/WebKit/LayoutTests/media/track/media-element-enqueue-event-crash.html
index a7cea1f..561f98d 100644
--- a/third_party/WebKit/LayoutTests/media/track/media-element-enqueue-event-crash.html
+++ b/third_party/WebKit/LayoutTests/media/track/media-element-enqueue-event-crash.html
@@ -1,62 +1,43 @@
 <!DOCTYPE  html>
-<html>
-    <head>
-        <script src=../media-file.js></script>
-        <script src=../media-controls.js></script>
-        <!-- TODO(foolip): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../video-test.js></script>
+<title>Tests that appending events for dispatching doesn't crash.</title>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../../resources/gc.js"></script>
+<script src="../media-file.js"></script>
+<video autoplay>
+    <track src="captions-webvtt/captions-fast.vtt" default>
+</video>
+<script>
+async_test(function(t) {
+    if (localStorage.testRuns)
+        localStorage.testRuns = Number(localStorage.testRuns) + 1;
+    else {
+        localStorage.testRuns = 1;
+        localStorage.totalRuns = 5;
+    }
 
-        <script>
-        if (window.testRunner)
-        {
-            testRunner.dumpAsText();
-            testRunner.waitUntilDone();
-        }
+    document.querySelector("track").track.mode = "showing";
+    setTimeout(t.step_func(CFcrash), 100);
 
-        function startTest()
-        {
-            if (localStorage.testRuns)
-                localStorage.testRuns = Number(localStorage.testRuns) + 1;
-            else {
-                localStorage.testRuns = 1;
-                localStorage.totalRuns = 5;
-            }
+    function CFcrash() {
+        var video = document.querySelector("video");
+        video.src = findMediaFile("video", "content/test");
+        var document1 = document.implementation.createDocument("", null);
+        document1.appendChild(video);
+        delete document1;
 
-            document.getElementsByTagName('track')[0].track.mode = 'showing';
-            setTimeout(CFcrash, 100);
-        }
+        setTimeout(t.step_func(forceGC), 0);
+    }
 
-        function forceGC() {
-            gc();
+    function forceGC() {
+        gc();
 
-            // End the test only if it ran at least totalRuns.
-            if (window.testRunner && localStorage.testRuns == localStorage.totalRuns) {
-                consoleWrite("** No crash. Pass **");
-                testRunner.notifyDone();
-            } else
-                window.location.reload();
-        }
+        // End the test only if it ran totalRuns.
+        if (localStorage.testRuns == localStorage.totalRuns)
+            t.done();
+        else
+            location.reload();
+    }
 
-        function CFcrash()
-        {
-            document1 = document.implementation.createDocument("", null);
-            document1.appendChild(videoElement);
-            delete document1;
-
-            setTimeout(forceGC, 0);
-        }
-
-        document.addEventListener("DOMContentLoaded", startTest, false);
-        </script>
-    </head>
-
-    <body>
-        <p>Tests that appending events for dispatching doesn't crash</p>
-        <video autoplay id="videoElement">
-            <source src="../content/test.ogv">
-            <source src="../content/test.mp4">
-            <track src="captions-webvtt/captions-fast.vtt" default>
-        </video>
-    </body>
-</html>
+});
+</script>
\ No newline at end of file
diff --git a/third_party/WebKit/LayoutTests/media/track/track-cue-gc-wrapper-expected.txt b/third_party/WebKit/LayoutTests/media/track/track-cue-gc-wrapper-expected.txt
deleted file mode 100644
index 3ce1568e..0000000
--- a/third_party/WebKit/LayoutTests/media/track/track-cue-gc-wrapper-expected.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-Tests that added cue object wrappers live across garbage collections.
-
-EXPECTED (video.textTracks.hasOwnProperty('custom') == 'true') OK
-** Add a text track to the video element **
-EXPECTED (track.hasOwnProperty('custom') == 'true') OK
-** Add cues with own native property to the track with enter event listener. **
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-
-** Trigger a garbage collection. **
-EXPECTED (video.textTracks.hasOwnProperty('custom') == 'true') OK
-EXPECTED (track.hasOwnProperty('custom') == 'true') OK
-
-** Play the video and test cue wrappers. **
-RUN(video.play())
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-EXPECTED (cue.hasOwnProperty('custom') == 'true') OK
-END OF TEST
-
diff --git a/third_party/WebKit/LayoutTests/media/track/track-cue-gc-wrapper.html b/third_party/WebKit/LayoutTests/media/track/track-cue-gc-wrapper.html
index 0ff60be..96ed4cf 100644
--- a/third_party/WebKit/LayoutTests/media/track/track-cue-gc-wrapper.html
+++ b/third_party/WebKit/LayoutTests/media/track/track-cue-gc-wrapper.html
@@ -1,74 +1,55 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Tests that added cue object wrappers live across garbage collections.</title>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../media-file.js"></script>
+<video></video>
+<script>
+async_test(function(t) {
+    var cueIndex = 0;
+    var cueLimit = 10;
+    var video = document.querySelector("video");
+    video.src = findMediaFile("video", "../content/test");
 
-        <script src=../media-file.js></script>
-        <!-- TODO(foolip): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../video-test.js></script>
-        <script>
-        var cue;
-        var track;
-        var j = 0;
-        var cueLimit = 10;
+    video.textTracks.custom = "trackList";
+    assert_true(video.textTracks.hasOwnProperty("custom"));
 
-        function checkNativeProperty()
-        {
-            cue = this;
-            testExpected("cue.hasOwnProperty('custom')", true);
-            if (++j >= cueLimit)
-                endTest();
-        }
+    // Add a text track to the video element.
+    var track = video.addTextTrack("captions", "regular captions track", "en");
+    track.custom = "track";
+    assert_true(track.hasOwnProperty("custom"));
 
-        function startTest()
-        {
-            findMediaElement();
-            video.src = findMediaFile('video', '../content/test');
+    // Add cues with own native property to the track with enter event listener.
+    for (var i = 0; i < cueLimit; i++) {
+        var cue = new VTTCue(i / 4, i / 2 + 1, "Label" + i);
+        cue.custom = "cue";
 
-            video.textTracks.custom = "trackList";
-            testExpected("video.textTracks.hasOwnProperty('custom')", true);
+        cue.onenter = t.step_func(function(event) {
+            var currentCue = event.target;
+            assert_true(currentCue.hasOwnProperty("custom"));
+            if (++cueIndex == cueLimit)
+                t.done();
+        });
 
-            consoleWrite("** Add a text track to the video element **");
+        track.addCue(cue);
+    }
 
-            track = video.addTextTrack("captions", "regular captions track", "en");
-            track.custom = "track";
-            testExpected("track.hasOwnProperty('custom')", true);
+    for (var i = 0; i < cueLimit; i++) {
+        var cue = track.cues[i];
+        assert_true(cue.hasOwnProperty("custom"));
+    }
 
-            consoleWrite("** Add cues with own native property to the track with enter event listener. **");
-            for (var i = 0; i < cueLimit; i++) {
-                var c = new VTTCue(i / 4, i / 2 + 1, "Label" + i);
-                c.custom = "cue";
-                c.addEventListener("enter", checkNativeProperty);
-                track.addCue(c);
-                c = null;
-            }
-            for (var i = 0; i < 10; i++) {
-                cue = track.cues[i];
-                testExpected("cue.hasOwnProperty('custom')", true);
-            }
+    // Trigger a garbage collection.
+    track = null;
+    gc();
 
-            consoleWrite("");
-            consoleWrite("** Trigger a garbage collection.  **");
-            track = null;
-            cue = null;
-            gc();
+    assert_true(video.textTracks.hasOwnProperty("custom"));
 
-            testExpected("video.textTracks.hasOwnProperty('custom')", true);
+    track = video.textTracks[0];
+    assert_true(track.hasOwnProperty("custom"));
 
-            track = video.textTracks[0];
-            testExpected("track.hasOwnProperty('custom')", true);
-
-            consoleWrite("");
-            consoleWrite("** Play the video and test cue wrappers.  **");
-            run("video.play()");
-            track.mode = "showing";
-        }
-        </script>
-    </head>
-
-    <body onload="startTest()">
-        <p>Tests that added cue object wrappers live across garbage collections.</p>
-        <video controls />
-    </body>
-</html>
+    // Play the video and test cue wrappers.
+    video.play();
+    track.mode = "showing";
+});
+</script>
\ No newline at end of file
diff --git a/third_party/WebKit/LayoutTests/media/track/track-remove-quickly-expected.txt b/third_party/WebKit/LayoutTests/media/track/track-remove-quickly-expected.txt
deleted file mode 100644
index d261a832..0000000
--- a/third_party/WebKit/LayoutTests/media/track/track-remove-quickly-expected.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-This test that removing a track element before it has been processed doesn't crash (https://bugs.webkit.org/show_bug.cgi?id=85095).
-If this test does not crash, it passes.
-
-END OF TEST
-
diff --git a/third_party/WebKit/LayoutTests/media/track/track-remove-quickly.html b/third_party/WebKit/LayoutTests/media/track/track-remove-quickly.html
index 2712279e..8649029 100644
--- a/third_party/WebKit/LayoutTests/media/track/track-remove-quickly.html
+++ b/third_party/WebKit/LayoutTests/media/track/track-remove-quickly.html
@@ -1,23 +1,13 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <script src=../media-file.js></script>
-        <!-- TODO(foolip): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../video-test.js></script>
-    </head>
-    <body>
-        <div id=video_container></div>
-        <script>
-            var mediaFile = findMediaFile("video", "../content/test");
-            document.getElementById('video_container').innerHTML = "<video src='" + mediaFile + "' controls ><track kind='captions' src='captions-webvtt/simple-captions.vtt' default ></video>";
-        </script>
-        <div>
-            This test that removing a track element before it has been processed doesn't crash (https://bugs.webkit.org/show_bug.cgi?id=85095).
-            <p>If this test does not crash, it passes.</p>
-        </div>
-        <script>
-            endTest();
-        </script>
-    </body>
-</html>
+<title>This test that removing a track element before it has been processed doesn't crash (https://bugs.webkit.org/show_bug.cgi?id=85095).</title>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../media-file.js"></script>
+<div id="video_container"></div>
+<script>
+var mediaFile = findMediaFile("video", "../content/test");
+document.getElementById("video_container").innerHTML = "<video src='" + mediaFile + "' controls ><track kind='captions' src='captions-webvtt/simple-captions.vtt' default ></video>";
+test(function() {
+// Test passes if it doesn't crash.
+});
+</script>
\ No newline at end of file
diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.png b/third_party/WebKit/LayoutTests/platform/android/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.png
deleted file mode 100644
index dcd9cea..0000000
--- a/third_party/WebKit/LayoutTests/platform/android/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.png
index 0fc4601..dcd9cea 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/listbox-appearance-basic-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/listbox-appearance-basic-expected.png
index 2f199d6..bf83ba1b 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/listbox-appearance-basic-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/listbox-appearance-basic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/menulist-appearance-basic-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/menulist-appearance-basic-expected.png
index 0ae95ab..85df8f83 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/menulist-appearance-basic-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/select/menulist-appearance-basic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/fast/images/drag-image-expected.png b/third_party/WebKit/LayoutTests/platform/win7/fast/images/drag-image-expected.png
deleted file mode 100644
index 3931dfb7..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/fast/images/drag-image-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/fast/images/paint-subrect-grid-expected.png b/third_party/WebKit/LayoutTests/platform/win7/fast/images/paint-subrect-grid-expected.png
deleted file mode 100644
index 7bd4e38..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/fast/images/paint-subrect-grid-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/fast/images/png-color-profile-ignore-gamma-expected.png b/third_party/WebKit/LayoutTests/platform/win7/fast/images/png-color-profile-ignore-gamma-expected.png
deleted file mode 100644
index 4259fb2..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/fast/images/png-color-profile-ignore-gamma-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/fast/images/png-suite/test-expected.png b/third_party/WebKit/LayoutTests/platform/win7/fast/images/png-suite/test-expected.png
deleted file mode 100644
index 2f1b6d0..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/fast/images/png-suite/test-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/fast/images/repaint-subrect-grid-expected.png b/third_party/WebKit/LayoutTests/platform/win7/fast/images/repaint-subrect-grid-expected.png
deleted file mode 100644
index f2891bb..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/fast/images/repaint-subrect-grid-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/W3C-SVG-1.1/filters-blend-01-b-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/W3C-SVG-1.1/filters-blend-01-b-expected.png
deleted file mode 100644
index 86874d8..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/W3C-SVG-1.1/filters-blend-01-b-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/W3C-SVG-1.1/masking-path-04-b-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/W3C-SVG-1.1/masking-path-04-b-expected.png
index 1cb5517..12c5134 100644
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/W3C-SVG-1.1/masking-path-04-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win7/svg/W3C-SVG-1.1/masking-path-04-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-in-attr-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-in-attr-expected.png
deleted file mode 100644
index 3f16781..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-in-attr-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-in2-attr-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-in2-attr-expected.png
deleted file mode 100644
index 3f16781..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-in2-attr-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-mode-attr-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-mode-attr-expected.png
deleted file mode 100644
index 3f16781..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-dom-mode-attr-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-in-prop-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-in-prop-expected.png
deleted file mode 100644
index 3f16781..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-in-prop-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-in2-prop-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-in2-prop-expected.png
deleted file mode 100644
index 3f16781..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-in2-prop-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-mode-prop-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-mode-prop-expected.png
deleted file mode 100644
index 3f16781..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/dynamic-updates/SVGFEBlendElement-svgdom-mode-prop-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/drag-image-expected.png b/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/drag-image-expected.png
deleted file mode 100644
index 3931dfb7..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/drag-image-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/paint-subrect-grid-expected.png b/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/paint-subrect-grid-expected.png
deleted file mode 100644
index e489f9a..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/paint-subrect-grid-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/png-color-profile-ignore-gamma-expected.png b/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/png-color-profile-ignore-gamma-expected.png
deleted file mode 100644
index 4259fb2..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/png-color-profile-ignore-gamma-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/png-suite/test-expected.png b/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/png-suite/test-expected.png
deleted file mode 100644
index 4628512..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/png-suite/test-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/repaint-subrect-grid-expected.png b/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/repaint-subrect-grid-expected.png
deleted file mode 100644
index b5875a42..0000000
--- a/third_party/WebKit/LayoutTests/platform/win7/virtual/gpu-rasterization/fast/images/repaint-subrect-grid-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/PerformanceTests/DOM/select-single-remove.html b/third_party/WebKit/PerformanceTests/DOM/select-single-remove.html
new file mode 100644
index 0000000..5fb13d7
--- /dev/null
+++ b/third_party/WebKit/PerformanceTests/DOM/select-single-remove.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<body>
+<script src="../resources/runner.js"></script>
+<select id="container"></select>
+<script>
+var container = document.getElementById('container');
+var nodes = [];
+var childCount = 1000;
+for (var i = 0; i < childCount; ++i) {
+    var option = document.createElement('option');
+    option.textContent = i;
+    nodes.push(option);
+}
+
+PerfTestRunner.measureRunsPerSecond({
+    description: 'Measures performance of removing option elements from a single-selection select element.',
+
+    run: () => {
+        for (var i = 0; i < childCount; ++i)
+            container.appendChild(nodes[i]);
+        container.offsetLeft;
+        for (var i = 0; i < childCount; ++i)
+            container.removeChild(nodes[i]);
+    }
+});
+</script>
+</body>
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
index 75998cd4..ba669b9 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
@@ -166,11 +166,8 @@
     }
 }
 
-void installConstantInternal(v8::Isolate* isolate, v8::Local<v8::FunctionTemplate> interfaceTemplate, v8::Local<v8::ObjectTemplate> prototypeTemplate, const V8DOMConfiguration::ConstantConfiguration& constant)
+v8::Local<v8::Primitive> valueForConstant(v8::Isolate* isolate, const V8DOMConfiguration::ConstantConfiguration& constant)
 {
-    v8::Local<v8::String> constantName = v8AtomicString(isolate, constant.name);
-    v8::PropertyAttribute attributes =
-        static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete);
     v8::Local<v8::Primitive> value;
     switch (constant.type) {
     case V8DOMConfiguration::ConstantTypeShort:
@@ -188,10 +185,30 @@
     default:
         NOTREACHED();
     }
+    return value;
+}
+
+void installConstantInternal(v8::Isolate* isolate, v8::Local<v8::FunctionTemplate> interfaceTemplate, v8::Local<v8::ObjectTemplate> prototypeTemplate, const V8DOMConfiguration::ConstantConfiguration& constant)
+{
+    v8::Local<v8::String> constantName = v8AtomicString(isolate, constant.name);
+    v8::PropertyAttribute attributes =
+        static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete);
+    v8::Local<v8::Primitive> value = valueForConstant(isolate, constant);
     interfaceTemplate->Set(constantName, value, attributes);
     prototypeTemplate->Set(constantName, value, attributes);
 }
 
+void installConstantInternal(v8::Isolate* isolate, v8::Local<v8::Function> interface, v8::Local<v8::Object> prototype, const V8DOMConfiguration::ConstantConfiguration& constant)
+{
+    v8::Local<v8::Context> context = isolate->GetCurrentContext();
+    v8::Local<v8::Name> name = v8AtomicString(isolate, constant.name);
+    v8::PropertyAttribute attributes =
+        static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete);
+    v8::Local<v8::Primitive> value = valueForConstant(isolate, constant);
+    v8CallOrCrash(interface->DefineOwnProperty(context, name, value, attributes));
+    v8CallOrCrash(prototype->DefineOwnProperty(context, name, value, attributes));
+}
+
 template<class Configuration>
 void installMethodInternal(v8::Isolate* isolate, v8::Local<v8::ObjectTemplate> instanceTemplate, v8::Local<v8::ObjectTemplate> prototypeTemplate, v8::Local<v8::FunctionTemplate> interfaceTemplate, v8::Local<v8::Signature> signature, const Configuration& method, const DOMWrapperWorld& world)
 {
@@ -298,6 +315,11 @@
     installConstantInternal(isolate, interfaceTemplate, prototypeTemplate, constant);
 }
 
+void V8DOMConfiguration::installConstant(v8::Isolate* isolate, v8::Local<v8::Function> interface, v8::Local<v8::Object> prototype, const ConstantConfiguration& constant)
+{
+    installConstantInternal(isolate, interface, prototype, constant);
+}
+
 void V8DOMConfiguration::installConstantWithGetter(v8::Isolate* isolate, v8::Local<v8::FunctionTemplate> interfaceTemplate, v8::Local<v8::ObjectTemplate> prototypeTemplate, const char* name, v8::AccessorNameGetterCallback getter)
 {
     v8::Local<v8::String> constantName = v8AtomicString(isolate, name);
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h
index ce307f51..6630e112 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h
+++ b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h
@@ -143,6 +143,8 @@
 
     static void installConstant(v8::Isolate*, v8::Local<v8::FunctionTemplate> interfaceTemplate, v8::Local<v8::ObjectTemplate> prototypeTemplate, const ConstantConfiguration&);
 
+    static void installConstant(v8::Isolate*, v8::Local<v8::Function> interface, v8::Local<v8::Object> prototype, const ConstantConfiguration&);
+
     static void installConstantWithGetter(v8::Isolate*, v8::Local<v8::FunctionTemplate> interfaceTemplate, v8::Local<v8::ObjectTemplate> prototypeTemplate, const char* name, v8::AccessorNameGetterCallback);
 
     // MethodConfiguration translates into calls to Set() for setting up an
diff --git a/third_party/WebKit/Source/bindings/scripts/code_generator_v8.py b/third_party/WebKit/Source/bindings/scripts/code_generator_v8.py
index 4829560c..b766670 100644
--- a/third_party/WebKit/Source/bindings/scripts/code_generator_v8.py
+++ b/third_party/WebKit/Source/bindings/scripts/code_generator_v8.py
@@ -82,7 +82,7 @@
 import v8_interface
 import v8_types
 import v8_union
-from v8_utilities import capitalize, cpp_name, unique_by
+from v8_utilities import capitalize, cpp_name, for_origin_trial_feature, unique_by
 from utilities import idl_filename_to_component, is_valid_component_dependency, is_testing_target, shorten_union_name
 
 
@@ -425,6 +425,7 @@
     jinja_env.filters.update({
         'blink_capitalize': capitalize,
         'exposed': exposed_if,
+        'for_origin_trial_feature': for_origin_trial_feature,
         'runtime_enabled': runtime_enabled_if,
         'unique_by': unique_by,
         })
diff --git a/third_party/WebKit/Source/bindings/scripts/v8_attributes.py b/third_party/WebKit/Source/bindings/scripts/v8_attributes.py
index d50bf3f..2b1a8c9 100644
--- a/third_party/WebKit/Source/bindings/scripts/v8_attributes.py
+++ b/third_party/WebKit/Source/bindings/scripts/v8_attributes.py
@@ -226,8 +226,7 @@
     return {'has_accessor_configuration': filter_has_accessor_configuration,
             'has_attribute_configuration': filter_has_attribute_configuration,
             'origin_trial_enabled_attributes': filter_origin_trial_enabled,
-            'runtime_enabled_attributes': filter_runtime_enabled,
-            }
+            'runtime_enabled_attributes': filter_runtime_enabled}
 
 
 ################################################################################
diff --git a/third_party/WebKit/Source/bindings/scripts/v8_interface.py b/third_party/WebKit/Source/bindings/scripts/v8_interface.py
index 7335888..bdcaef5 100644
--- a/third_party/WebKit/Source/bindings/scripts/v8_interface.py
+++ b/third_party/WebKit/Source/bindings/scripts/v8_interface.py
@@ -78,8 +78,7 @@
 def filter_has_special_getter(constants):
     return [constant for constant in constants if
             constant['measure_as'] or
-            constant['deprecate_as'] or
-            constant['origin_trial_enabled_function']]
+            constant['deprecate_as']]
 
 
 def filter_runtime_enabled(constants):
@@ -87,10 +86,29 @@
             constant['runtime_enabled_function']]
 
 
+def filter_origin_trial_enabled(constants):
+    return [constant for constant in constants if
+            constant['origin_trial_feature_name']]
+
+
 def constant_filters():
     return {'has_constant_configuration': filter_has_constant_configuration,
             'has_special_getter': filter_has_special_getter,
-            'runtime_enabled_constants': filter_runtime_enabled}
+            'runtime_enabled_constants': filter_runtime_enabled,
+            'origin_trial_enabled_constants': filter_origin_trial_enabled}
+
+
+def origin_trial_feature_names(constants, attributes):
+    """ Returns a list of the names of each origin trial feature used in this interface.
+
+    This list is the union of the sets of names used for constants and attributes.
+    """
+
+    feature_names = set(
+        [constant['origin_trial_feature_name'] for constant in constants if constant['origin_trial_feature_name']] +
+        [attribute['origin_trial_feature_name'] for attribute in attributes if attribute['origin_trial_feature_name']]
+    )
+    return sorted(feature_names)
 
 
 def interface_context(interface):
@@ -586,6 +604,10 @@
         'has_named_properties_object': is_global and context['named_property_getter'],
     })
 
+    # Origin Trials
+    context.update({
+        'origin_trial_feature_names': origin_trial_feature_names(context['constants'], context['attributes']),
+    })
     return context
 
 
diff --git a/third_party/WebKit/Source/bindings/scripts/v8_utilities.py b/third_party/WebKit/Source/bindings/scripts/v8_utilities.py
index a48586d9..7220c39 100644
--- a/third_party/WebKit/Source/bindings/scripts/v8_utilities.py
+++ b/third_party/WebKit/Source/bindings/scripts/v8_utilities.py
@@ -123,6 +123,13 @@
     return filtered_list
 
 
+def for_origin_trial_feature(items, feature_name):
+    """Filters the list of attributes or constants, and returns those defined for the named origin trial feature."""
+    return [item for item in items if
+            item['origin_trial_feature_name'] == feature_name and
+            not item.get('exposed_test')]
+
+
 ################################################################################
 # C++
 ################################################################################
diff --git a/third_party/WebKit/Source/bindings/templates/constants.cpp b/third_party/WebKit/Source/bindings/templates/constants.cpp
index 1d7d1c1..c4d8e925 100644
--- a/third_party/WebKit/Source/bindings/templates/constants.cpp
+++ b/third_party/WebKit/Source/bindings/templates/constants.cpp
@@ -40,7 +40,7 @@
 {% endfor %}
 {% endfilter %}
 {% endfor %}
-{# Constants with [DeprecateAs] or [MeasureAs] or [OriginTrialEnabled] #}
+{# Constants with [DeprecateAs] or [MeasureAs] #}
 {% for constant in constants | has_special_getter %}
 V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "{{constant.name}}", {{cpp_class}}V8Internal::{{constant.name}}ConstantGetterCallback);
 {% endfor %}
diff --git a/third_party/WebKit/Source/bindings/templates/interface.h b/third_party/WebKit/Source/bindings/templates/interface.h
index a822c755..72df2c39 100644
--- a/third_party/WebKit/Source/bindings/templates/interface.h
+++ b/third_party/WebKit/Source/bindings/templates/interface.h
@@ -168,8 +168,8 @@
     {{exported}}static void register{{method.name | blink_capitalize}}MethodForPartialInterface(void (*)(const v8::FunctionCallbackInfo<v8::Value>&));
     {% endfor %}
     {% endif %}
-    {% for group in attributes|origin_trial_enabled_attributes|groupby('origin_trial_feature_name') %}{{newline}}
-    static void install{{group.grouper}}(ScriptState*, v8::Local<v8::Object> instance);
+    {% for origin_trial_feature_name in origin_trial_feature_names %}{{newline}}
+    static void install{{origin_trial_feature_name}}(ScriptState*, v8::Local<v8::Object> instance);
     {% endfor %}
     {% if has_partial_interface %}
 
diff --git a/third_party/WebKit/Source/bindings/templates/interface_base.cpp b/third_party/WebKit/Source/bindings/templates/interface_base.cpp
index 7e559ae4..3667d4dc 100644
--- a/third_party/WebKit/Source/bindings/templates/interface_base.cpp
+++ b/third_party/WebKit/Source/bindings/templates/interface_base.cpp
@@ -365,13 +365,18 @@
 {##############################################################################}
 {% block origin_trials %}
 {% from 'attributes.cpp' import attribute_configuration with context %}
-{% for group in attributes|origin_trial_enabled_attributes|groupby('origin_trial_feature_name') %}{{newline}}
-void {{v8_class_or_partial}}::install{{group.grouper}}(ScriptState* scriptState, v8::Local<v8::Object> instance)
+{% from 'constants.cpp' import constant_configuration with context %}
+{% for origin_trial_feature_name in origin_trial_feature_names %}{{newline}}
+void {{v8_class_or_partial}}::install{{origin_trial_feature_name}}(ScriptState* scriptState, v8::Local<v8::Object> instance)
 {
     v8::Local<v8::Object> prototype = instance->GetPrototype()->ToObject(scriptState->isolate());
-    v8::Local<v8::Signature> signature;
+    {# Origin-Trial-enabled attributes #}
+    {% if attributes | for_origin_trial_feature(origin_trial_feature_name) %}
+    V8PerIsolateData* perIsolateData = V8PerIsolateData::from(scriptState->isolate());
+    v8::Local<v8::FunctionTemplate> interfaceTemplate = perIsolateData->findInterfaceTemplate(scriptState->world(), &{{v8_class}}::wrapperTypeInfo);
+    v8::Local<v8::Signature> signature = v8::Signature::New(scriptState->isolate(), interfaceTemplate);
     ALLOW_UNUSED_LOCAL(signature);
-    {% for attribute in group.list | unique_by('name') | sort %}
+    {% for attribute in attributes | for_origin_trial_feature(origin_trial_feature_name) | unique_by('name') | sort %}
     {% if attribute.is_data_type_property %}
     const V8DOMConfiguration::AttributeConfiguration attribute{{attribute.name}}Configuration = \
         {{attribute_configuration(attribute)}};
@@ -382,6 +387,18 @@
     V8DOMConfiguration::installAccessor(scriptState->isolate(), scriptState->world(), instance, prototype, v8::Local<v8::Function>(), signature, accessor{{attribute.name}}Configuration);
     {% endif %}
     {% endfor %}
+    {% endif %}
+
+    {# Origin-Trial-enabled constants #}
+    {% if constants | for_origin_trial_feature(origin_trial_feature_name) %}
+    V8PerContextData* perContextData = V8PerContextData::from(scriptState->context());
+    v8::Local<v8::Function> interface = perContextData->constructorForType(&{{v8_class}}::wrapperTypeInfo);
+    {% for constant in constants | for_origin_trial_feature(origin_trial_feature_name) | unique_by('name') | sort %}
+    {% set constant_name = constant.name.title().replace('_', '') %}
+    const V8DOMConfiguration::ConstantConfiguration constant{{constant_name}}Configuration = {{constant_configuration(constant)}};
+    V8DOMConfiguration::installConstant(scriptState->isolate(), interface, prototype, constant{{constant_name}}Configuration);
+    {% endfor %}
+    {% endif %}
 }
 {% endfor %}
 {% endblock %}
diff --git a/third_party/WebKit/Source/bindings/templates/partial_interface.h b/third_party/WebKit/Source/bindings/templates/partial_interface.h
index 512cf62..cfe9776 100644
--- a/third_party/WebKit/Source/bindings/templates/partial_interface.h
+++ b/third_party/WebKit/Source/bindings/templates/partial_interface.h
@@ -28,8 +28,8 @@
     {% endfor %}
     {# Custom internal fields #}
     static void preparePrototypeAndInterfaceObject(v8::Local<v8::Context>, const DOMWrapperWorld&, v8::Local<v8::Object>, v8::Local<v8::Function>, v8::Local<v8::FunctionTemplate>);
-    {% for group in attributes|origin_trial_enabled_attributes|groupby('origin_trial_feature_name') %}{{newline}}
-    static void install{{group.grouper}}(ScriptState*, v8::Local<v8::Object> instance);
+    {% for origin_trial_feature_name in origin_trial_feature_names %}{{newline}}
+    static void install{{origin_trial_feature_name}}(ScriptState*, v8::Local<v8::Object> instance);
     {% endfor %}
 private:
     static void install{{v8_class}}Template(v8::Isolate*, const DOMWrapperWorld&, v8::Local<v8::FunctionTemplate> interfaceTemplate);
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp b/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp
index 9748a0e..a702266 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp
+++ b/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp
@@ -113,31 +113,6 @@
     v8SetReturnValueInt(info, 1);
 }
 
-static void FEATURE1_ORIGIN_TRIAL_ENABLED_CONST1ConstantGetterCallback(v8::Local<v8::Name>, const v8::PropertyCallbackInfo<v8::Value>& info)
-{
-    v8SetReturnValueInt(info, 1);
-}
-
-static void FEATURE1_ORIGIN_TRIAL_ENABLED_CONST2ConstantGetterCallback(v8::Local<v8::Name>, const v8::PropertyCallbackInfo<v8::Value>& info)
-{
-    v8SetReturnValueInt(info, 2);
-}
-
-static void FEATURE2_ORIGIN_TRIAL_ENABLED_CONST1ConstantGetterCallback(v8::Local<v8::Name>, const v8::PropertyCallbackInfo<v8::Value>& info)
-{
-    v8SetReturnValueInt(info, 3);
-}
-
-static void FEATURE2_ORIGIN_TRIAL_ENABLED_CONST2ConstantGetterCallback(v8::Local<v8::Name>, const v8::PropertyCallbackInfo<v8::Value>& info)
-{
-    v8SetReturnValueInt(info, 4);
-}
-
-static void FEATURE3_ORIGIN_TRIAL_ENABLED_CONST1ConstantGetterCallback(v8::Local<v8::Name>, const v8::PropertyCallbackInfo<v8::Value>& info)
-{
-    v8SetReturnValueInt(info, 5);
-}
-
 static void stringifierAttributeAttributeGetter(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Local<v8::Object> holder = info.Holder();
@@ -11862,11 +11837,6 @@
     }
     V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "DEPRECATED_CONSTANT", TestObjectV8Internal::DEPRECATED_CONSTANTConstantGetterCallback);
     V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "MEASURED_CONSTANT", TestObjectV8Internal::MEASURED_CONSTANTConstantGetterCallback);
-    V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "FEATURE1_ORIGIN_TRIAL_ENABLED_CONST1", TestObjectV8Internal::FEATURE1_ORIGIN_TRIAL_ENABLED_CONST1ConstantGetterCallback);
-    V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "FEATURE1_ORIGIN_TRIAL_ENABLED_CONST2", TestObjectV8Internal::FEATURE1_ORIGIN_TRIAL_ENABLED_CONST2ConstantGetterCallback);
-    V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "FEATURE2_ORIGIN_TRIAL_ENABLED_CONST1", TestObjectV8Internal::FEATURE2_ORIGIN_TRIAL_ENABLED_CONST1ConstantGetterCallback);
-    V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "FEATURE2_ORIGIN_TRIAL_ENABLED_CONST2", TestObjectV8Internal::FEATURE2_ORIGIN_TRIAL_ENABLED_CONST2ConstantGetterCallback);
-    V8DOMConfiguration::installConstantWithGetter(isolate, interfaceTemplate, prototypeTemplate, "FEATURE3_ORIGIN_TRIAL_ENABLED_CONST1", TestObjectV8Internal::FEATURE3_ORIGIN_TRIAL_ENABLED_CONST1ConstantGetterCallback);
     static_assert(0 == TestObject::CONST_VALUE_0, "the value of TestObject_CONST_VALUE_0 does not match with implementation");
     static_assert(1 == TestObject::CONST_VALUE_1, "the value of TestObject_CONST_VALUE_1 does not match with implementation");
     static_assert(2 == TestObject::CONST_VALUE_2, "the value of TestObject_CONST_VALUE_2 does not match with implementation");
@@ -11942,7 +11912,9 @@
 void V8TestObject::installFeatureName(ScriptState* scriptState, v8::Local<v8::Object> instance)
 {
     v8::Local<v8::Object> prototype = instance->GetPrototype()->ToObject(scriptState->isolate());
-    v8::Local<v8::Signature> signature;
+    V8PerIsolateData* perIsolateData = V8PerIsolateData::from(scriptState->isolate());
+    v8::Local<v8::FunctionTemplate> interfaceTemplate = perIsolateData->findInterfaceTemplate(scriptState->world(), &V8TestObject::wrapperTypeInfo);
+    v8::Local<v8::Signature> signature = v8::Signature::New(scriptState->isolate(), interfaceTemplate);
     ALLOW_UNUSED_LOCAL(signature);
     const V8DOMConfiguration::AccessorConfiguration accessororiginTrialEnabledLongAttributeConfiguration = \
         {"originTrialEnabledLongAttribute", TestObjectV8Internal::originTrialEnabledLongAttributeAttributeGetterCallback, TestObjectV8Internal::originTrialEnabledLongAttributeAttributeSetterCallback, 0, 0, 0, v8::DEFAULT, static_cast<v8::PropertyAttribute>(v8::None), V8DOMConfiguration::ExposedToAllScripts, V8DOMConfiguration::OnPrototype, V8DOMConfiguration::CheckHolder};
@@ -11950,6 +11922,41 @@
     const V8DOMConfiguration::AccessorConfiguration accessorunscopeableOriginTrialEnabledLongAttributeConfiguration = \
         {"unscopeableOriginTrialEnabledLongAttribute", TestObjectV8Internal::unscopeableOriginTrialEnabledLongAttributeAttributeGetterCallback, TestObjectV8Internal::unscopeableOriginTrialEnabledLongAttributeAttributeSetterCallback, 0, 0, 0, v8::DEFAULT, static_cast<v8::PropertyAttribute>(v8::None), V8DOMConfiguration::ExposedToAllScripts, V8DOMConfiguration::OnPrototype, V8DOMConfiguration::CheckHolder};
     V8DOMConfiguration::installAccessor(scriptState->isolate(), scriptState->world(), instance, prototype, v8::Local<v8::Function>(), signature, accessorunscopeableOriginTrialEnabledLongAttributeConfiguration);
+
+}
+
+void V8TestObject::installFeatureName1(ScriptState* scriptState, v8::Local<v8::Object> instance)
+{
+    v8::Local<v8::Object> prototype = instance->GetPrototype()->ToObject(scriptState->isolate());
+
+    V8PerContextData* perContextData = V8PerContextData::from(scriptState->context());
+    v8::Local<v8::Function> interface = perContextData->constructorForType(&V8TestObject::wrapperTypeInfo);
+    const V8DOMConfiguration::ConstantConfiguration constantFeature1OriginTrialEnabledConst1Configuration = {"FEATURE1_ORIGIN_TRIAL_ENABLED_CONST1", 1, 0, V8DOMConfiguration::ConstantTypeShort};
+    V8DOMConfiguration::installConstant(scriptState->isolate(), interface, prototype, constantFeature1OriginTrialEnabledConst1Configuration);
+    const V8DOMConfiguration::ConstantConfiguration constantFeature1OriginTrialEnabledConst2Configuration = {"FEATURE1_ORIGIN_TRIAL_ENABLED_CONST2", 2, 0, V8DOMConfiguration::ConstantTypeShort};
+    V8DOMConfiguration::installConstant(scriptState->isolate(), interface, prototype, constantFeature1OriginTrialEnabledConst2Configuration);
+}
+
+void V8TestObject::installFeatureName2(ScriptState* scriptState, v8::Local<v8::Object> instance)
+{
+    v8::Local<v8::Object> prototype = instance->GetPrototype()->ToObject(scriptState->isolate());
+
+    V8PerContextData* perContextData = V8PerContextData::from(scriptState->context());
+    v8::Local<v8::Function> interface = perContextData->constructorForType(&V8TestObject::wrapperTypeInfo);
+    const V8DOMConfiguration::ConstantConfiguration constantFeature2OriginTrialEnabledConst1Configuration = {"FEATURE2_ORIGIN_TRIAL_ENABLED_CONST1", 3, 0, V8DOMConfiguration::ConstantTypeShort};
+    V8DOMConfiguration::installConstant(scriptState->isolate(), interface, prototype, constantFeature2OriginTrialEnabledConst1Configuration);
+    const V8DOMConfiguration::ConstantConfiguration constantFeature2OriginTrialEnabledConst2Configuration = {"FEATURE2_ORIGIN_TRIAL_ENABLED_CONST2", 4, 0, V8DOMConfiguration::ConstantTypeShort};
+    V8DOMConfiguration::installConstant(scriptState->isolate(), interface, prototype, constantFeature2OriginTrialEnabledConst2Configuration);
+}
+
+void V8TestObject::installFeatureName3(ScriptState* scriptState, v8::Local<v8::Object> instance)
+{
+    v8::Local<v8::Object> prototype = instance->GetPrototype()->ToObject(scriptState->isolate());
+
+    V8PerContextData* perContextData = V8PerContextData::from(scriptState->context());
+    v8::Local<v8::Function> interface = perContextData->constructorForType(&V8TestObject::wrapperTypeInfo);
+    const V8DOMConfiguration::ConstantConfiguration constantFeature3OriginTrialEnabledConst1Configuration = {"FEATURE3_ORIGIN_TRIAL_ENABLED_CONST1", 5, 0, V8DOMConfiguration::ConstantTypeShort};
+    V8DOMConfiguration::installConstant(scriptState->isolate(), interface, prototype, constantFeature3OriginTrialEnabledConst1Configuration);
 }
 v8::Local<v8::FunctionTemplate> V8TestObject::domTemplate(v8::Isolate* isolate, const DOMWrapperWorld& world)
 {
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.h b/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.h
index d4fd62da4..27d9ae1 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.h
@@ -89,6 +89,12 @@
     CORE_EXPORT static void preparePrototypeAndInterfaceObject(v8::Local<v8::Context>, const DOMWrapperWorld&, v8::Local<v8::Object> prototypeObject, v8::Local<v8::Function> interfaceObject, v8::Local<v8::FunctionTemplate> interfaceTemplate);
 
     static void installFeatureName(ScriptState*, v8::Local<v8::Object> instance);
+
+    static void installFeatureName1(ScriptState*, v8::Local<v8::Object> instance);
+
+    static void installFeatureName2(ScriptState*, v8::Local<v8::Object> instance);
+
+    static void installFeatureName3(ScriptState*, v8::Local<v8::Object> instance);
 };
 
 template <>
diff --git a/third_party/WebKit/Source/core/dom/Element.cpp b/third_party/WebKit/Source/core/dom/Element.cpp
index 6da31da..6efc5c6 100644
--- a/third_party/WebKit/Source/core/dom/Element.cpp
+++ b/third_party/WebKit/Source/core/dom/Element.cpp
@@ -1424,14 +1424,12 @@
     }
 
     if (inShadowIncludingDocument()) {
-        if (getCustomElementState() == CustomElementState::Custom) {
+        if (getCustomElementState() == CustomElementState::Custom)
             CustomElement::enqueueConnectedCallback(this);
-        } else if (isUpgradedV0CustomElement()) {
+        else if (isUpgradedV0CustomElement())
             V0CustomElement::didAttach(this, document());
-        } else if (getCustomElementState() == CustomElementState::Undefined) {
-            if (CustomElementsRegistry* registry = CustomElement::registry(*this))
-                registry->addCandidate(this);
-        }
+        else if (getCustomElementState() == CustomElementState::Undefined)
+            CustomElement::tryToUpgrade(this);
     }
 
     TreeScope& scope = insertionPoint->treeScope();
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
index f2d27d9..9a25fae 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
@@ -186,4 +186,20 @@
         definition->enqueueAttributeChangedCallback(element, name, oldValue, newValue);
 }
 
+void CustomElement::tryToUpgrade(Element* element)
+{
+    // Try to upgrade an element
+    // https://html.spec.whatwg.org/multipage/scripting.html#concept-try-upgrade
+
+    DCHECK_EQ(element->getCustomElementState(), CustomElementState::Undefined);
+
+    CustomElementsRegistry* registry = CustomElement::registry(*element);
+    if (!registry)
+        return;
+    if (CustomElementDefinition* definition = registry->definitionForName(element->localName()))
+        definition->enqueueUpgradeReaction(element);
+    else
+        registry->addCandidate(element);
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElement.h b/third_party/WebKit/Source/core/dom/custom/CustomElement.h
index 080ac2b2f..a733051 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElement.h
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElement.h
@@ -47,6 +47,8 @@
     static void enqueueAttributeChangedCallback(Element*, const QualifiedName&,
         const AtomicString& oldValue, const AtomicString& newValue);
 
+    static void tryToUpgrade(Element*);
+
 private:
     static HTMLElement* createUndefinedElement(Document&, const QualifiedName&);
 };
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementDefinition.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementDefinition.cpp
index bf8acd6f..3c950fd 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementDefinition.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementDefinition.cpp
@@ -102,6 +102,8 @@
 // https://html.spec.whatwg.org/multipage/scripting.html#concept-upgrade-an-element
 void CustomElementDefinition::upgrade(Element* element)
 {
+    DCHECK_EQ(element->getCustomElementState(), CustomElementState::Undefined);
+
     if (!m_observedAttributes.isEmpty())
         enqueueAttributeChangedCallbackForAllAttributes(element);
 
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeReaction.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeReaction.cpp
index 8da5f43..8296c3a 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeReaction.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeReaction.cpp
@@ -16,7 +16,11 @@
 
 void CustomElementUpgradeReaction::invoke(Element* element)
 {
-    m_definition->upgrade(element);
+    // Don't call upgrade() if it's already upgraded. Multiple upgrade reactions
+    // could be enqueued because the state changes in step 10 of upgrades.
+    // https://html.spec.whatwg.org/multipage/scripting.html#upgrades
+    if (element->getCustomElementState() == CustomElementState::Undefined)
+        m_definition->upgrade(element);
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/html/HTMLOptionElement.cpp b/third_party/WebKit/Source/core/html/HTMLOptionElement.cpp
index df36b0521..6c8e842 100644
--- a/third_party/WebKit/Source/core/html/HTMLOptionElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLOptionElement.cpp
@@ -310,7 +310,7 @@
     if (HTMLDataListElement* dataList = ownerDataListElement())
         dataList->optionElementChildrenChanged();
     else if (HTMLSelectElement* select = ownerSelectElement())
-        select->optionElementChildrenChanged();
+        select->optionElementChildrenChanged(*this);
     updateLabel();
     HTMLElement::childrenChanged(change);
 }
diff --git a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index f68437b..750ffda 100644
--- a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
@@ -429,12 +429,14 @@
     HTMLFormControlElementWithState::childrenChanged(change);
 }
 
-void HTMLSelectElement::optionElementChildrenChanged()
+void HTMLSelectElement::optionElementChildrenChanged(const HTMLOptionElement& option)
 {
     setNeedsValidityCheck();
     setOptionsChangedOnLayoutObject();
 
     if (layoutObject()) {
+        if (option.selected() && usesMenuList())
+            layoutObject()->updateFromElement();
         if (AXObjectCache* cache = layoutObject()->document().existingAXObjectCache())
             cache->childrenChanged(this);
     }
diff --git a/third_party/WebKit/Source/core/html/HTMLSelectElement.h b/third_party/WebKit/Source/core/html/HTMLSelectElement.h
index 450b34f..9fd2ac44 100644
--- a/third_party/WebKit/Source/core/html/HTMLSelectElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLSelectElement.h
@@ -86,7 +86,7 @@
     HTMLOptionsCollection* options();
     HTMLCollection* selectedOptions();
 
-    void optionElementChildrenChanged();
+    void optionElementChildrenChanged(const HTMLOptionElement&);
 
     void setRecalcListItems();
     void invalidateSelectedItems();
diff --git a/third_party/WebKit/Source/core/origin_trials/testing/InternalsFrobulate.idl b/third_party/WebKit/Source/core/origin_trials/testing/InternalsFrobulate.idl
index 4680ce7..23a6841 100644
--- a/third_party/WebKit/Source/core/origin_trials/testing/InternalsFrobulate.idl
+++ b/third_party/WebKit/Source/core/origin_trials/testing/InternalsFrobulate.idl
@@ -6,5 +6,6 @@
     [CallWith=ScriptState, RaisesException] readonly attribute boolean frobulate;
     readonly attribute boolean frobulateNoEnabledCheck;
     [OriginTrialEnabled=OriginTrialsSampleAPI, ImplementedAs=frobulateNoEnabledCheck] readonly attribute boolean frobulateBindings;
+    [OriginTrialEnabled=OriginTrialsSampleAPI] const unsigned short FROBULATE_CONST = 1;
 };
 
diff --git a/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.h b/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.h
index c5ac8a8..495d461b 100644
--- a/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.h
+++ b/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.h
@@ -14,6 +14,7 @@
 class WorkerInternalsFrobulate final {
     STATIC_ONLY(WorkerInternalsFrobulate);
 public:
+    static const unsigned short kFrobulateConst = 1;
     static bool frobulate(WorkerInternals&) { return true; }
 };
 
diff --git a/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.idl b/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.idl
index 1e5178c..fbdf2db1 100644
--- a/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.idl
+++ b/third_party/WebKit/Source/core/origin_trials/testing/WorkerInternalsFrobulate.idl
@@ -4,5 +4,6 @@
 
 partial interface WorkerInternals {
     [OriginTrialEnabled=OriginTrialsSampleAPI] readonly attribute boolean frobulate;
+    [OriginTrialEnabled=OriginTrialsSampleAPI, Reflect=kFrobulateConst] const unsigned short FROBULATE_CONST = 1;
 };
 
diff --git a/third_party/WebKit/Source/core/workers/WorkerThread.cpp b/third_party/WebKit/Source/core/workers/WorkerThread.cpp
index bcb8193..27ff8425 100644
--- a/third_party/WebKit/Source/core/workers/WorkerThread.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerThread.cpp
@@ -351,6 +351,14 @@
 
     // If terminate has already been called.
     if (m_terminated) {
+        if (m_runningDebuggerTask) {
+            // Any debugger task is guaranteed to finish, so we can wait for the
+            // completion even if the synchronous forcible termination is
+            // requested. Shutdown sequence will start after the task.
+            DCHECK(!m_scheduledForceTerminationTask);
+            return;
+        }
+
         // The synchronous forcible termination request should overtake the
         // scheduled termination task because the request will block the main
         // thread and the scheduled termination task never runs.
@@ -385,7 +393,7 @@
     // loop. If script execution weren't forbidden, a while(1) loop in JS could
     // keep the thread alive forever.
     //
-    // (1) |m_readyToShutdown|: It this is set, the worker thread has already
+    // (1) |m_readyToShutdown|: If this is set, the worker thread has already
     // noticed that the thread is about to be terminated and the worker global
     // scope is already disposed, so we don't have to explicitly terminate the
     // worker execution.
@@ -586,11 +594,13 @@
     ThreadDebugger::idleStarted(isolate());
     {
         MutexLocker lock(m_threadStateMutex);
-        m_runningDebuggerTask = false;
-
-        if (!m_terminated)
+        if (!m_terminated) {
+            m_runningDebuggerTask = false;
             return;
+        }
         // terminate() was called. Shutdown sequence will start soon.
+        // Keep |m_runningDebuggerTask| to prevent forcible termination from the
+        // main thread before shutdown preparation.
     }
     // Stop further worker tasks to run after this point.
     prepareForShutdownOnWorkerThread();
diff --git a/third_party/WebKit/Source/core/workers/WorkerThread.h b/third_party/WebKit/Source/core/workers/WorkerThread.h
index 3a1de279..d31ff1f 100644
--- a/third_party/WebKit/Source/core/workers/WorkerThread.h
+++ b/third_party/WebKit/Source/core/workers/WorkerThread.h
@@ -34,6 +34,7 @@
 #include "core/workers/WorkerLoaderProxy.h"
 #include "core/workers/WorkerThreadLifecycleObserver.h"
 #include "platform/LifecycleNotifier.h"
+#include "platform/WaitableEvent.h"
 #include "wtf/Forward.h"
 #include "wtf/Functional.h"
 #include "wtf/OwnPtr.h"
@@ -43,7 +44,6 @@
 namespace blink {
 
 class InspectorTaskRunner;
-class WaitableEvent;
 class WorkerBackingThread;
 class WorkerGlobalScope;
 class WorkerInspectorController;
@@ -152,6 +152,8 @@
 
     ExitCode getExitCode();
 
+    void waitForShutdownForTesting() { m_shutdownEvent->wait(); }
+
 protected:
     WorkerThread(PassRefPtr<WorkerLoaderProxy>, WorkerReportingProxy&);
 
@@ -164,6 +166,7 @@
 
 private:
     friend class WorkerThreadTest;
+    FRIEND_TEST_ALL_PREFIXES(WorkerThreadTest, StartAndTerminateOnScriptLoaded_TerminateWhileDebuggerTaskIsRunning);
 
     class ForceTerminationTask;
     class WorkerMicrotaskRunner;
@@ -190,8 +193,6 @@
     void performDebuggerTaskOnWorkerThread(std::unique_ptr<CrossThreadClosure>);
     void performDebuggerTaskDontWaitOnWorkerThread();
 
-    void setForceTerminationDelayInMsForTesting(long long forceTerminationDelayInMs) { m_forceTerminationDelayInMs = forceTerminationDelayInMs; }
-
     bool m_started = false;
     bool m_terminated = false;
     bool m_readyToShutdown = false;
diff --git a/third_party/WebKit/Source/core/workers/WorkerThreadTest.cpp b/third_party/WebKit/Source/core/workers/WorkerThreadTest.cpp
index 526bd66..3552cf9 100644
--- a/third_party/WebKit/Source/core/workers/WorkerThreadTest.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerThreadTest.cpp
@@ -44,14 +44,9 @@
         m_workerThread->startWithSourceCode(m_securityOrigin.get(), "while(true) {}");
     }
 
-    void waitForShutdown()
-    {
-        m_workerThread->m_shutdownEvent->wait();
-    }
-
     void setForceTerminationDelayInMs(long long forceTerminationDelayInMs)
     {
-        m_workerThread->setForceTerminationDelayInMsForTesting(forceTerminationDelayInMs);
+        m_workerThread->m_forceTerminationDelayInMs = forceTerminationDelayInMs;
     }
 
     bool isForceTerminationTaskScheduled()
@@ -104,7 +99,7 @@
     // gracefully shut down.
     m_workerThread->terminate();
     EXPECT_TRUE(isForceTerminationTaskScheduled());
-    waitForShutdown();
+    m_workerThread->waitForShutdownForTesting();
     EXPECT_EQ(WorkerThread::ExitCode::GracefullyTerminated, m_workerThread->getExitCode());
 }
 
@@ -128,7 +123,7 @@
     // (2) If the thread has already been initialized on the worker thread,
     // terminate() should gracefully shut down the thread.
     m_workerThread->terminate();
-    waitForShutdown();
+    m_workerThread->waitForShutdownForTesting();
     WorkerThread::ExitCode exitCode = m_workerThread->getExitCode();
     EXPECT_EQ(WorkerThread::ExitCode::GracefullyTerminated, exitCode);
 }
@@ -176,7 +171,7 @@
 
     // Wait until the force termination task runs.
     testing::runDelayedTasks(kForceTerminationDelayInMs);
-    waitForShutdown();
+    m_workerThread->waitForShutdownForTesting();
     EXPECT_EQ(WorkerThread::ExitCode::AsyncForciblyTerminated, m_workerThread->getExitCode());
 }
 
@@ -201,7 +196,7 @@
 
     // Wait until the force termination task runs.
     testing::runDelayedTasks(kForceTerminationDelayInMs);
-    waitForShutdown();
+    m_workerThread->waitForShutdownForTesting();
     EXPECT_EQ(WorkerThread::ExitCode::AsyncForciblyTerminated, m_workerThread->getExitCode());
 }
 
@@ -225,6 +220,39 @@
     EXPECT_EQ(WorkerThread::ExitCode::SyncForciblyTerminated, m_workerThread->getExitCode());
 }
 
+TEST_F(WorkerThreadTest, StartAndTerminateOnScriptLoaded_TerminateWhileDebuggerTaskIsRunning)
+{
+    expectReportingCallsForWorkerForciblyTerminated();
+    startWithSourceCodeNotToFinish();
+    m_workerThread->waitUntilScriptLoaded();
+
+    // Simulate that a debugger task is running.
+    m_workerThread->m_runningDebuggerTask = true;
+
+    // terminate() should not schedule a force termination task because there is
+    // a running debugger task.
+    m_workerThread->terminate();
+    EXPECT_FALSE(isForceTerminationTaskScheduled());
+    EXPECT_EQ(WorkerThread::ExitCode::NotTerminated, m_workerThread->getExitCode());
+
+    // Multiple terminate() calls should not take effect.
+    m_workerThread->terminate();
+    m_workerThread->terminate();
+    EXPECT_FALSE(isForceTerminationTaskScheduled());
+    EXPECT_EQ(WorkerThread::ExitCode::NotTerminated, m_workerThread->getExitCode());
+
+    // Focible termination request should also respect the running debugger
+    // task.
+    m_workerThread->terminateInternal(WorkerThread::TerminationMode::Forcible);
+    EXPECT_FALSE(isForceTerminationTaskScheduled());
+    EXPECT_EQ(WorkerThread::ExitCode::NotTerminated, m_workerThread->getExitCode());
+
+    // Clean up in order to satisfy DCHECKs in dtors.
+    m_workerThread->m_runningDebuggerTask = false;
+    m_workerThread->forciblyTerminateExecution();
+    m_workerThread->waitForShutdownForTesting();
+}
+
 // TODO(nhiroki): Add tests for terminateAndWaitForAllWorkers.
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/web/WebMemoryPressureListener.cpp b/third_party/WebKit/Source/web/WebMemoryCoordinator.cpp
similarity index 73%
rename from third_party/WebKit/Source/web/WebMemoryPressureListener.cpp
rename to third_party/WebKit/Source/web/WebMemoryCoordinator.cpp
index e652306..aa1c71e 100644
--- a/third_party/WebKit/Source/web/WebMemoryPressureListener.cpp
+++ b/third_party/WebKit/Source/web/WebMemoryCoordinator.cpp
@@ -2,14 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "public/web/WebMemoryPressureListener.h"
+#include "public/web/WebMemoryCoordinator.h"
 
 #include "core/page/Page.h"
 #include "platform/MemoryPurgeController.h"
 
 namespace blink {
 
-void WebMemoryPressureListener::onMemoryPressure(WebMemoryPressureLevel pressureLevel)
+void WebMemoryCoordinator::onMemoryPressure(WebMemoryPressureLevel pressureLevel)
 {
     Page::onMemoryPressure();
     MemoryPurgeController::onMemoryPressure(pressureLevel);
diff --git a/third_party/WebKit/Source/web/web.gypi b/third_party/WebKit/Source/web/web.gypi
index 10a3304..680c111c 100644
--- a/third_party/WebKit/Source/web/web.gypi
+++ b/third_party/WebKit/Source/web/web.gypi
@@ -172,7 +172,7 @@
       'WebMediaDevicesRequest.cpp',
       'WebMediaStreamRegistry.cpp',
       'WebMetaElement.cpp',
-      'WebMemoryPressureListener.cpp',
+      'WebMemoryCoordinator.cpp',
       'WebNetworkStateNotifier.cpp',
       'WebNode.cpp',
       'WebOptionElement.cpp',
diff --git a/third_party/WebKit/public/blink_headers.gypi b/third_party/WebKit/public/blink_headers.gypi
index 5747c64..1c38838 100644
--- a/third_party/WebKit/public/blink_headers.gypi
+++ b/third_party/WebKit/public/blink_headers.gypi
@@ -388,7 +388,7 @@
       "web/WebMediaDevicesRequest.h",
       "web/WebMediaPlayerAction.h",
       "web/WebMediaStreamRegistry.h",
-      "web/WebMemoryPressureListener.h",
+      "web/WebMemoryCoordinator.h",
       "web/WebMenuItemInfo.h",
       "web/WebMetaElement.h",
       "web/WebNavigationPolicy.h",
diff --git a/third_party/WebKit/public/web/WebMemoryPressureListener.h b/third_party/WebKit/public/web/WebMemoryCoordinator.h
similarity index 80%
rename from third_party/WebKit/public/web/WebMemoryPressureListener.h
rename to third_party/WebKit/public/web/WebMemoryCoordinator.h
index b5a8b70..306b961c 100644
--- a/third_party/WebKit/public/web/WebMemoryPressureListener.h
+++ b/third_party/WebKit/public/web/WebMemoryCoordinator.h
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef WebMemoryPressureListener_h
-#define WebMemoryPressureListener_h
+#ifndef WebMemoryCoordinator_h
+#define WebMemoryCoordinator_h
 
 #include "public/platform/WebCommon.h"
 #include "public/platform/WebMemoryPressureLevel.h"
 
 namespace blink {
 
-class WebMemoryPressureListener {
+class WebMemoryCoordinator {
 public:
     // Called when a memory pressure notification is received.
     BLINK_EXPORT static void onMemoryPressure(WebMemoryPressureLevel);
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 3524733..922fdc96 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -34366,6 +34366,24 @@
     whenever before scrolling down to the given snippet, the user discards some
     snippets in the top of the list.
   </summary>
+  <obsolete>
+    Deprecated as of 6/2016
+  </obsolete>
+</histogram>
+
+<histogram name="NewTabPage.Snippets.CardClickedScoreNew" units="score">
+  <owner>jkrcal@chromium.org</owner>
+  <summary>
+    Android: The score of the snippets card on the NTP, that is clicked through
+    to the host website of the content. The recorded score is from the moment
+    the snippet was fetched, it could have changed since. In each &quot;_x&quot;
+    suffix  of the histogram, only snippets on positions \lt;=x are tracked. We
+    track the position the snippet had in the list when NTP was loaded. This
+    tracked position is thus different from the position observed by the user
+    whenever before scrolling down to the given snippet, the user discards some
+    snippets in the top of the list. In contrast to CardClickedScore, this
+    histogram has a proper maximal value of 100 000.
+  </summary>
 </histogram>
 
 <histogram name="NewTabPage.Snippets.CardExpanded">
@@ -34438,6 +34456,27 @@
     down to the given snippet, the user discards some snippets in the top of the
     list.
   </summary>
+  <obsolete>
+    Deprecated as of 6/2016
+  </obsolete>
+</histogram>
+
+<histogram name="NewTabPage.Snippets.CardShownScoreNew" units="score">
+  <owner>jkrcal@chromium.org</owner>
+  <summary>
+    Android: The score of the snippets card that is shown on the NTP. Each
+    snippet (its score) is recorded whenever at least 1/3 of its height becomes
+    visible by scrolling through the NTP. Each snippet is recorded at most once
+    for a given instance of NTP and a given data set of snippets that is shown.
+    The recorded score is from the moment the snippet was fetched, it could have
+    changed since. In each &quot;_x&quot; suffix  of the histogram, only
+    snippets on positions \lt;=x are tracked. By this, we mean the position the
+    snippet had in the list when NTP was loaded. This tracked position is thus
+    different from the position observed by the user whenever before scrolling
+    down to the given snippet, the user discards some snippets in the top of the
+    list. In contrast to CardShownScore, this histogram has a proper maximal
+    value of 100 000.
+  </summary>
 </histogram>
 
 <histogram name="NewTabPage.Snippets.FetchHttpResponseOrErrorCode"
@@ -97028,8 +97067,10 @@
   <suffix name="5_9" label="Only snippets on position 5-9"/>
   <affected-histogram name="NewTabPage.Snippets.CardClickedAge"/>
   <affected-histogram name="NewTabPage.Snippets.CardClickedScore"/>
+  <affected-histogram name="NewTabPage.Snippets.CardClickedScoreNew"/>
   <affected-histogram name="NewTabPage.Snippets.CardShownAge"/>
   <affected-histogram name="NewTabPage.Snippets.CardShownScore"/>
+  <affected-histogram name="NewTabPage.Snippets.CardShownScoreNew"/>
 </histogram_suffixes>
 
 <histogram_suffixes name="PpapiPluginName">
diff --git a/ui/base/BUILD.gn b/ui/base/BUILD.gn
index d5393b3..f56d72e10 100644
--- a/ui/base/BUILD.gn
+++ b/ui/base/BUILD.gn
@@ -727,6 +727,7 @@
     "resource/resource_bundle_unittest.cc",
     "resource/scale_factor_unittest.cc",
     "template_expressions_unittest.cc",
+    "test/page_transition_types_unittest.cc",
     "test/run_all_unittests.cc",
     "user_activity/user_activity_detector_unittest.cc",
   ]
diff --git a/ui/base/page_transition_types.cc b/ui/base/page_transition_types.cc
index d7623f5..7f1d6e4 100644
--- a/ui/base/page_transition_types.cc
+++ b/ui/base/page_transition_types.cc
@@ -13,7 +13,13 @@
   // Expect the rhs to be a compile time constant without qualifiers.
   DCHECK_EQ(PageTransitionGetQualifier(rhs), 0);
   DCHECK(PageTransitionIsValidType(rhs));
-  return PageTransitionStripQualifier(lhs) == PageTransitionStripQualifier(rhs);
+  return static_cast<int32_t>(PageTransitionStripQualifier(lhs)) ==
+      static_cast<int32_t>(PageTransitionStripQualifier(rhs));
+}
+
+bool PageTransitionTypeIncludingQualifiersIs(PageTransition lhs,
+                                             PageTransition rhs) {
+  return static_cast<int32_t>(lhs) == static_cast<int32_t>(rhs);
 }
 
 PageTransition PageTransitionStripQualifier(PageTransition type) {
@@ -37,9 +43,8 @@
 }
 
 bool PageTransitionIsMainFrame(PageTransition type) {
-  int32_t t = PageTransitionStripQualifier(type);
-  return (t != PAGE_TRANSITION_AUTO_SUBFRAME &&
-          t != PAGE_TRANSITION_MANUAL_SUBFRAME);
+  return !PageTransitionCoreTypeIs(type, PAGE_TRANSITION_AUTO_SUBFRAME) &&
+         !PageTransitionCoreTypeIs(type, PAGE_TRANSITION_MANUAL_SUBFRAME);
 }
 
 bool PageTransitionIsRedirect(PageTransition type) {
diff --git a/ui/base/page_transition_types.h b/ui/base/page_transition_types.h
index ef0bb48..eafea523 100644
--- a/ui/base/page_transition_types.h
+++ b/ui/base/page_transition_types.h
@@ -151,6 +151,11 @@
 UI_BASE_EXPORT bool PageTransitionCoreTypeIs(PageTransition lhs,
                                              PageTransition rhs);
 
+// Compares two PageTransition types including qualifiers. Rarely useful,
+// PageTransitionCoreTypeIs() is more likely what you need.
+UI_BASE_EXPORT bool PageTransitionTypeIncludingQualifiersIs(PageTransition lhs,
+                                                            PageTransition rhs);
+
 // Simplifies the provided transition by removing any qualifier
 UI_BASE_EXPORT PageTransition PageTransitionStripQualifier(
     PageTransition type);
@@ -188,7 +193,8 @@
 class DontUseOperatorEquals;
 
 // Ban operator== as it's way too easy to forget to strip the qualifiers. Use
-// PageTransitionCoreTypeIs() instead.
+// PageTransitionCoreTypeIs() instead or, in rare cases,
+// PageTransitionTypeIncludingQualifiersIs().
 DontUseOperatorEquals operator==(PageTransition, PageTransition);
 DontUseOperatorEquals operator==(PageTransition, int);
 DontUseOperatorEquals operator==(int, PageTransition);
diff --git a/ui/base/test/page_transition_types_unittest.cc b/ui/base/test/page_transition_types_unittest.cc
new file mode 100644
index 0000000..08a971d
--- /dev/null
+++ b/ui/base/test/page_transition_types_unittest.cc
@@ -0,0 +1,54 @@
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/base/page_transition_types.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace ui {
+
+TEST(PageTransitionTypesTest, PageTransitionCoreTypeIs) {
+  EXPECT_TRUE(
+      PageTransitionCoreTypeIs(PAGE_TRANSITION_TYPED, PAGE_TRANSITION_TYPED));
+  EXPECT_FALSE(PageTransitionCoreTypeIs(PAGE_TRANSITION_TYPED,
+                                        PAGE_TRANSITION_AUTO_BOOKMARK));
+  EXPECT_TRUE(PageTransitionCoreTypeIs(
+      PageTransitionFromInt(PAGE_TRANSITION_TYPED |
+                            PAGE_TRANSITION_SERVER_REDIRECT),
+      PAGE_TRANSITION_TYPED));
+}
+
+TEST(PageTransitionTypesTest, PageTransitionTypeIncludingQualifiersIs) {
+  EXPECT_TRUE(PageTransitionTypeIncludingQualifiersIs(PAGE_TRANSITION_TYPED,
+                                                      PAGE_TRANSITION_TYPED));
+  EXPECT_FALSE(PageTransitionTypeIncludingQualifiersIs(PAGE_TRANSITION_TYPED,
+                                                       PAGE_TRANSITION_LINK));
+  EXPECT_TRUE(PageTransitionTypeIncludingQualifiersIs(
+      PageTransitionFromInt(PAGE_TRANSITION_TYPED |
+                            PAGE_TRANSITION_SERVER_REDIRECT),
+      PageTransitionFromInt(PAGE_TRANSITION_TYPED |
+                            PAGE_TRANSITION_SERVER_REDIRECT)));
+  EXPECT_FALSE(PageTransitionTypeIncludingQualifiersIs(
+      PageTransitionFromInt(PAGE_TRANSITION_TYPED |
+                            PAGE_TRANSITION_SERVER_REDIRECT),
+      PAGE_TRANSITION_TYPED));
+  EXPECT_FALSE(PageTransitionTypeIncludingQualifiersIs(
+      PAGE_TRANSITION_TYPED,
+      PageTransitionFromInt(PAGE_TRANSITION_TYPED |
+                            PAGE_TRANSITION_SERVER_REDIRECT)));
+}
+
+TEST(PageTransitionTypesTest, PageTransitionStripQualifier) {
+  typedef int32_t underlying_type;
+
+  EXPECT_EQ(static_cast<underlying_type>(
+                PageTransitionStripQualifier(PAGE_TRANSITION_TYPED)),
+            static_cast<underlying_type>(PAGE_TRANSITION_TYPED));
+  EXPECT_EQ(static_cast<underlying_type>(PageTransitionStripQualifier(
+      PageTransitionFromInt(PAGE_TRANSITION_TYPED |
+                            PAGE_TRANSITION_SERVER_REDIRECT))),
+            static_cast<underlying_type>(PAGE_TRANSITION_TYPED));
+}
+
+}  // namespace ui