diff --git a/AUTHORS b/AUTHORS
index 2045c62..d94fa3a 100644
--- a/AUTHORS
+++ b/AUTHORS

@@ -275,6 +275,7 @@
 Jeado Ko <haibane84@gmail.com>
 Jeongeun Kim <je_julie.kim@samsung.com>
 Jeongmin Kim <kimwjdalsl@gmail.com>
+Jeremy Noring <jnoring@hirevue.com>
 Jeremy Spiegel <jeremysspiegel@gmail.com>
 Jesper Storm Bache <jsbache@gmail.com>
 Jesse Miller <jesse@jmiller.biz>

diff --git a/DEPS b/DEPS
index 8bc844c..8665384 100644
--- a/DEPS
+++ b/DEPS

@@ -39,7 +39,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '8a7d6f9df4be01ce8ae58f0d9c5adbbdc4e1db83',
+  'skia_revision': 'c4ce72fc15b109c40ad5ba46b06a17209b2a750e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -216,7 +216,7 @@
    Var('chromium_git') + '/native_client/src/third_party/scons-2.0.1.git' + '@' + '1c1550e17fc26355d08627fbdec13d8291227067',
 
   'src/third_party/webrtc':
-    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + 'fcc3833d12a7f24dbe71f21791016ff4f10e04f8', # commit position 12447
+    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + '545e17c1c8d07cbd1f12e873f363a587e74332df', # commit position 12483
 
   'src/third_party/openmax_dl':
     Var('chromium_git') + '/external/webrtc/deps/third_party/openmax.git' + '@' +  Var('openmax_dl_revision'),

diff --git a/ash/mus/manifest.json b/ash/mus/manifest.json
index f394830..843f41a 100644
--- a/ash/mus/manifest.json
+++ b/ash/mus/manifest.json

@@ -1,11 +1,5 @@
 {
-  "manifest_version":  1,
   "name": "mojo:ash_sysui",
   "display_name": "System UI",
-  "capabilities": {
-    "required": {
-      "*":  { "interfaces":  ["*"] },
-      "mojo:mus": { "classes": [ "mus:core" ] }
-    }
-  }
+  "capabilities": { "*": [ "*" ] }
 }

diff --git a/ash/system/toast/toast_overlay.cc b/ash/system/toast/toast_overlay.cc
index deaba0e..1128843 100644
--- a/ash/system/toast/toast_overlay.cc
+++ b/ash/system/toast/toast_overlay.cc

@@ -31,8 +31,8 @@
 
 namespace {
 
-// Horizontal offset of the overlay from the bottom of the screen.
-const int kVerticalOffset = 5;
+// Offset of the overlay from the edge of the work area.
+const int kOffset = 5;
 
 // Font style used for modifier key labels.
 const ui::ResourceBundle::FontStyle kTextFontStyle =
@@ -45,6 +45,13 @@
 const SkColor kButtonBackgroundColor = SkColorSetARGB(0xFF, 0x32, 0x32, 0x32);
 const SkColor kButtonTextColor = SkColorSetARGB(0xFF, 0x7B, 0xAA, 0xF7);
 
+// These values are in DIP.
+const int kToastHorizontalSpacing = 16;
+const int kToastVerticalSpacing = 16;
+const int kToastChildSpacing = 32;
+const int kToastMaximumWidth = 568;
+const int kToastMinimumWidth = 288;
+
 }  // anonymous namespace
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -54,7 +61,13 @@
   explicit ToastOverlayLabel(const std::string& label);
   ~ToastOverlayLabel() override;
 
+  void SetMaximumWidth(int width);
+
  private:
+  int maximum_width_ = 0;
+
+  gfx::Size GetPreferredSize() const override;
+
   DISALLOW_COPY_AND_ASSIGN(ToastOverlayLabel);
 };
 
@@ -66,6 +79,7 @@
   SetFontList(rb->GetFontList(kTextFontStyle));
   SetAutoColorReadabilityEnabled(false);
   SetFocusable(false);
+  SetMultiLine(true);
   SetEnabledColor(SK_ColorWHITE);
   SetDisabledColor(SK_ColorWHITE);
   SetSubpixelRenderingEnabled(false);
@@ -73,6 +87,19 @@
 
 ToastOverlayLabel::~ToastOverlayLabel() {}
 
+void ToastOverlayLabel::SetMaximumWidth(int width) {
+  maximum_width_ = width;
+}
+
+gfx::Size ToastOverlayLabel::GetPreferredSize() const {
+  gfx::Size original_size = Label::GetPreferredSize();
+
+  if (maximum_width_ != 0 && maximum_width_ < original_size.width())
+    return gfx::Size(maximum_width_, GetHeightForWidth(maximum_width_));
+  else
+    return original_size;
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 //  ToastOverlayButton
 class ToastOverlayButton : public views::LabelButton {
@@ -116,6 +143,9 @@
   ToastOverlay* overlay_;       // weak
   ToastOverlayButton* button_;  // weak
 
+  gfx::Size GetMaximumSize() const override;
+  gfx::Size GetMinimumSize() const override;
+
   void ButtonPressed(views::Button* sender, const ui::Event& event) override;
 
   DISALLOW_COPY_AND_ASSIGN(ToastOverlayView);
@@ -127,25 +157,20 @@
       button_(new ToastOverlayButton(
           this,
           l10n_util::GetStringUTF16(IDS_ASH_TOAST_DISMISS_BUTTON))) {
-  const gfx::Font& font =
-      ui::ResourceBundle::GetSharedInstance().GetFont(kTextFontStyle);
-  int font_size = font.GetFontSize();
-
-  // Text should have a margin of 0.5 times the font size on each side, so
-  // the spacing between two labels will be the same as the font size.
-  int horizontal_spacing = font_size * 2;
-  int vertical_spacing = font_size;
-  int child_spacing = font_size * 4;
-
-  SetLayoutManager(new views::BoxLayout(views::BoxLayout::kHorizontal,
-                                        horizontal_spacing, vertical_spacing,
-                                        child_spacing));
-
   ToastOverlayLabel* label = new ToastOverlayLabel(text);
+  label->SetMaximumWidth(GetMaximumSize().width() -
+                         button_->GetPreferredSize().width() -
+                         kToastHorizontalSpacing * 2 - kToastChildSpacing);
   AddChildView(label);
-  label->SetVisible(true);
 
   AddChildView(button_);
+
+  auto layout = new views::BoxLayout(views::BoxLayout::kHorizontal,
+                                     kToastHorizontalSpacing,
+                                     kToastVerticalSpacing, kToastChildSpacing);
+  SetLayoutManager(layout);
+  layout->SetFlexForView(label, 1);
+  layout->SetFlexForView(button_, 0);
 }
 
 ToastOverlayView::~ToastOverlayView() {}
@@ -158,6 +183,18 @@
   views::View::OnPaint(canvas);
 }
 
+gfx::Size ToastOverlayView::GetMinimumSize() const {
+  return gfx::Size(kToastMinimumWidth, 0);
+}
+
+gfx::Size ToastOverlayView::GetMaximumSize() const {
+  ShelfLayoutManager* shelf_layout_manager =
+      Shelf::ForPrimaryDisplay()->shelf_layout_manager();
+  gfx::Rect work_area_bounds = shelf_layout_manager->user_work_area_bounds();
+
+  return gfx::Size(kToastMaximumWidth, work_area_bounds.height() - kOffset * 2);
+}
+
 void ToastOverlayView::ButtonPressed(views::Button* sender,
                                      const ui::Event& event) {
   overlay_->Show(false);
@@ -224,10 +261,9 @@
 gfx::Rect ToastOverlay::CalculateOverlayBounds() {
   ShelfLayoutManager* shelf_layout_manager =
       Shelf::ForPrimaryDisplay()->shelf_layout_manager();
-  gfx::Rect work_area_bounds = shelf_layout_manager->user_work_area_bounds();
 
   gfx::Rect bounds = shelf_layout_manager->user_work_area_bounds();
-  int target_y = bounds.bottom() - widget_size_.height() - kVerticalOffset;
+  int target_y = bounds.bottom() - widget_size_.height() - kOffset;
   bounds.ClampToCenteredSize(widget_size_);
   bounds.set_y(target_y);
   return bounds;

diff --git a/build/common.gypi b/build/common.gypi
index 74836e7..9368049d 100644
--- a/build/common.gypi
+++ b/build/common.gypi

@@ -3575,6 +3575,15 @@
             ],
           },
         }],
+        [ 'OS=="ios"', {
+          'Archive': {
+            'inherit_from': ['Common_Base', 'x86_Base', 'Release_Base'],
+            'xcode_settings': {
+              'GCC_SYMBOLS_PRIVATE_EXTERN': 'YES',     # -fvisibility=hidden
+              'STRIP_INSTALLED_PRODUCT': 'YES',
+            },
+          },
+        }],
         [ 'OS=="win"', {
           # TODO(bradnelson): add a gyp mechanism to make this more graceful.
           'Debug_x64': {
@@ -5032,7 +5041,6 @@
           # GCC_INLINES_ARE_PRIVATE_EXTERN maps to -fvisibility-inlines-hidden
           'GCC_INLINES_ARE_PRIVATE_EXTERN': 'YES',
           'GCC_OBJC_CALL_CXX_CDTORS': 'YES',        # -fobjc-call-cxx-cdtors
-          'GCC_SYMBOLS_PRIVATE_EXTERN': 'YES',      # -fvisibility=hidden
           'GCC_THREADSAFE_STATICS': 'NO',           # -fno-threadsafe-statics
           'GCC_TREAT_WARNINGS_AS_ERRORS': 'YES',    # -Werror
           'GCC_VERSION': 'com.apple.compilers.llvm.clang.1_0',
@@ -5121,6 +5129,20 @@
               }],
             ],
           }],
+          ['OS=="mac"', {
+            'xcode_settings': {
+              'GCC_SYMBOLS_PRIVATE_EXTERN': 'YES',    # -fvisibility=hidden
+            },
+          }],
+          ['OS=="ios"', {
+            'xcode_settings': {
+              # XCTests inject a dynamic library into the application. If
+              # fvisibility is set to hidden, then some symbols needed by
+              # XCTests are not available. This setting is enabled for the
+              # Archive configuration.
+              'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',
+            },
+          }],
         ],
         'target_conditions': [
           ['_type!="static_library"', {
@@ -5425,7 +5447,7 @@
               'Release_Base': {
                 'xcode_settings': {
                   'DEPLOYMENT_POSTPROCESSING': 'YES',
-                  'STRIP_INSTALLED_PRODUCT': 'YES',
+                  'STRIP_INSTALLED_PRODUCT': 'NO',
                   'conditions': [
                     ['buildtype=="Official"', {
                       'DEBUG_INFORMATION_FORMAT': 'dwarf-with-dsym',

diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
index 07408d6..fd8f46e 100644
--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn

@@ -90,6 +90,23 @@
   # Gold icf level, values are "none", "safe", "all". If value isn't overridden,
   # default initialization is below.
   gold_icf_level = ""
+
+  # If this is set to true, or if LLVM_FORCE_HEAD_REVISION is set to 1
+  # in the environment, we use the revision in the llvm repo to determine
+  # the CLANG_REVISION to use, instead of the version hard-coded into
+  # //tools/clang/scripts/update.py. This should only be used in
+  # conjunction with setting LLVM_FORCE_HEAD_REVISION in the
+  # environment when `gclient runhooks` is run as well.
+  llvm_force_head_revision = false
+}
+
+if (is_clang && !is_nacl) {
+  update_args = [ "--print-revision" ]
+  if (llvm_force_head_revision) {
+    update_args += [ "--llvm-force-head-revision" ]
+  }
+  clang_revision =
+      exec_script("//tools/clang/scripts/update.py", update_args, "trim string")
 }
 
 # Apply the default logic for these values if they were not set explicitly.
@@ -226,10 +243,7 @@
     # when turning clang on or off. (defines are passed via the command line,
     # and build system rebuild things when their commandline changes). Nothing
     # should ever read this define.
-    defines +=
-        [ "CR_CLANG_REVISION=" + exec_script("//tools/clang/scripts/update.py",
-                                             [ "--print-revision" ],
-                                             "trim string") ]
+    defines += [ "CR_CLANG_REVISION=$clang_revision" ]
   }
 
   # Non-Mac Posix compiler flags setup.
@@ -974,9 +988,7 @@
         "-Wno-shift-negative-value",
       ]
 
-      if (exec_script("//tools/clang/scripts/update.py",
-                      [ "--print-revision" ],
-                      "trim string") != "266460-1") {
+      if (llvm_force_head_revision) {
         cflags += [
           # TODO(thakis): https://crbug.com/604888
           "-Wno-undefined-var-template",

diff --git a/chrome/browser/media/media_stream_infobar_delegate_android.cc b/chrome/browser/media/media_stream_infobar_delegate_android.cc
index 3e77c74..eb98652 100644
--- a/chrome/browser/media/media_stream_infobar_delegate_android.cc
+++ b/chrome/browser/media/media_stream_infobar_delegate_android.cc

@@ -22,18 +22,6 @@
 #include "ui/base/l10n/l10n_util.h"
 #include "url/gurl.h"
 
-namespace {
-
-enum DevicePermissionActions {
-  kAllowHttps = 0,
-  kAllowHttp,
-  kDeny,
-  kCancel,
-  kPermissionActionsMax  // Must always be last!
-};
-
-}  // namespace
-
 MediaStreamInfoBarDelegateAndroid::~MediaStreamInfoBarDelegateAndroid() {}
 
 // static
@@ -97,8 +85,6 @@
 void MediaStreamInfoBarDelegateAndroid::InfoBarDismissed() {
   // Deny the request if the infobar was closed with the 'x' button, since
   // we don't want WebRTC to be waiting for an answer that will never come.
-  UMA_HISTOGRAM_ENUMERATION("Media.DevicePermissionActions", kCancel,
-                            kPermissionActionsMax);
   controller_->Cancelled();
 }
 
@@ -119,20 +105,11 @@
 }
 
 bool MediaStreamInfoBarDelegateAndroid::Accept() {
-  if (content::IsOriginSecure(controller_->GetOrigin())) {
-    UMA_HISTOGRAM_ENUMERATION("Media.DevicePermissionActions", kAllowHttps,
-                              kPermissionActionsMax);
-  } else {
-    UMA_HISTOGRAM_ENUMERATION("Media.DevicePermissionActions", kAllowHttp,
-                              kPermissionActionsMax);
-  }
   controller_->PermissionGranted();
   return true;
 }
 
 bool MediaStreamInfoBarDelegateAndroid::Cancel() {
-  UMA_HISTOGRAM_ENUMERATION("Media.DevicePermissionActions", kDeny,
-                            kPermissionActionsMax);
   controller_->PermissionDenied();
   return true;
 }

diff --git a/chrome/browser/resources/snippets_internals.css b/chrome/browser/resources/snippets_internals.css
index 40d8997c..1bc0a5c 100644
--- a/chrome/browser/resources/snippets_internals.css
+++ b/chrome/browser/resources/snippets_internals.css

@@ -6,6 +6,10 @@
   font-size: 20px;
 }
 
+textarea {
+  width: 100%;
+}
+
 #info > div {
   width: 100%;
 }

diff --git a/chrome/browser/resources/snippets_internals.html b/chrome/browser/resources/snippets_internals.html
index c34a0d90..640520f 100644
--- a/chrome/browser/resources/snippets_internals.html
+++ b/chrome/browser/resources/snippets_internals.html

@@ -70,9 +70,10 @@
     </div>
     <div class="forms">
       <input id="submit-download" type="submit" value="Add snippets">
-          from hosts <input id="hosts-input" type="text" placeholder=
-          "www.wired.com www.bbc.co.uk">
-      <div id="hosts-help" class="detail"></div>
+          from hosts <span id="hosts-help" class="detail"></span>:
+      <textarea id="hosts-input" placeholder="www.wired.com www.bbc.co.uk" 
+          rows="5"></textarea>
+      <div id="hosts-status" class="detail"></div>
     </div>
   </div>
   

diff --git a/chrome/browser/ui/views/location_bar/bubble_icon_view.cc b/chrome/browser/ui/views/location_bar/bubble_icon_view.cc
index 8278ca9..6b62f113 100644
--- a/chrome/browser/ui/views/location_bar/bubble_icon_view.cc
+++ b/chrome/browser/ui/views/location_bar/bubble_icon_view.cc

@@ -98,7 +98,7 @@
     ExecuteCommand(EXECUTE_SOURCE_MOUSE);
 }
 
-bool BubbleIconView::OnKeyPressed(const ui::KeyEvent& event) {
+bool BubbleIconView::OnKeyReleased(const ui::KeyEvent& event) {
   if (event.key_code() != ui::VKEY_SPACE && event.key_code() != ui::VKEY_RETURN)
     return false;
 

diff --git a/chrome/browser/ui/views/location_bar/bubble_icon_view.h b/chrome/browser/ui/views/location_bar/bubble_icon_view.h
index ba5a449..12a95a656 100644
--- a/chrome/browser/ui/views/location_bar/bubble_icon_view.h
+++ b/chrome/browser/ui/views/location_bar/bubble_icon_view.h

@@ -62,7 +62,7 @@
   void Layout() override;
   bool OnMousePressed(const ui::MouseEvent& event) override;
   void OnMouseReleased(const ui::MouseEvent& event) override;
-  bool OnKeyPressed(const ui::KeyEvent& event) override;
+  bool OnKeyReleased(const ui::KeyEvent& event) override;
   void ViewHierarchyChanged(
       const ViewHierarchyChangedDetails& details) override;
   void OnNativeThemeChanged(const ui::NativeTheme* theme) override;

diff --git a/chrome/browser/ui/views/location_bar/content_setting_image_view.cc b/chrome/browser/ui/views/location_bar/content_setting_image_view.cc
index f1a33e4..1711eb4 100644
--- a/chrome/browser/ui/views/location_bar/content_setting_image_view.cc
+++ b/chrome/browser/ui/views/location_bar/content_setting_image_view.cc

@@ -139,20 +139,12 @@
   if (!label()->visible() && !activated)
     ink_drop_delegate_->OnAction(views::InkDropState::HIDDEN);
   if (activated)
-    OnClick();
-}
-
-bool ContentSettingImageView::OnKeyPressed(const ui::KeyEvent& event) {
-  if (event.key_code() != ui::VKEY_SPACE && event.key_code() != ui::VKEY_RETURN)
-    return false;
-
-  OnClick();
-  return true;
+    OnActivate();
 }
 
 void ContentSettingImageView::OnGestureEvent(ui::GestureEvent* event) {
   if (event->type() == ui::ET_GESTURE_TAP)
-    OnClick();
+    OnActivate();
   if ((event->type() == ui::ET_GESTURE_TAP) ||
       (event->type() == ui::ET_GESTURE_TAP_DOWN))
     event->SetHandled();
@@ -204,6 +196,50 @@
           slide_animator_.GetCurrentValue() > (1.0 - kOpenFraction));
 }
 
+bool ContentSettingImageView::OnActivate() {
+  if (slide_animator_.is_animating()) {
+    // If the user clicks while we're animating, the bubble arrow will be
+    // pointing to the image, and if we allow the animation to keep running, the
+    // image will move away from the arrow (or we'll have to move the bubble,
+    // which is even worse). So we want to stop the animation.  We have two
+    // choices: jump to the final post-animation state (no label visible), or
+    // pause the animation where we are and continue running after the bubble
+    // closes. The former looks more jerky, so we avoid it unless the animation
+    // hasn't even fully exposed the image yet, in which case pausing with half
+    // an image visible will look broken.
+    if (!pause_animation_ && ShouldShowBackground() &&
+        (width() > MinimumWidthForImageWithBackgroundShown())) {
+      pause_animation_ = true;
+      pause_animation_state_ = slide_animator_.GetCurrentValue();
+    }
+    slide_animator_.Reset();
+  }
+
+  content::WebContents* web_contents = parent_->GetWebContents();
+  if (web_contents && !bubble_view_) {
+    bubble_view_ = new ContentSettingBubbleContents(
+                content_setting_image_model_->CreateBubbleModel(
+                    parent_->delegate()->GetContentSettingBubbleModelDelegate(),
+                    web_contents, parent_->profile()),
+                web_contents, this, views::BubbleBorder::TOP_RIGHT);
+    views::Widget* bubble_widget =
+        views::BubbleDialogDelegateView::CreateBubble(bubble_view_);
+    bubble_widget->AddObserver(this);
+    // This is triggered by an input event. If the user clicks the icon while
+    // it's not animating, the icon will be placed in an active state, so the
+    // bubble doesn't need an arrow. If the user clicks during an animation,
+    // the animation simply pauses and no other visible state change occurs, so
+    // show the arrow in this case.
+    if (ui::MaterialDesignController::IsModeMaterial() && !pause_animation_) {
+      ink_drop_delegate_->OnAction(views::InkDropState::ACTIVATED);
+      bubble_view_->SetArrowPaintType(views::BubbleBorder::PAINT_TRANSPARENT);
+    }
+    bubble_widget->Show();
+  }
+
+  return true;
+}
+
 void ContentSettingImageView::AnimationEnded(const gfx::Animation* animation) {
   slide_animator_.Reset();
   if (!pause_animation_) {
@@ -246,48 +282,6 @@
     ink_drop_delegate_->OnAction(views::InkDropState::DEACTIVATED);
 }
 
-void ContentSettingImageView::OnClick() {
-  if (slide_animator_.is_animating()) {
-    // If the user clicks while we're animating, the bubble arrow will be
-    // pointing to the image, and if we allow the animation to keep running, the
-    // image will move away from the arrow (or we'll have to move the bubble,
-    // which is even worse). So we want to stop the animation.  We have two
-    // choices: jump to the final post-animation state (no label visible), or
-    // pause the animation where we are and continue running after the bubble
-    // closes. The former looks more jerky, so we avoid it unless the animation
-    // hasn't even fully exposed the image yet, in which case pausing with half
-    // an image visible will look broken.
-    if (!pause_animation_ && ShouldShowBackground() &&
-        (width() > MinimumWidthForImageWithBackgroundShown())) {
-      pause_animation_ = true;
-      pause_animation_state_ = slide_animator_.GetCurrentValue();
-    }
-    slide_animator_.Reset();
-  }
-
-  content::WebContents* web_contents = parent_->GetWebContents();
-  if (web_contents && !bubble_view_) {
-    bubble_view_ = new ContentSettingBubbleContents(
-                content_setting_image_model_->CreateBubbleModel(
-                    parent_->delegate()->GetContentSettingBubbleModelDelegate(),
-                    web_contents, parent_->profile()),
-                web_contents, this, views::BubbleBorder::TOP_RIGHT);
-    views::Widget* bubble_widget =
-        views::BubbleDialogDelegateView::CreateBubble(bubble_view_);
-    bubble_widget->AddObserver(this);
-    // This is triggered by an input event. If the user clicks the icon while
-    // it's not animating, the icon will be placed in an active state, so the
-    // bubble doesn't need an arrow. If the user clicks during an animation,
-    // the animation simply pauses and no other visible state change occurs, so
-    // show the arrow in this case.
-    if (ui::MaterialDesignController::IsModeMaterial() && !pause_animation_) {
-      ink_drop_delegate_->OnAction(views::InkDropState::ACTIVATED);
-      bubble_view_->SetArrowPaintType(views::BubbleBorder::PAINT_TRANSPARENT);
-    }
-    bubble_widget->Show();
-  }
-}
-
 void ContentSettingImageView::UpdateImage() {
   SetImage(content_setting_image_model_->GetIcon(GetTextColor()).AsImageSkia());
   image()->SetTooltipText(content_setting_image_model_->get_tooltip());

diff --git a/chrome/browser/ui/views/location_bar/content_setting_image_view.h b/chrome/browser/ui/views/location_bar/content_setting_image_view.h
index af2b6c6..e6cc0d94 100644
--- a/chrome/browser/ui/views/location_bar/content_setting_image_view.h
+++ b/chrome/browser/ui/views/location_bar/content_setting_image_view.h

@@ -66,7 +66,6 @@
   void OnBoundsChanged(const gfx::Rect& previous_bounds) override;
   bool OnMousePressed(const ui::MouseEvent& event) override;
   void OnMouseReleased(const ui::MouseEvent& event) override;
-  bool OnKeyPressed(const ui::KeyEvent& event) override;
   void OnGestureEvent(ui::GestureEvent* event) override;
   void OnNativeThemeChanged(const ui::NativeTheme* native_theme) override;
   SkColor GetTextColor() const override;
@@ -74,6 +73,7 @@
   bool ShouldShowBackground() const override;
   double WidthMultiplier() const override;
   bool IsShrinking() const override;
+  bool OnActivate() override;
 
   // gfx::AnimationDelegate:
   void AnimationEnded(const gfx::Animation* animation) override;
@@ -84,10 +84,6 @@
   void OnWidgetDestroying(views::Widget* widget) override;
   void OnWidgetVisibilityChanged(views::Widget* widget, bool visible) override;
 
-  // Called when the user clicks the view; this freezes the animation or snaps
-  // it to its end state as necessary and then opens a content setting bubble.
-  void OnClick();
-
   // Updates the image and tooltip to match the current model state.
   void UpdateImage();
 

diff --git a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc
index 9612757b..67c376a 100644
--- a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc
+++ b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc

@@ -119,11 +119,21 @@
   return false;
 }
 
+bool IconLabelBubbleView::OnActivate() {
+  return false;
+}
+
 gfx::Size IconLabelBubbleView::GetPreferredSize() const {
   // Height will be ignored by the LocationBarView.
   return GetSizeForLabelWidth(label_->GetPreferredSize().width());
 }
 
+bool IconLabelBubbleView::OnKeyReleased(const ui::KeyEvent& event) {
+  if (event.key_code() != ui::VKEY_RETURN && event.key_code() != ui::VKEY_SPACE)
+    return false;
+  return OnActivate();
+}
+
 void IconLabelBubbleView::Layout() {
   // Compute the image bounds.  In non-MD, the leading padding depends on
   // whether this is an extension icon, since extension icons and

diff --git a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h
index 99ac8ad..11e1bbd 100644
--- a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h
+++ b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h

@@ -74,9 +74,14 @@
   // Returns true when animation is in progress and is shrinking.
   virtual bool IsShrinking() const;
 
+  // The view has been activated by a user gesture such as spacebar. Returns
+  // true if some handling was performed.
+  virtual bool OnActivate();
+
   // views::View:
   gfx::Size GetPreferredSize() const override;
   void Layout() override;
+  bool OnKeyReleased(const ui::KeyEvent& event) override;
   void OnNativeThemeChanged(const ui::NativeTheme* native_theme) override;
   void AddInkDropLayer(ui::Layer* ink_drop_layer) override;
   void RemoveInkDropLayer(ui::Layer* ink_drop_layer) override;

diff --git a/chrome/browser/ui/views/location_bar/location_icon_view.cc b/chrome/browser/ui/views/location_bar/location_icon_view.cc
index f1b4fc8d..8f66143 100644
--- a/chrome/browser/ui/views/location_bar/location_icon_view.cc
+++ b/chrome/browser/ui/views/location_bar/location_icon_view.cc

@@ -25,29 +25,6 @@
 using content::NavigationEntry;
 using content::WebContents;
 
-namespace {
-
-void ProcessEventInternal(LocationBarView* view) {
-  WebContents* contents = view->GetWebContents();
-  if (!contents)
-    return;
-
-  // Important to use GetVisibleEntry to match what's showing in the omnibox.
-  NavigationEntry* entry = contents->GetController().GetVisibleEntry();
-  // The visible entry can be nullptr in the case of window.open("").
-  if (!entry)
-    return;
-
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  DCHECK(model_client);
-
-  view->delegate()->ShowWebsiteSettings(contents, entry->GetURL(),
-                                        model_client->GetSecurityInfo());
-}
-
-}  // namespace
-
 LocationIconView::LocationIconView(const gfx::FontList& font_list,
                                    SkColor parent_background_color,
                                    LocationBarView* location_bar)
@@ -105,13 +82,6 @@
   return false;
 }
 
-bool LocationIconView::OnKeyReleased(const ui::KeyEvent& event) {
-  if (event.key_code() != ui::VKEY_RETURN && event.key_code() != ui::VKEY_SPACE)
-    return false;
-  ProcessEvent(event);
-  return true;
-}
-
 void LocationIconView::OnGestureEvent(ui::GestureEvent* event) {
   if (event->type() != ui::ET_GESTURE_TAP)
     return;
@@ -131,17 +101,12 @@
   // location bar is at the NTP.
   if (location_bar_->GetOmniboxView()->IsEditingOrEmpty())
     return;
-  ProcessEvent(event);
+  ProcessLocatedEvent(event);
 }
 
-void LocationIconView::ProcessEvent(const ui::LocatedEvent& event) {
-  if (!HitTestPoint(event.location()))
-    return;
-  ProcessEventInternal(location_bar_);
-}
-
-void LocationIconView::ProcessEvent(const ui::KeyEvent& event) {
-  ProcessEventInternal(location_bar_);
+void LocationIconView::ProcessLocatedEvent(const ui::LocatedEvent& event) {
+  if (HitTestPoint(event.location()))
+    OnActivate();
 }
 
 gfx::Size LocationIconView::GetMinimumSize() const {
@@ -163,6 +128,26 @@
   return GetTextColor();
 }
 
+bool LocationIconView::OnActivate() {
+  WebContents* contents = location_bar_->GetWebContents();
+  if (!contents)
+    return false;
+
+  // Important to use GetVisibleEntry to match what's showing in the omnibox.
+  NavigationEntry* entry = contents->GetController().GetVisibleEntry();
+  // The visible entry can be nullptr in the case of window.open("").
+  if (!entry)
+    return false;
+
+  ChromeSecurityStateModelClient* model_client =
+      ChromeSecurityStateModelClient::FromWebContents(contents);
+  DCHECK(model_client);
+
+  location_bar_->delegate()->ShowWebsiteSettings(
+      contents, entry->GetURL(), model_client->GetSecurityInfo());
+  return true;
+}
+
 gfx::Size LocationIconView::GetMinimumSizeForPreferredSize(
     gfx::Size size) const {
   const int kMinCharacters = 10;

diff --git a/chrome/browser/ui/views/location_bar/location_icon_view.h b/chrome/browser/ui/views/location_bar/location_icon_view.h
index 5593bba..537e14f 100644
--- a/chrome/browser/ui/views/location_bar/location_icon_view.h
+++ b/chrome/browser/ui/views/location_bar/location_icon_view.h

@@ -31,12 +31,12 @@
   bool OnMouseDragged(const ui::MouseEvent& event) override;
   void OnMouseReleased(const ui::MouseEvent& event) override;
   bool OnKeyPressed(const ui::KeyEvent& event) override;
-  bool OnKeyReleased(const ui::KeyEvent& event) override;
   void OnGestureEvent(ui::GestureEvent* event) override;
   bool GetTooltipText(const gfx::Point& p,
                       base::string16* tooltip) const override;
   SkColor GetTextColor() const override;
   SkColor GetBorderColor() const override;
+  bool OnActivate() override;
 
   // Whether we should show the tooltip for this icon or not.
   void set_show_tooltip(bool show_tooltip) { show_tooltip_ = show_tooltip; }
@@ -51,8 +51,7 @@
   void SetBackground(bool should_show_ev);
 
  private:
-  void ProcessEvent(const ui::LocatedEvent& event);
-  void ProcessEvent(const ui::KeyEvent& event);
+  void ProcessLocatedEvent(const ui::LocatedEvent& event);
 
   // Returns what the minimum size would be if the preferred size were |size|.
   gfx::Size GetMinimumSizeForPreferredSize(gfx::Size size) const;

diff --git a/chrome/browser/ui/webui/snippets_internals_message_handler.cc b/chrome/browser/ui/webui/snippets_internals_message_handler.cc
index 363919fb..bd3fe9e4 100644
--- a/chrome/browser/ui/webui/snippets_internals_message_handler.cc
+++ b/chrome/browser/ui/webui/snippets_internals_message_handler.cc

@@ -122,6 +122,8 @@
     const base::ListValue* args) {
   DCHECK_EQ(1u, args->GetSize());
 
+  SendString("hosts-status", std::string());
+
   std::string hosts_string;
   args->GetString(0, &hosts_string);
 
@@ -160,6 +162,10 @@
   result.Set("list", std::move(snippets_list));
   web_ui()->CallJavascriptFunction("chrome.SnippetsInternals.receiveSnippets",
                                    result);
+
+  const std::string& status = ntp_snippets_service_->last_status();
+  if (!status.empty())
+    SendString("hosts-status", "Finished: " + status);
 }
 
 void SnippetsInternalsMessageHandler::SendDiscardedSnippets() {

diff --git a/components/cronet/android/test/quic_test_server.cc b/components/cronet/android/test/quic_test_server.cc
index 8f21eae7..4ad572d4 100644
--- a/components/cronet/android/test/quic_test_server.cc
+++ b/components/cronet/android/test/quic_test_server.cc

@@ -13,6 +13,7 @@
 #include "base/threading/thread.h"
 #include "components/cronet/android/test/cronet_test_util.h"
 #include "jni/QuicTestServer_jni.h"
+#include "net/base/ip_address.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/test_data_directory.h"
 #include "net/quic/crypto/proof_source_chromium.h"
@@ -37,8 +38,6 @@
   CHECK(base::PathExists(file_dir)) << "Quic data does not exist";
   net::QuicInMemoryCache::GetInstance()->InitializeFromDirectory(
       file_dir.value());
-  net::IPAddressNumber ip;
-  net::ParseIPLiteralToNumber(kFakeQuicDomain, &ip);
   net::QuicConfig config;
 
   // Set up server certs.
@@ -55,7 +54,8 @@
                                             net::QuicSupportedVersions());
 
   // Start listening.
-  int rv = g_quic_server->Listen(net::IPEndPoint(ip, kServerPort));
+  int rv = g_quic_server->Listen(
+      net::IPEndPoint(net::IPAddress::IPv4AllZeros(), kServerPort));
   CHECK_GE(rv, 0) << "Quic server fails to start";
   JNIEnv* env = base::android::AttachCurrentThread();
   Java_QuicTestServer_onServerStarted(env);

diff --git a/components/cronet/ios/test/quic_test_server.cc b/components/cronet/ios/test/quic_test_server.cc
index 581d737b..28f1b55 100644
--- a/components/cronet/ios/test/quic_test_server.cc
+++ b/components/cronet/ios/test/quic_test_server.cc

@@ -10,6 +10,7 @@
 #include "base/path_service.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/threading/thread.h"
+#include "net/base/ip_address.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/test_data_directory.h"
 #include "net/quic/crypto/proof_source_chromium.h"
@@ -18,9 +19,6 @@
 
 namespace cronet {
 
-// This must match the certificate used (quic_test.example.com.crt and
-// quic_test.example.com.key.pkcs8).
-const char kFakeQuicDomain[] = "test.example.com";
 static const int kServerPort = 6121;
 
 base::Thread* g_quic_server_thread = nullptr;
@@ -38,8 +36,6 @@
   net::QuicInMemoryCache::GetInstance()->InitializeFromDirectory(
       file_dir.value());
    */
-  net::IPAddressNumber ip;
-  net::ParseIPLiteralToNumber(kFakeQuicDomain, &ip);
   net::QuicConfig config;
 
   // Set up server certs.
@@ -57,7 +53,8 @@
                                             net::QuicSupportedVersions());
 
   // Start listening.
-  int rv = g_quic_server->Listen(net::IPEndPoint(ip, kServerPort));
+  int rv = g_quic_server->Listen(
+      net::IPEndPoint(net::IPAddress::IPv4AllZeros(), kServerPort));
   CHECK_GE(rv, 0) << "Quic server fails to start";
   server_started_event->Signal();
 }

diff --git a/components/mus/demo/manifest.json b/components/mus/demo/manifest.json
index 38e442a3..6f7f61d7 100644
--- a/components/mus/demo/manifest.json
+++ b/components/mus/demo/manifest.json

@@ -1,12 +1,6 @@
 {
-  "manifest_version":  1,
   "name": "mojo:mus_demo",
   "display_name": "MUS Demo",
-  "capabilities": {
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes":  ["mus:window_tree_host_factory"] }
-    }
-  }
+  "capabilities": { "*": ["*"] }
 }
 

diff --git a/components/mus/manifest.json b/components/mus/manifest.json
index bf001cf1..ca144d18b 100644
--- a/components/mus/manifest.json
+++ b/components/mus/manifest.json

@@ -3,27 +3,9 @@
   "name": "mojo:mus",
   "display_name": "UI Service",
   "capabilities": {
-    "provided": {
-      "mus:core": [
-        "mus::mojom::DisplayManager",
-        "mus::mojom::Gpu",
-        "mus::mojom::WindowTreeFactory"
-      ],
-      "mus:user": [
-        "mus::mojom::UserAccessManager"
-      ],
-      "mus:window_tree_host_factory": [
-        "mus::mojom::WindowTreeHostFactory"
-      ],
-      "mus:gpu": [
-        "mus::mojom::Gpu"
-      ],
-      "mus:window_manager": [
-        "mus::mojom::WindowManagerFactoryService"
-      ]
-    },
     "required": {
-      "mojo:shell": { "classes": [ "shell:all_users", "shell:explicit_class" ] }
+      "*": { "interfaces": [ "*" ] },
+      "mojo:shell": { "classes": [ "all_users" ] }
     }
   }
 }

diff --git a/components/mus/ws/mus_ws_unittests_app_manifest.json b/components/mus/ws/mus_ws_unittests_app_manifest.json
index cdb8afd..ad68fd6c 100644
--- a/components/mus/ws/mus_ws_unittests_app_manifest.json
+++ b/components/mus/ws/mus_ws_unittests_app_manifest.json

@@ -1,14 +1,5 @@
 {
-  "manifest_version": 1,
   "name": "mojo:mus_ws_unittests_app",
   "display_name": "Mus Window Server Unittests",
-  "capabilities": {
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": {
-        "classes": [ "mus:core" ],
-        "interfaces":  [ "mus::mojom::WindowTreeHostFactory" ]
-      }
-    }
-  }
+  "capabilities": { "*": [ "*" ] }
 }

diff --git a/components/ntp_snippets/ntp_snippets_fetcher.cc b/components/ntp_snippets/ntp_snippets_fetcher.cc
index c0eb082..0dbf702 100644
--- a/components/ntp_snippets/ntp_snippets_fetcher.cc
+++ b/components/ntp_snippets/ntp_snippets_fetcher.cc

@@ -7,6 +7,7 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/path_service.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/task_runner_util.h"
@@ -24,6 +25,11 @@
 
 namespace ntp_snippets {
 
+namespace {
+
+const char kStatusMessageURLRequestErrorFormat[] = "URLRequestStatus error %d";
+const char kStatusMessageHTTPErrorFormat[] = "HTTP error %d";
+
 const char kContentSnippetsServerFormat[] =
     "https://chromereader-pa.googleapis.com/v1/fetch?key=%s";
 
@@ -61,6 +67,8 @@
     "        \"value\": \"%s\""
     "      }";
 
+}  // namespace
+
 NTPSnippetsFetcher::NTPSnippetsFetcher(
     scoped_refptr<base::SequencedTaskRunner> file_task_runner,
     scoped_refptr<URLRequestContextGetter> url_request_context_getter,
@@ -110,25 +118,27 @@
 void NTPSnippetsFetcher::OnURLFetchComplete(const URLFetcher* source) {
   DCHECK_EQ(url_fetcher_.get(), source);
 
+  std::string message;
   const URLRequestStatus& status = source->GetStatus();
   if (!status.is_success()) {
-    DLOG(WARNING) << "URLRequestStatus error " << status.error()
-                  << " while trying to download " << source->GetURL().spec();
-    return;
-  }
-
-  int response_code = source->GetResponseCode();
-  if (response_code != net::HTTP_OK) {
-    DLOG(WARNING) << "HTTP error " << response_code
-                  << " while trying to download " << source->GetURL().spec();
-    return;
+    message = base::StringPrintf(kStatusMessageURLRequestErrorFormat,
+                                 status.error());
+  } else if (source->GetResponseCode() != net::HTTP_OK) {
+    message = base::StringPrintf(kStatusMessageHTTPErrorFormat,
+                                 source->GetResponseCode());
   }
 
   std::string response;
-  bool stores_result_to_string = source->GetResponseAsString(&response);
-  DCHECK(stores_result_to_string);
+  if (!message.empty()) {
+    DLOG(WARNING) << message << " while trying to download "
+                  << source->GetURL().spec();
 
-  callback_list_.Notify(response);
+  } else {
+    bool stores_result_to_string = source->GetResponseAsString(&response);
+    DCHECK(stores_result_to_string);
+  }
+
+  callback_list_.Notify(response, message);
 }
 
 }  // namespace ntp_snippets

diff --git a/components/ntp_snippets/ntp_snippets_fetcher.h b/components/ntp_snippets/ntp_snippets_fetcher.h
index ae7fd6c9..1c0b7d4 100644
--- a/components/ntp_snippets/ntp_snippets_fetcher.h
+++ b/components/ntp_snippets/ntp_snippets_fetcher.h

@@ -21,9 +21,13 @@
 // Fetches snippet data for the NTP from the server
 class NTPSnippetsFetcher : public net::URLFetcherDelegate {
  public:
-  using SnippetsAvailableCallback = base::Callback<void(const std::string&)>;
+  // If problems occur (explained in |status_message|), |snippets_json| is
+  // empty; otherwise, |status_message| is empty.
+  using SnippetsAvailableCallback =
+      base::Callback<void(const std::string& snippets_json,
+                          const std::string& status_message)>;
   using SnippetsAvailableCallbackList =
-      base::CallbackList<void(const std::string&)>;
+      base::CallbackList<void(const std::string&, const std::string&)>;
 
   NTPSnippetsFetcher(
       scoped_refptr<base::SequencedTaskRunner> file_task_runner,

diff --git a/components/ntp_snippets/ntp_snippets_service.cc b/components/ntp_snippets/ntp_snippets_service.cc
index 84dfaecd..84a13b1e 100644
--- a/components/ntp_snippets/ntp_snippets_service.cc
+++ b/components/ntp_snippets/ntp_snippets_service.cc

@@ -15,6 +15,7 @@
 #include "base/location.h"
 #include "base/path_service.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/stringprintf.h"
 #include "base/task_runner_util.h"
 #include "base/time/time.h"
 #include "base/values.h"
@@ -43,6 +44,11 @@
 
 const int kDefaultExpiryTimeMins = 24 * 60;
 
+const char kStatusMessageEmptyHosts[] = "Cannot fetch for empty hosts list.";
+const char kStatusMessageEmptyList[] = "Invalid / empty list.";
+const char kStatusMessageJsonErrorFormat[] = "Received invalid JSON (error %s)";
+const char kStatusMessageOK[] = "OK";
+
 base::TimeDelta GetFetchingInterval(const char* switch_name,
                                     int default_value_seconds) {
   int value_seconds = default_value_seconds;
@@ -232,8 +238,12 @@
     snippets_fetcher_->FetchSnippets(std::set<std::string>());
     return;
   }
-  if (!hosts.empty())
+  if (!hosts.empty()) {
     snippets_fetcher_->FetchSnippets(hosts);
+  } else {
+    last_fetch_status_ = kStatusMessageEmptyHosts;
+    LoadingSnippetsFinished();
+  }
 }
 
 void NTPSnippetsService::RescheduleFetching() {
@@ -324,23 +334,42 @@
 }
 
 void NTPSnippetsService::OnSnippetsDownloaded(
-    const std::string& snippets_json) {
-  parse_json_callback_.Run(
-      snippets_json, base::Bind(&NTPSnippetsService::OnJsonParsed,
-                                weak_ptr_factory_.GetWeakPtr(), snippets_json),
-      base::Bind(&NTPSnippetsService::OnJsonError,
-                 weak_ptr_factory_.GetWeakPtr(), snippets_json));
+    const std::string& snippets_json, const std::string& status) {
+
+  if (!snippets_json.empty()) {
+    DCHECK(status.empty());
+
+    parse_json_callback_.Run(
+        snippets_json,
+        base::Bind(&NTPSnippetsService::OnJsonParsed,
+                   weak_ptr_factory_.GetWeakPtr(), snippets_json),
+        base::Bind(&NTPSnippetsService::OnJsonError,
+                   weak_ptr_factory_.GetWeakPtr(), snippets_json));
+  } else {
+    last_fetch_status_ = status;
+    LoadingSnippetsFinished();
+  }
 }
 
 void NTPSnippetsService::OnJsonParsed(const std::string& snippets_json,
                                       scoped_ptr<base::Value> parsed) {
-  LOG_IF(WARNING, !LoadFromValue(*parsed)) << "Received invalid snippets: "
-                                           << snippets_json;
+  if (!LoadFromValue(*parsed)) {
+    LOG(WARNING) << "Received invalid snippets: " << snippets_json;
+    last_fetch_status_ = kStatusMessageEmptyList;
+  } else {
+    last_fetch_status_ = kStatusMessageOK;
+  }
+
+  LoadingSnippetsFinished();
 }
 
 void NTPSnippetsService::OnJsonError(const std::string& snippets_json,
                                      const std::string& error) {
   LOG(WARNING) << "Received invalid JSON (" << error << "): " << snippets_json;
+  last_fetch_status_ = base::StringPrintf(kStatusMessageJsonErrorFormat,
+                                          error.c_str());
+
+  LoadingSnippetsFinished();
 }
 
 bool NTPSnippetsService::LoadFromValue(const base::Value& value) {
@@ -385,16 +414,14 @@
                    std::make_move_iterator(new_snippets.begin()),
                    std::make_move_iterator(new_snippets.end()));
 
-  // Immediately remove any already-expired snippets. This will also notify our
-  // observers and schedule the expiry timer.
-  RemoveExpiredSnippets();
-
   return true;
 }
 
 void NTPSnippetsService::LoadSnippetsFromPrefs() {
   bool success = LoadFromListValue(*pref_service_->GetList(prefs::kSnippets));
   DCHECK(success) << "Failed to parse snippets from prefs";
+
+  LoadingSnippetsFinished();
 }
 
 void NTPSnippetsService::StoreSnippetsToPrefs() {
@@ -434,7 +461,8 @@
   pref_service_->Set(prefs::kSnippetHosts, list);
 }
 
-void NTPSnippetsService::RemoveExpiredSnippets() {
+void NTPSnippetsService::LoadingSnippetsFinished() {
+  // Remove expired snippets.
   base::Time expiry = base::Time::Now();
 
   snippets_.erase(
@@ -471,7 +499,7 @@
   }
   DCHECK_GT(next_expiry, expiry);
   expiry_timer_.Start(FROM_HERE, next_expiry - expiry,
-                      base::Bind(&NTPSnippetsService::RemoveExpiredSnippets,
+                      base::Bind(&NTPSnippetsService::LoadingSnippetsFinished,
                                  base::Unretained(this)));
 }
 

diff --git a/components/ntp_snippets/ntp_snippets_service.h b/components/ntp_snippets/ntp_snippets_service.h
index c7a32443..e6dac62e 100644
--- a/components/ntp_snippets/ntp_snippets_service.h
+++ b/components/ntp_snippets/ntp_snippets_service.h

@@ -79,6 +79,11 @@
   // suggestions from the suggestion service) and adds them to the current ones.
   void FetchSnippetsFromHosts(const std::set<std::string>& hosts);
 
+  // Returns the last status message from the snippets fetcher.
+  const std::string& last_status() const {
+    return last_fetch_status_;
+  }
+
   // (Re)schedules the periodic fetching of snippets. This is necessary because
   // the schedule depends on the time of day
   void RescheduleFetching();
@@ -123,7 +128,8 @@
   friend class NTPSnippetsServiceTest;
 
   void OnSuggestionsChanged(const suggestions::SuggestionsProfile& suggestions);
-  void OnSnippetsDownloaded(const std::string& snippets_json);
+  void OnSnippetsDownloaded(const std::string& snippets_json,
+                            const std::string& status);
 
   void OnJsonParsed(const std::string& snippets_json,
                     scoped_ptr<base::Value> parsed);
@@ -148,7 +154,7 @@
   std::set<std::string> GetSnippetHostsFromPrefs() const;
   void StoreSnippetHostsToPrefs(const std::set<std::string>& hosts);
 
-  void RemoveExpiredSnippets();
+  void LoadingSnippetsFinished();
 
   bool enabled_;
 
@@ -189,6 +195,8 @@
   scoped_ptr<NTPSnippetsFetcher::SnippetsAvailableCallbackList::Subscription>
       snippets_fetcher_subscription_;
 
+  std::string last_fetch_status_;
+
   // Timer that calls us back when the next snippet expires.
   base::OneShotTimer expiry_timer_;
 

diff --git a/components/ntp_snippets/ntp_snippets_service_unittest.cc b/components/ntp_snippets/ntp_snippets_service_unittest.cc
index 8f49824ed..532385cf 100644
--- a/components/ntp_snippets/ntp_snippets_service_unittest.cc
+++ b/components/ntp_snippets/ntp_snippets_service_unittest.cc

@@ -156,7 +156,7 @@
   NTPSnippetsService* service() { return service_.get(); }
 
   void LoadFromJSONString(const std::string& json) {
-    service_->OnSnippetsDownloaded(json);
+    service_->OnSnippetsDownloaded(json, std::string());
   }
 
   void SetExpectJsonParseSuccess(bool expect_success) {

diff --git a/components/resource_provider/manifest.json b/components/resource_provider/manifest.json
index 1b057ca..d02e9b3 100644
--- a/components/resource_provider/manifest.json
+++ b/components/resource_provider/manifest.json

@@ -4,7 +4,7 @@
   "display_name": "Resource Provider",
   "capabilities": {
     "required": {
-      "mojo:shell": { "classes": [ "shell:all_users" ] }
+      "mojo:shell": { "classes": [ "all_users" ] }
     }
   }
 }

diff --git a/content/browser/service_worker/embedded_worker_instance.cc b/content/browser/service_worker/embedded_worker_instance.cc
index db93afa..f6f4638 100644
--- a/content/browser/service_worker/embedded_worker_instance.cc
+++ b/content/browser/service_worker/embedded_worker_instance.cc

@@ -810,6 +810,14 @@
   return duration;
 }
 
+void EmbeddedWorkerInstance::AddMessageToConsole(ConsoleMessageLevel level,
+                                                 const std::string& message) {
+  if (status_ != RUNNING && status_ != STARTING)
+    return;
+  registry_->Send(process_id(), new EmbeddedWorkerMsg_AddMessageToConsole(
+                                    embedded_worker_id_, level, message));
+}
+
 // static
 std::string EmbeddedWorkerInstance::StatusToString(Status status) {
   switch (status) {

diff --git a/content/browser/service_worker/embedded_worker_instance.h b/content/browser/service_worker/embedded_worker_instance.h
index 1da7e13..9356bb53 100644
--- a/content/browser/service_worker/embedded_worker_instance.h
+++ b/content/browser/service_worker/embedded_worker_instance.h

@@ -23,6 +23,7 @@
 #include "content/browser/service_worker/service_worker_metrics.h"
 #include "content/common/content_export.h"
 #include "content/common/service_worker/service_worker_status_code.h"
+#include "content/public/common/console_message_level.h"
 #include "url/gurl.h"
 
 // Windows headers will redefine SendMessage.
@@ -180,6 +181,10 @@
   // created. Not called for import scripts.
   void OnURLJobCreatedForMainScript();
 
+  // Add message to the devtools console.
+  void AddMessageToConsole(ConsoleMessageLevel level,
+                           const std::string& message);
+
   static std::string StatusToString(Status status);
   static std::string StartingPhaseToString(StartingPhase phase);
 

diff --git a/content/browser/service_worker/service_worker_write_to_cache_job.cc b/content/browser/service_worker/service_worker_write_to_cache_job.cc
index b1e7d4b..2053d48 100644
--- a/content/browser/service_worker/service_worker_write_to_cache_job.cc
+++ b/content/browser/service_worker/service_worker_write_to_cache_job.cc

@@ -435,17 +435,8 @@
     const net::URLRequestStatus& status,
     const std::string& status_message) {
   DCHECK(!status.is_io_pending());
-
-  net::Error error = NotifyFinishedCaching(status, status_message);
-  // The special case mentioned in NotifyFinishedCaching about script being
-  // identical does not apply here, since the entire body needs to be read
-  // before this is relevant.
-  DCHECK_EQ(status.error(), error);
-
-  net::URLRequestStatus reported_status = status;
-  std::string reported_status_message = status_message;
-
-  NotifyStartError(reported_status);
+  NotifyFinishedCaching(status, status_message);
+  NotifyStartError(status);
 }
 
 net::Error ServiceWorkerWriteToCacheJob::NotifyFinishedCaching(
@@ -455,6 +446,15 @@
   if (did_notify_finished_)
     return result;
 
+  if (status.status() != net::URLRequestStatus::SUCCESS) {
+    // AddMessageToConsole must be called before this job notifies that an error
+    // occurred because the worker stops soon after receiving the error
+    // response.
+    version_->embedded_worker()->AddMessageToConsole(
+        CONSOLE_MESSAGE_LEVEL_ERROR,
+        status_message.empty() ? kFetchScriptError : status_message);
+  }
+
   int size = -1;
   if (status.is_success())
     size = cache_writer_->bytes_written();

diff --git a/content/child/blink_platform_impl.cc b/content/child/blink_platform_impl.cc
index 3d432ccf..18016bb1 100644
--- a/content/child/blink_platform_impl.cc
+++ b/content/child/blink_platform_impl.cc

@@ -418,15 +418,6 @@
 BlinkPlatformImpl::~BlinkPlatformImpl() {
 }
 
-WebURLLoader* BlinkPlatformImpl::createURLLoader() {
-  ChildThreadImpl* child_thread = ChildThreadImpl::current();
-  // There may be no child thread in RenderViewTests.  These tests can still use
-  // data URLs to bypass the ResourceDispatcher.
-  return new WebURLLoaderImpl(
-      child_thread ? child_thread->resource_dispatcher() : NULL,
-      base::WrapUnique(currentThread()->getWebTaskRunner()->clone()));
-}
-
 blink::WebSocketHandle* BlinkPlatformImpl::createWebSocketHandle() {
   return new WebSocketBridge;
 }

diff --git a/content/child/blink_platform_impl.h b/content/child/blink_platform_impl.h
index 51b427d..d0c7a17c 100644
--- a/content/child/blink_platform_impl.h
+++ b/content/child/blink_platform_impl.h

@@ -85,7 +85,6 @@
 
   size_t maxDecodedImageBytes() override;
   uint32_t getUniqueIdForProcess() override;
-  blink::WebURLLoader* createURLLoader() override;
   blink::WebSocketHandle* createWebSocketHandle() override;
   blink::WebString userAgent() override;
   blink::WebData parseDataURL(const blink::WebURL& url,

diff --git a/content/common/service_worker/embedded_worker_messages.h b/content/common/service_worker/embedded_worker_messages.h
index 86fb48c..a245c4e0 100644
--- a/content/common/service_worker/embedded_worker_messages.h
+++ b/content/common/service_worker/embedded_worker_messages.h

@@ -9,6 +9,7 @@
 #include <string>
 
 #include "content/common/service_worker/embedded_worker_settings.h"
+#include "content/public/common/console_message_level.h"
 #include "content/public/common/web_preferences.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_message_macros.h"
@@ -62,6 +63,12 @@
 IPC_MESSAGE_CONTROL1(EmbeddedWorkerMsg_StopWorker,
                      int /* embedded_worker_id */)
 
+// Browser -> Renderer message to add message to the devtools console.
+IPC_MESSAGE_CONTROL3(EmbeddedWorkerMsg_AddMessageToConsole,
+                     int /* embedded_worker_id */,
+                     content::ConsoleMessageLevel /* level */,
+                     std::string /* message */)
+
 // Renderer -> Browser message to indicate that the worker is ready for
 // inspection.
 IPC_MESSAGE_CONTROL1(EmbeddedWorkerHostMsg_WorkerReadyForInspection,

diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index 33e6eda8..0f296389 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java

@@ -1476,7 +1476,7 @@
     private void hidePopups() {
         hideSelectActionMode();
         hidePastePopup();
-        hideSelectPopup();
+        hideSelectPopupWithCancelMesage();
         mPopupZoomer.hide(false);
         if (mUnselectAllOnActionModeDismiss) dismissTextHandles();
     }
@@ -2551,7 +2551,18 @@
      */
     @CalledByNative
     private void hideSelectPopup() {
-        if (mSelectPopup != null) mSelectPopup.hide();
+        if (mSelectPopup == null) return;
+        mSelectPopup.hide(false);
+        mSelectPopup = null;
+        mNativeSelectPopupSourceFrame = 0;
+    }
+
+    /**
+     * Called when the <select> popup needs to be hidden. This calls
+     * nativeSelectPopupMenuItems() with null indices.
+     */
+    private void hideSelectPopupWithCancelMesage() {
+        if (mSelectPopup != null) mSelectPopup.hide(true);
     }
 
     /**

diff --git a/content/public/android/java/src/org/chromium/content/browser/input/SelectPopup.java b/content/public/android/java/src/org/chromium/content/browser/input/SelectPopup.java
index bd5abef..cc2dd2bb 100644
--- a/content/public/android/java/src/org/chromium/content/browser/input/SelectPopup.java
+++ b/content/public/android/java/src/org/chromium/content/browser/input/SelectPopup.java

@@ -15,5 +15,5 @@
     /**
      * Hides the popup.
      */
-    public void hide();
+    public void hide(boolean sendsCancelMessage);
 }

diff --git a/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java b/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java
index 09ace74..609734f 100644
--- a/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java
+++ b/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java

@@ -144,8 +144,13 @@
     }
 
     @Override
-    public void hide() {
-        mListBoxPopup.cancel();
-        notifySelection(null);
+    public void hide(boolean sendsCancelMessage) {
+        if (sendsCancelMessage) {
+            mListBoxPopup.cancel();
+            notifySelection(null);
+        } else {
+            mSelectionNotified = true;
+            mListBoxPopup.cancel();
+        }
     }
 }

diff --git a/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDropdown.java b/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDropdown.java
index 707ad2c..b5989cf 100644
--- a/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDropdown.java
+++ b/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDropdown.java

@@ -39,7 +39,7 @@
             @Override
             public void onItemClick(AdapterView<?> parent, View view, int position, long id) {
                 notifySelection(new int[] {position});
-                hide();
+                hide(false);
             }
         });
         if (selected.length > 0) {
@@ -81,8 +81,13 @@
     }
 
     @Override
-    public void hide() {
-        mDropdownPopupWindow.dismiss();
-        notifySelection(null);
+    public void hide(boolean sendsCancelMessage) {
+        if (sendsCancelMessage) {
+            mDropdownPopupWindow.dismiss();
+            notifySelection(null);
+        } else {
+            mSelectionNotified = true;
+            mDropdownPopupWindow.dismiss();
+        }
     }
 }

diff --git a/content/public/app/mojo/content_browser_manifest.json b/content/public/app/mojo/content_browser_manifest.json
index ab043e4..c560fdc 100644
--- a/content/public/app/mojo/content_browser_manifest.json
+++ b/content/public/app/mojo/content_browser_manifest.json

@@ -7,11 +7,7 @@
     "required": {
       "*": { "interfaces": [ "*" ] },
       "mojo:shell": {
-        "classes": [
-          "shell:client_process",
-          "shell:instance_name",
-          "shell:user_id"
-        ],
+        "classes": [ "client_process", "instance_name", "user_id" ],
         "interfaces": [ "*" ]
       }
     }

diff --git a/content/public/app/mojo/content_renderer_manifest.json b/content/public/app/mojo/content_renderer_manifest.json
index 4287606..053edd0 100644
--- a/content/public/app/mojo/content_renderer_manifest.json
+++ b/content/public/app/mojo/content_renderer_manifest.json

@@ -1,10 +1,5 @@
 {
-  "manifest_version":  1,
   "name": "exe:content_renderer",
   "display_name": "Content Renderer",
-  "capabilities": {
-    "required": {
-      "mojo:mus": { "classes": [ "mus:gpu" ] }
-    }
-  }
+  "capabilities": { "mojo:mus": [ "mus::mojom::Gpu" ] }
 }

diff --git a/content/renderer/media/video_track_recorder.cc b/content/renderer/media/video_track_recorder.cc
index 8272eeef..09e478e7 100644
--- a/content/renderer/media/video_track_recorder.cc
+++ b/content/renderer/media/video_track_recorder.cc

@@ -360,9 +360,9 @@
   DCHECK_EQ(240u, codec_config_.g_h);
   DCHECK_EQ(256u, codec_config_.rc_target_bitrate);
   // Use the selected bitrate or adjust default bit rate to account for the
-  // actual size.
+  // actual size.  Note: |rc_target_bitrate| units are kbit per second.
   if (bits_per_second_ > 0) {
-    codec_config_.rc_target_bitrate = bits_per_second_;
+    codec_config_.rc_target_bitrate = bits_per_second_ / 1000;
   } else {
     codec_config_.rc_target_bitrate = size.GetArea() *
                                       codec_config_.rc_target_bitrate /

diff --git a/content/renderer/service_worker/embedded_worker_dispatcher.cc b/content/renderer/service_worker/embedded_worker_dispatcher.cc
index c3cfb32..ec12c06d 100644
--- a/content/renderer/service_worker/embedded_worker_dispatcher.cc
+++ b/content/renderer/service_worker/embedded_worker_dispatcher.cc

@@ -21,6 +21,7 @@
 #include "content/renderer/service_worker/service_worker_context_client.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
+#include "third_party/WebKit/public/web/WebConsoleMessage.h"
 #include "third_party/WebKit/public/web/WebEmbeddedWorker.h"
 #include "third_party/WebKit/public/web/WebEmbeddedWorkerStartData.h"
 
@@ -56,6 +57,8 @@
     IPC_MESSAGE_HANDLER(EmbeddedWorkerMsg_StopWorker, OnStopWorker)
     IPC_MESSAGE_HANDLER(EmbeddedWorkerMsg_ResumeAfterDownload,
                         OnResumeAfterDownload)
+    IPC_MESSAGE_HANDLER(EmbeddedWorkerMsg_AddMessageToConsole,
+                        OnAddMessageToConsole)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
@@ -133,4 +136,31 @@
   wrapper->worker()->resumeAfterDownload();
 }
 
+void EmbeddedWorkerDispatcher::OnAddMessageToConsole(
+    int embedded_worker_id,
+    ConsoleMessageLevel level,
+    const std::string& message) {
+  WorkerWrapper* wrapper = workers_.Lookup(embedded_worker_id);
+  if (!wrapper)
+    return;
+  blink::WebConsoleMessage::Level target_level =
+      blink::WebConsoleMessage::LevelLog;
+  switch (level) {
+    case CONSOLE_MESSAGE_LEVEL_DEBUG:
+      target_level = blink::WebConsoleMessage::LevelDebug;
+      break;
+    case CONSOLE_MESSAGE_LEVEL_LOG:
+      target_level = blink::WebConsoleMessage::LevelLog;
+      break;
+    case CONSOLE_MESSAGE_LEVEL_WARNING:
+      target_level = blink::WebConsoleMessage::LevelWarning;
+      break;
+    case CONSOLE_MESSAGE_LEVEL_ERROR:
+      target_level = blink::WebConsoleMessage::LevelError;
+      break;
+  }
+  wrapper->worker()->addMessageToConsole(blink::WebConsoleMessage(
+      target_level, blink::WebString::fromUTF8(message)));
+}
+
 }  // namespace content

diff --git a/content/renderer/service_worker/embedded_worker_dispatcher.h b/content/renderer/service_worker/embedded_worker_dispatcher.h
index f118d58..e77086f7 100644
--- a/content/renderer/service_worker/embedded_worker_dispatcher.h
+++ b/content/renderer/service_worker/embedded_worker_dispatcher.h

@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
+#include "content/public/common/console_message_level.h"
 #include "ipc/ipc_listener.h"
 
 struct EmbeddedWorkerMsg_StartWorker_Params;
@@ -35,6 +36,9 @@
   void OnStartWorker(const EmbeddedWorkerMsg_StartWorker_Params& params);
   void OnStopWorker(int embedded_worker_id);
   void OnResumeAfterDownload(int embedded_worker_id);
+  void OnAddMessageToConsole(int embedded_worker_id,
+                             ConsoleMessageLevel level,
+                             const std::string& message);
 
   IDMap<WorkerWrapper, IDMapOwnPointer> workers_;
   std::map<int /* embedded_worker_id */, base::TimeTicks> stop_worker_times_;

diff --git a/content/test/test_blink_web_unit_test_support.cc b/content/test/test_blink_web_unit_test_support.cc
index b9b1532..f3f9fc4 100644
--- a/content/test/test_blink_web_unit_test_support.cc
+++ b/content/test/test_blink_web_unit_test_support.cc

@@ -21,6 +21,7 @@
 #include "components/scheduler/renderer/renderer_scheduler_impl.h"
 #include "components/scheduler/renderer/webthread_impl_for_renderer_scheduler.h"
 #include "components/scheduler/test/lazy_scheduler_message_loop_delegate_for_tests.h"
+#include "content/child/web_url_loader_impl.h"
 #include "content/test/mock_webclipboard_impl.h"
 #include "content/test/web_gesture_curve_mock.h"
 #include "media/base/media.h"
@@ -30,6 +31,8 @@
 #include "third_party/WebKit/public/platform/WebData.h"
 #include "third_party/WebKit/public/platform/WebPluginListBuilder.h"
 #include "third_party/WebKit/public/platform/WebString.h"
+#include "third_party/WebKit/public/platform/WebTaskRunner.h"
+#include "third_party/WebKit/public/platform/WebThread.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/web/WebKit.h"
 #include "third_party/WebKit/public/web/WebNetworkStateNotifier.h"
@@ -185,8 +188,12 @@
 }
 
 blink::WebURLLoader* TestBlinkWebUnitTestSupport::createURLLoader() {
-  return url_loader_factory_->createURLLoader(
-      BlinkPlatformImpl::createURLLoader());
+  blink::WebThread* currentThread = Platform::current()->currentThread();
+  // This loader should be used only for process-local resources such as
+  // data URLs.
+  blink::WebURLLoader* default_loader = new WebURLLoaderImpl(
+      nullptr, base::WrapUnique(currentThread->getWebTaskRunner()->clone()));
+  return url_loader_factory_->createURLLoader(default_loader);
 }
 
 blink::WebString TestBlinkWebUnitTestSupport::userAgent() {

diff --git a/mash/catalog_viewer/manifest.json b/mash/catalog_viewer/manifest.json
index 3009224..c8913020 100644
--- a/mash/catalog_viewer/manifest.json
+++ b/mash/catalog_viewer/manifest.json

@@ -3,10 +3,7 @@
   "name": "mojo:catalog_viewer",
   "display_name": "Catalog Viewer",
   "capabilities": {
-    "provided": { "mash:launchable": ["mash::mojom::Launchable"] },
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes": [ "mus:core" ] }
-    }
+    "provided": { "launchable": ["mash::mojom::Launchable"] },
+    "required": { "*": { "interfaces": [ "*" ] } }
   }
 }

diff --git a/mash/example/views_examples/manifest.json b/mash/example/views_examples/manifest.json
index a5c495c8..950431f 100644
--- a/mash/example/views_examples/manifest.json
+++ b/mash/example/views_examples/manifest.json

@@ -3,10 +3,7 @@
   "name": "mojo:views_examples",
   "display_name": "Views Examples",
   "capabilities": {
-    "provided": { "mash:launchable": ["mash::mojom::Launchable"] },
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes": [ "mus:core" ] }
-    }
+    "provided": { "launchable": ["mash::mojom::Launchable"] },
+    "required": { "*": { "interfaces": [ "*" ] } }
   }
 }

diff --git a/mash/example/window_type_launcher/manifest.json b/mash/example/window_type_launcher/manifest.json
index d104e3a..c676a3b 100644
--- a/mash/example/window_type_launcher/manifest.json
+++ b/mash/example/window_type_launcher/manifest.json

@@ -1,12 +1,5 @@
 {
-  "manifest_version":  1,
   "name": "exe:window_type_launcher_exe",
   "display_name": "Window Type Launcher",
-  "capabilities": {
-    "provided": { "mash:launchable": ["mash::mojom::Launchable"] },
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes": [ "mus:core" ] }
-    }
-  }
+  "capabilities": { "*": ["*"] }
 }

diff --git a/mash/init/manifest.json b/mash/init/manifest.json
index f477717..70c79e2 100644
--- a/mash/init/manifest.json
+++ b/mash/init/manifest.json

@@ -5,7 +5,7 @@
   "capabilities": {
     "required": {
       "*": { "interfaces": [ "*" ] },
-      "mojo:shell": { "classes": ["shell:user_id", "shell:all_users"] }
+      "mojo:shell": { "classes": ["user_id", "all_users"] }
     }
   }
 }

diff --git a/mash/login/manifest.json b/mash/login/manifest.json
index 129e25cc..b88eaeb 100644
--- a/mash/login/manifest.json
+++ b/mash/login/manifest.json

@@ -5,8 +5,7 @@
   "capabilities": {
     "required": {
       "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes": [ "mus:core", "mus:user" ] },
-      "mojo:shell":  { "classes":  ["shell:all_users"] }
+      "mojo:shell":  { "classes":  ["all_users"] }
     }
   }
 }

diff --git a/mash/quick_launch/manifest.json b/mash/quick_launch/manifest.json
index a1e4fe8d..7159c415 100644
--- a/mash/quick_launch/manifest.json
+++ b/mash/quick_launch/manifest.json

@@ -3,10 +3,7 @@
   "name": "mojo:quick_launch",
   "display_name": "Quick Launch Bar",
   "capabilities": {
-    "provided": { "mash:launchable": ["mash::mojom::Launchable"] },
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes":  ["mus:core"] }
-    }
+    "provided": { "launchable": ["mash::mojom::Launchable"] },
+    "required": { "*": { "interfaces": [ "*" ] } }
   }
 }

diff --git a/mash/quick_launch/quick_launch_application.cc b/mash/quick_launch/quick_launch_application.cc
index 85bd51d0..a5cf6e80c 100644
--- a/mash/quick_launch/quick_launch_application.cc
+++ b/mash/quick_launch/quick_launch_application.cc

@@ -125,7 +125,7 @@
 
   void UpdateEntries() {
     catalog_->GetEntriesProvidingClass(
-        "mash:launchable",
+        "launchable",
         base::Bind(&QuickLaunchUI::OnGotCatalogEntries,
                    base::Unretained(this)));
   }

diff --git a/mash/screenlock/manifest.json b/mash/screenlock/manifest.json
index 7b88a535..9af78dc 100644
--- a/mash/screenlock/manifest.json
+++ b/mash/screenlock/manifest.json

@@ -1,11 +1,5 @@
 {
-  "manifest_version": 1,
   "name": "mojo:screenlock",
   "display_name": "Screen Lock",
-  "capabilities": {
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes": [ "mus:core" ] }
-    }
-  }
+  "capabilities": { "*": [ "*" ] }
 }

diff --git a/mash/task_viewer/manifest.json b/mash/task_viewer/manifest.json
index 2ea4dcd..2f1487a 100644
--- a/mash/task_viewer/manifest.json
+++ b/mash/task_viewer/manifest.json

@@ -3,10 +3,7 @@
   "name": "mojo:task_viewer",
   "display_name": "Task Viewer",
   "capabilities": {
-    "provided": { "mash:launchable": ["mash::mojom::Launchable"] },
-    "required": {
-      "*": { "interfaces": [ "*" ] },
-      "mojo:mus": { "classes": [ "mus:core" ] }
-    }
+    "provided": { "launchable": ["mash::mojom::Launchable"] },
+    "required": { "*": { "interfaces": [ "*" ] } }
   }
 }

diff --git a/mash/unittests_manifest.json b/mash/unittests_manifest.json
index 90efe9f5..0f3e63e0 100644
--- a/mash/unittests_manifest.json
+++ b/mash/unittests_manifest.json

@@ -1,15 +1,5 @@
 {
-  "manifest_version":  1,
   "name": "exe:mash_unittests",
   "display_name": "Mash Unittests",
-  "capabilities": {
-    "required": {
-      "mojo:desktop_wm": { "interfaces": [ "*" ] },
-      "mojo:quick_launch": { "interfaces": [ "*" ] },
-      "mojo:mus": {
-        "classes": [ "mus:core" ],
-        "interfaces": [ "mus::mojom::WindowServerTest" ]
-      }
-    }
-  }
+  "capabilities": { "*": ["*"] }
 }

diff --git a/mash/wm/manifest.json b/mash/wm/manifest.json
index d8bb64e..46267f0 100644
--- a/mash/wm/manifest.json
+++ b/mash/wm/manifest.json

@@ -1,11 +1,5 @@
 {
-  "manifest_version":  1,
   "name": "mojo:desktop_wm",
   "display_name": "Window Manager",
-  "capabilities": {
-    "required": {
-      "mojo:mus": { "classes": [ "mus:window_manager", "mus:core" ] },
-      "*":  { "interfaces":  ["*"] }
-    }
-  }
+  "capabilities": { "*": ["*"] }
 }

diff --git a/services/catalog/manifest.json b/services/catalog/manifest.json
index 02897dd3..2ae1be8 100644
--- a/services/catalog/manifest.json
+++ b/services/catalog/manifest.json

@@ -4,7 +4,7 @@
   "display_name": "Application Resolver",
   "capabilities": {
     "required": {
-      "mojo:shell": { "classes": [ "shell:all_users" ] }      
+      "mojo:shell": { "classes": [ "all_users" ] }      
     }
   }
 }

diff --git a/services/shell/manifest.json b/services/shell/manifest.json
index 6681d967..d3303f9 100644
--- a/services/shell/manifest.json
+++ b/services/shell/manifest.json

@@ -4,14 +4,13 @@
   "display_name": "Service Manager",
   "capabilities": {
     "provided": {
-      "shell:user_id": [ ],
-      "shell:client_process": [ ],
-      "shell:instance_name": [ ],
-      "shell:all_users": [ ],
-      "shell:block_wildcard":  [ ]
+      "user_id": [ ],
+      "client_process": [ ],
+      "instance_name": [ ],
+      "all_users":  [ ]
     },
     "required": {
-      "mojo:shell": { "classes": [ "shell:all_users" ] }
+      "mojo:shell": { "classes": [ "all_users" ] }
     }
   }
 }

diff --git a/services/shell/public/cpp/lib/interface_registry.cc b/services/shell/public/cpp/lib/interface_registry.cc
index 27a132b6..39e5d90 100644
--- a/services/shell/public/cpp/lib/interface_registry.cc
+++ b/services/shell/public/cpp/lib/interface_registry.cc

@@ -35,14 +35,8 @@
   auto iter = name_to_binder_.find(interface_name);
   InterfaceBinder* binder = iter != name_to_binder_.end() ? iter->second :
       default_binder_;
-  if (binder) {
+  if (binder)
     binder->BindInterface(connection_, interface_name, std::move(handle));
-  } else {
-    LOG(ERROR) << "Connection CapabilityFilter prevented binding to interface: "
-               << interface_name << " connection_name:"
-               << connection_->GetConnectionName() << " remote_name:"
-               << connection_->GetRemoteIdentity().name();
-  }
 }
 
 bool InterfaceRegistry::SetInterfaceBinderForName(
@@ -54,6 +48,10 @@
     name_to_binder_[interface_name] = binder;
     return true;
   }
+  LOG(WARNING) << "Connection CapabilityFilter prevented binding to interface: "
+               << interface_name << " connection_name:"
+               << connection_->GetConnectionName() << " remote_name:"
+               << connection_->GetRemoteIdentity().name();
   return false;
 }
 

diff --git a/services/shell/shell.cc b/services/shell/shell.cc
index 36973578..dd91518e 100644
--- a/services/shell/shell.cc
+++ b/services/shell/shell.cc

@@ -34,11 +34,10 @@
 
 const char kCatalogName[] = "mojo:catalog";
 const char kShellName[] = "mojo:shell";
-const char kCapabilityClass_UserID[] = "shell:user_id";
-const char kCapabilityClass_ClientProcess[] = "shell:client_process";
-const char kCapabilityClass_InstanceName[] = "shell:instance_name";
-const char kCapabilityClass_AllUsers[] = "shell:all_users";
-const char kCapabilityClass_ExplicitClass[] = "shell:explicit_class";
+const char kCapabilityClass_UserID[] = "user_id";
+const char kCapabilityClass_ClientProcess[] = "client_process";
+const char kCapabilityClass_InstanceName[] = "instance_name";
+const char kCapabilityClass_AllUsers[] = "all_users";
 
 void EmptyResolverCallback(mojom::ResolveResultPtr result) {}
 
@@ -151,27 +150,18 @@
     params->connect_callback().Run(mojom::ConnectResult::SUCCEEDED,
                                    identity_.user_id(), id_);
     uint32_t source_id = mojom::kInvalidInstanceID;
-    CapabilityRequest request;
-    request.interfaces.insert("*");
+    CapabilityRequest spec;
+    spec.interfaces.insert("*");
     Instance* source = shell_->GetExistingInstance(params->source());
     if (source) {
-      request = GenerateCapabilityRequestForConnection(
+      spec = GenerateCapabilityRequestForConnection(
           source->capability_spec_, identity_, capability_spec_);
       source_id = source->id();
     }
-
-    // The target has specified that sources must request one of its provided
-    // classes instead of specifying a wild-card for interfaces or interfaces
-    // directly.
-    if (HasClass(capability_spec_, kCapabilityClass_ExplicitClass) &&
-        (request.classes.empty() || request.interfaces.count("*") != 0)) {
-      request.interfaces = Interfaces();
-    }
-
     shell_client_->AcceptConnection(
         mojom::Identity::From(params->source()), source_id,
         params->TakeRemoteInterfaces(), params->TakeLocalInterfaces(),
-        mojom::CapabilityRequest::From(request), params->target().name());
+        mojom::CapabilityRequest::From(spec), params->target().name());
   }
 
   void StartWithClient(mojom::ShellClientPtr client) {

diff --git a/services/shell/tests/connect/connect_test_app_a_manifest.json b/services/shell/tests/connect/connect_test_app_a_manifest.json
index 9f025c47..3ab8927b 100644
--- a/services/shell/tests/connect/connect_test_app_a_manifest.json
+++ b/services/shell/tests/connect/connect_test_app_a_manifest.json

@@ -2,9 +2,5 @@
   "manifest_version": 1,
   "name": "mojo:connect_test_a",
   "display_name": "Connect Test A",
-  "capabilities": {
-    "required": {
-      "mojo:connect_test_class_app": { "classes":  [ "class" ] }
-    }
-  }
+  "capabilities": { }
 }

diff --git a/services/shell/tests/connect/connect_test_app_manifest.json b/services/shell/tests/connect/connect_test_app_manifest.json
index 91a0c6e..bae4bf9 100644
--- a/services/shell/tests/connect/connect_test_app_manifest.json
+++ b/services/shell/tests/connect/connect_test_app_manifest.json

@@ -9,7 +9,7 @@
         "classes": [ "class" ],
         "interfaces": ["shell::test::mojom::ConnectTestService"]
       },
-      "mojo:shell": { "classes": [ "shell:user_id" ] }
+      "mojo:shell": { "classes": [ "user_id" ] }
     }
   }
 }

diff --git a/services/shell/tests/connect/connect_test_class_app.cc b/services/shell/tests/connect/connect_test_class_app.cc
index 8aec2aa..d64d38b 100644
--- a/services/shell/tests/connect/connect_test_class_app.cc
+++ b/services/shell/tests/connect/connect_test_class_app.cc

@@ -37,6 +37,7 @@
     identity_ = identity;
   }
   bool AcceptConnection(Connection* connection) override {
+    CHECK(connection->HasCapabilityClass("class"));
     connection->AddInterface<test::mojom::ConnectTestService>(this);
     connection->AddInterface<test::mojom::ClassInterface>(this);
     inbound_connections_.insert(connection);

diff --git a/services/shell/tests/connect/connect_test_class_app_manifest.json b/services/shell/tests/connect/connect_test_class_app_manifest.json
index 5be9880..3f40e1ad 100644
--- a/services/shell/tests/connect/connect_test_class_app_manifest.json
+++ b/services/shell/tests/connect/connect_test_class_app_manifest.json

@@ -4,10 +4,7 @@
   "display_name": "Connect Test Class App",
   "capabilities": {
     "provided": {
-      "class": [ "shell::test::mojom::ClassInterface" ]
-    },
-    "required": {
-      "mojo:shell": { "classes": ["shell:explicit_class"] }
+      "class": ["shell::test::mojom::ClassInterface"]
     }
   }
 }

diff --git a/services/shell/tests/connect/connect_test_singleton_app_manifest.json b/services/shell/tests/connect/connect_test_singleton_app_manifest.json
index 4ea8595f..550314d 100644
--- a/services/shell/tests/connect/connect_test_singleton_app_manifest.json
+++ b/services/shell/tests/connect/connect_test_singleton_app_manifest.json

@@ -4,7 +4,7 @@
   "display_name": "Connect Test Singleton App",
   "capabilities": {
     "required": {
-      "mojo:shell": { "classes": [ "shell:all_users" ] }
+      "mojo:shell": { "classes": [ "all_users" ] }
     }
   }
 }

diff --git a/services/shell/tests/connect/connect_unittest.cc b/services/shell/tests/connect/connect_unittest.cc
index 9805cff..b144468 100644
--- a/services/shell/tests/connect/connect_unittest.cc
+++ b/services/shell/tests/connect/connect_unittest.cc

@@ -307,19 +307,6 @@
   EXPECT_EQ("CLASS APP", string2);
 }
 
-TEST_F(ConnectTest, ConnectWithoutExplicitClassBlocked) {
-  // We not be able to bind a ClassInterfacePtr since the connect_unittest app
-  // does not explicitly request the "class" capability from
-  // connect_test_class_app. This test will hang if it is bound.
-  std::unique_ptr<Connection> connection =
-      connector()->Connect(kTestClassAppName);
-  test::mojom::ClassInterfacePtr class_interface;
-  connection->GetInterface(&class_interface);
-  base::RunLoop loop;
-  class_interface.set_connection_error_handler(base::Bind(&QuitLoop, &loop));
-  loop.Run();
-}
-
 TEST_F(ConnectTest, ConnectAsDifferentUser_Allowed) {
   std::unique_ptr<Connection> connection = connector()->Connect(kTestAppName);
   test::mojom::UserIdTestPtr user_id_test;

diff --git a/services/shell/tests/connect/connect_unittests_manifest.json b/services/shell/tests/connect/connect_unittests_manifest.json
index b2f39e2c..8e171d2 100644
--- a/services/shell/tests/connect/connect_unittests_manifest.json
+++ b/services/shell/tests/connect/connect_unittests_manifest.json

@@ -5,9 +5,6 @@
   "capabilities": {
     "required": {
       "mojo:connect_test_package": { "interfaces": [ "*" ] },
-      "mojo:connect_test_class_app": {
-        "interfaces":  ["*"]
-      },
       "mojo:connect_test_app": {
         "interfaces": [
           "shell::test::mojom::ConnectTestService",
@@ -25,7 +22,7 @@
           "shell::test::mojom::UserIdTest"
         ]
       },
-      "mojo:shell": { "classes": [ "shell:instance_name", "shell:user_id" ] }
+      "mojo:shell": { "classes": [ "instance_name", "user_id" ] }
     }
   }
 }

diff --git a/services/shell/tests/lifecycle/lifecycle_unittest_manifest.json b/services/shell/tests/lifecycle/lifecycle_unittest_manifest.json
index 6e3f4a4f..b02dee1e 100644
--- a/services/shell/tests/lifecycle/lifecycle_unittest_manifest.json
+++ b/services/shell/tests/lifecycle/lifecycle_unittest_manifest.json

@@ -5,10 +5,8 @@
   "capabilities": {
     "required": {
       "*": { "interfaces": [ "*" ] },
-      "mojo:shell": {
-        "classes": [ "shell:instance_name", "shell:client_process" ],
-        "interfaces": [ "*" ]
-      }
+      "mojo:shell": { "classes": [ "instance_name", "client_process" ], 
+                      "interfaces": [ "*" ] }
     }
   }
 }

diff --git a/services/shell/tests/shell/driver_manifest.json b/services/shell/tests/shell/driver_manifest.json
index 12e7190..8efa0f1 100644
--- a/services/shell/tests/shell/driver_manifest.json
+++ b/services/shell/tests/shell/driver_manifest.json

@@ -5,7 +5,7 @@
   "capabilities": {
     "required": {
       "*": { "interfaces": [ "*" ] },
-      "mojo:shell": { "classes":  ["shell:client_process"] }
+      "mojo:shell": { "classes":  ["client_process"] }
     }
   }
 }

diff --git a/services/tracing/manifest.json b/services/tracing/manifest.json
index e73d2ce..adbdc58 100644
--- a/services/tracing/manifest.json
+++ b/services/tracing/manifest.json

@@ -4,7 +4,7 @@
   "display_name": "Tracing Collector",
   "capabilities": {
     "required": {
-      "mojo:shell": { "classes": [ "shell:all_users" ] }
+      "mojo:shell": { "classes": [ "all_users" ] }
     }
   }
 }

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 64da375..fe1f9b14 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -11,13 +11,6 @@
 crbug.com/345655 fast/dom/StyleSheet/detached-stylesheet-without-wrapper.html [ Failure ]
 crbug.com/370906 fast/dom/StyleSheet/gc-declaration-parent-rule.html [ Failure ]
 
-# With Oilpan, parent pointers in the DOM tree do not
-# mysteriously disappear. This is the intended behavior.
-crbug.com/356658 fast/dom/gc-3.html [ Failure ]
-crbug.com/356658 fast/dom/gc-5.html [ Failure ]
-crbug.com/356658 fast/dom/gc-12.html [ Failure ]
-crbug.com/356658 crbug.com/356828 fast/dom/gc-dom-tree-lifetime.html [ Failure Timeout ]
-
 crbug.com/501229 fast/forms/associatedFormControls-leak-nodes.html [ Failure Pass ]
 
 crbug.com/417181 http/tests/xmlhttprequest/abort-on-changestate-headers-received.html [ Failure Pass ]

diff --git a/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-interface.html b/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-interface.html
new file mode 100644
index 0000000..ddf56b0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-interface.html

@@ -0,0 +1,45 @@
+<!DOCTYPE HTML>
+<link rel="help" href="https://w3c.github.io/selection-api/#idl-def-Selection">
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script>
+test(function() {
+    function assert_enumerable(p, isReadOnly) {
+        assert_true(p in Selection.prototype);
+        assert_true(Selection.prototype.propertyIsEnumerable(p));
+        if (isReadOnly)
+            assert_equals(Object.getOwnPropertyDescriptor(Selection.prototype, p).set, undefined);
+    }
+
+    assert_true('Selection' in self);
+
+    var readOnly = true;
+
+    // Verify spec interface coverage (only.)
+
+    assert_enumerable('anchorNode', readOnly);
+    assert_enumerable('anchorOffset', readOnly);
+    assert_enumerable('focusNode', readOnly);
+    assert_enumerable('focusOffset', readOnly);
+    assert_enumerable('isCollapsed', readOnly);
+    assert_enumerable('rangeCount', readOnly);
+    assert_enumerable('type', readOnly);
+
+    assert_enumerable('getRangeAt');
+    assert_enumerable('addRange');
+    // Not implemented: crbug.com/391673
+    //assert_enumerable('removeRange');
+    assert_enumerable('removeAllRanges');
+    assert_enumerable('empty');
+    assert_enumerable('collapse');
+    assert_enumerable('setPosition');
+    assert_enumerable('collapseToStart');
+    assert_enumerable('collapseToEnd');
+    assert_enumerable('extend');
+    assert_enumerable('setBaseAndExtent');
+    assert_enumerable('selectAllChildren');
+    assert_enumerable('deleteFromDocument');
+    assert_enumerable('containsNode');
+    assert_enumerable('toString');
+}, 'Selection interface');
+</script>

diff --git a/third_party/WebKit/LayoutTests/fast/dom/gc-12-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/gc-12-expected.txt
index da93c2d..92a2349 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/gc-12-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/gc-12-expected.txt

@@ -1,7 +1,7 @@
 This test verifies that DOM nodes are not garbage collected as long as a node in the tree is referenced from JavaScript.
 
 PASS: span should be a Node and is.
-FAIL: span.parentNode should be a Node but instead is null.
+PASS: span.parentNode should be a Node and is.
 PASS: span.firstChild should be a Node and is.
 PASS: span should be a Node and is.
 PASS: span.parentNode should be a Node and is.

diff --git a/third_party/WebKit/LayoutTests/fast/dom/gc-3-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/gc-3-expected.txt
index ff2ddb3..2dcc215 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/gc-3-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/gc-3-expected.txt

@@ -4,5 +4,6 @@
 
 replacement content
 B
+parent node exists
 child node exists
 

diff --git a/third_party/WebKit/LayoutTests/fast/dom/gc-5-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/gc-5-expected.txt
index 68b579f..384e6755 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/gc-5-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/gc-5-expected.txt

@@ -4,4 +4,5 @@
 
 replacement content
 B
+D
 

diff --git a/third_party/WebKit/LayoutTests/fast/dom/gc-dom-tree-lifetime-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/gc-dom-tree-lifetime-expected.txt
index d48fd99..c83eede1 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/gc-dom-tree-lifetime-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/gc-dom-tree-lifetime-expected.txt

@@ -10,24 +10,24 @@
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML ===
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML and divX ===
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML, divX and divY ===
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML, divX, divY and divZ ===
 PASS All <div> objects in a DOM tree are successfully destructed.
@@ -43,24 +43,24 @@
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML ===
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML and divX ===
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML, divX and divY ===
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML, divX, divY and divZ ===
 PASS All <div> objects in a DOM tree are successfully destructed.
@@ -76,24 +76,24 @@
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML ===
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML and divX ===
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML, divX and divY ===
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 === After clearing innerHTML, divX, divY and divZ ===
 PASS All <div> objects in a DOM tree are successfully destructed.
@@ -109,24 +109,24 @@
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML ===
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML and divX ===
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML, divX and divY ===
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML, divX, divY and divZ ===
 PASS All <div> objects in a DOM tree are successfully destructed.
@@ -142,24 +142,24 @@
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML ===
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML and divX ===
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML, divX and divY ===
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 === After clearing innerHTML, divX, divY and divZ ===
 PASS All <div> objects in a DOM tree are successfully destructed.
@@ -175,24 +175,24 @@
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML ===
 PASS globalDiv.id is "div2"
-FAIL globalDiv.parentNode.id should be div2-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div2-parent"
 PASS globalDiv.firstChild.id is "div2-child"
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML and divX ===
 PASS globalDiv.id is "div1"
-FAIL globalDiv.parentNode.id should be div1-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div1-parent"
 PASS globalDiv.firstChild.id is "div1-child"
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML, divX and divY ===
 PASS globalDiv.id is "div0"
-FAIL globalDiv.parentNode.id should be div0-parent. Threw exception TypeError: Cannot read property 'id' of null
+PASS globalDiv.parentNode.id is "div0-parent"
 PASS globalDiv.firstChild.id is "div0-child"
 === After clearing innerHTML, divX, divY and divZ ===
 PASS All <div> objects in a DOM tree are successfully destructed.

diff --git a/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum-expected.txt b/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum-expected.txt
index 1c52f9c..961b847 100644
--- a/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum-expected.txt

@@ -1,7 +1,6 @@
 This tests that the toString() function does not enumerate.
 
 PASS: the toString function is not enumerable for Location.
-PASS: the toString function is not enumerable for Selection.
 PASS: the toString function is not enumerable for HTMLDivElement.
 PASS: the toString function is not enumerable for HTMLDocument.
 PASS: the toString function is not enumerable for Object.

diff --git a/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum.html b/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum.html
index 05493ca..f7c7612 100644
--- a/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum.html
+++ b/third_party/WebKit/LayoutTests/fast/js/toString-dontEnum.html

@@ -26,7 +26,6 @@
 
             // DOM objects with custom toString() functions
             test(window.location, "Location");
-            test(window.getSelection(), "Selection");
 
             // Other DOM objects
             test(document.createElement('div'), "HTMLDivElement");

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_populate_entries-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_populate_entries-expected.txt
deleted file mode 100644
index 6148a67..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_populate_entries-expected.txt
+++ /dev/null

@@ -1,8 +0,0 @@
-Description
-
-This test validates the functionality of onresourcetimingbufferfull in resource timing.
-
-This is a testharness.js-based test.
-PASS onresourcetimingbufferfull should have been invoked once buffer is full! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_populate_entries.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_populate_entries.html
index f89ce7b7..7329733 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_populate_entries.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_populate_entries.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>onresourcetimingbufferfull callback of resource timing</title>
+        <title>This test validates the functionality of onresourcetimingbufferfull in resource timing.</title>
         <script src="/w3c/webperf/resources/webperftestharnessextension.js"></script>
         <script>
             var context = new PerformanceContext(performance);
@@ -29,7 +29,5 @@
         </script>
     </head>
     <body onload=onload_test()>
-        <h1>Description</h1>
-        <p>This test validates the functionality of onresourcetimingbufferfull in resource timing.</p>
     </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_shrink_buffer_size-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_shrink_buffer_size-expected.txt
deleted file mode 100644
index b12a05c6..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_shrink_buffer_size-expected.txt
+++ /dev/null

@@ -1,8 +0,0 @@
-Description
-
-This test validates the functionality of onresourcetimingbufferfull in resource timing.
-
-This is a testharness.js-based test.
-PASS onresourcetimingbufferfull should be invoked once the buffer is shrunk to size which is less than or equal to current entry number! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_shrink_buffer_size.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_shrink_buffer_size.html
index 788b94a..da78164 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_shrink_buffer_size.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_full_when_shrink_buffer_size.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>onresourcetimingbufferfull callback of resource timing</title>
+        <title>This test validates the functionality of onresourcetimingbufferfull in resource timing.</title>
         <script src="/w3c/webperf/resources/webperftestharnessextension.js"></script>
         <script>
             var context = new PerformanceContext(performance);
@@ -31,7 +31,5 @@
         </script>
     </head>
     <body onload=onload_test()>
-        <h1>Description</h1>
-        <p>This test validates the functionality of onresourcetimingbufferfull in resource timing.</p>
     </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_size_restriction-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_size_restriction-expected.txt
deleted file mode 100644
index b8f7b4f..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_size_restriction-expected.txt
+++ /dev/null

@@ -1,8 +0,0 @@
-Description
-
-This test validates the functionality of setResourceTimingBufferSize method in resource timing.
-
-This is a testharness.js-based test.
-PASS 2 resource timing entries should be stored since buffer size is 2! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_size_restriction.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_size_restriction.html
index 514ce3ae..a30805b 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_size_restriction.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_buffer_size_restriction.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>buffer size restriction functionality of resource timing</title>
+        <title>This test validates the functionality of setResourceTimingBufferSize method in resource timing.</title>
         <script src="/w3c/webperf/resources/webperftestharnessextension.js"></script>
         <script>
             var context = new PerformanceContext(performance);
@@ -24,7 +24,5 @@
         </script>
     </head>
     <body onload=onload_test()>
-        <h1>Description</h1>
-        <p>This test validates the functionality of setResourceTimingBufferSize method in resource timing.</p>
     </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_clear_resource_timing_functionality-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_clear_resource_timing_functionality-expected.txt
deleted file mode 100644
index 2525446..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_clear_resource_timing_functionality-expected.txt
+++ /dev/null

@@ -1,9 +0,0 @@
-Description
-
-This test validates the functionality of clearResourceTimings method in resource timing.
-
-This is a testharness.js-based test.
-PASS 4 resource timing entries should be stored in this page! 
-PASS No resource timing entries should be stored after clearResourceTimings! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_clear_resource_timing_functionality.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_clear_resource_timing_functionality.html
index 1a23e20..4bbadb39 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_clear_resource_timing_functionality.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_clear_resource_timing_functionality.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>clearResourceTimings functionality of resource timing</title>
+        <title>This test validates the functionality of clearResourceTimings method in resource timing.</title>
         <link rel="author" title="Intel" href="http://www.intel.com/" />
         <link rel="help" href="http://www.w3.org/TR/resource-timing/#performanceresourcetiming"/>
         <script src="/w3c/resources/testharness.js"></script>
@@ -22,7 +22,5 @@
         </script>
     </head>
     <body onload=onload_test()>
-        <h1>Description</h1>
-        <p>This test validates the functionality of clearResourceTimings method in resource timing.</p>
     </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect-expected.txt
deleted file mode 100644
index 4cdf5d4..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect-expected.txt
+++ /dev/null

@@ -1,20 +0,0 @@
-Description
-
-This test validates the values in resource timing for a cross-origin redirect.
-
-
-This is a testharness.js-based test.
-PASS Starting document.location.hostname is correct (127.0.0.1:8000) 
-PASS redirectStart should be 0 in cross-origin redirect! 
-PASS redirectEnd should be 0 in cross-origin redirect! 
-PASS domainLookupStart should be 0 in cross-origin redirect! 
-PASS domainLookupEnd should be 0 in cross-origin redirect! 
-PASS connectStart should be 0 in cross-origin redirect! 
-PASS connectEnd should be 0 in cross-origin redirect! 
-PASS requestStart should be 0 in cross-origin redirect! 
-PASS responseStart should be 0 in cross-origin redirect! 
-PASS secureConnectionStart should be 0 in cross-origin redirect! 
-PASS fetchStart should be greater than 0 in cross-origin redirect! 
-PASS responseEnd should be greater than 0 in cross-origin redirect! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect.html
index b569db1..1a3d407 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>resource timing information for cross-origin redirect</title>
+        <title>This test validates the values in resource timing for a cross-origin redirect.</title>
         <link rel="author" title="Intel" href="http://www.intel.com/" />
         <link rel="help" href="http://www.w3.org/TR/resource-timing/#performanceresourcetiming"/>
         <script src="/w3c/resources/testharness.js"></script>
@@ -37,8 +37,6 @@
 
     </head>
     <body>
-        <h1>Description</h1>
-        <p>This test validates the values in resource timing for a cross-origin redirect.</p>
         <iframe id="frameContext" src="" style="width: 250px; height: 250px;"></iframe>
         <script>
             test_equals(document.location.host, pageOrigin, 'Starting document.location.hostname is correct (' + pageOrigin + ')');

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_with_timing_allow_origin-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_with_timing_allow_origin-expected.txt
deleted file mode 100644
index dbd4b2c2..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_with_timing_allow_origin-expected.txt
+++ /dev/null

@@ -1,13 +0,0 @@
-Description
-
-This test validates the values in resource timing for a timing allowed cross-origin redirect.
-
-
-This is a testharness.js-based test.
-PASS Starting document.location.hostname is correct (127.0.0.1:8000) 
-PASS redirectStart should be greater than 0 in timing allowed cross-origin redirect! 
-PASS redirectStart should be equal to startTime in timing allowed cross-origin redirect! 
-PASS redirectEnd should be no less than redirectStart in timing allowed cross-origin redirect! 
-PASS fetchStart should be no less than redirectEnd in timing allowed cross-origin redirect! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_with_timing_allow_origin.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_with_timing_allow_origin.html
index a35c3d4..2a0575f 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_with_timing_allow_origin.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_with_timing_allow_origin.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>resource timing information for timing allowed cross-origin redirect</title>
+        <title>This test validates the values in resource timing for a timing allowed cross-origin redirect.</title>
         <link rel="author" title="Intel" href="http://www.intel.com/" />
         <link rel="help" href="http://www.w3.org/TR/resource-timing/#performanceresourcetiming"/>
         <script src="/w3c/resources/testharness.js"></script>
@@ -30,8 +30,6 @@
 
     </head>
     <body>
-        <h1>Description</h1>
-        <p>This test validates the values in resource timing for a timing allowed cross-origin redirect.</p>
         <iframe id="frameContext" src="" style="width: 250px; height: 250px;"></iframe>
         <script>
             test_equals(document.location.host, pageOrigin, 'Starting document.location.hostname is correct (' + pageOrigin + ')');

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_resource_request-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_resource_request-expected.txt
deleted file mode 100644
index 42bcf70..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_resource_request-expected.txt
+++ /dev/null

@@ -1,21 +0,0 @@
-Description
-
-This test validates the values in resource timing for a cross-origin resource request.
-
-
-
-This is a testharness.js-based test.
-PASS Starting document.location.hostname is correct (127.0.0.1:8000) 
-PASS redirectStart should be 0 in cross-origin request! 
-PASS redirectEnd should be 0 in cross-origin request! 
-PASS domainLookupStart should be 0 in cross-origin request! 
-PASS domainLookupEnd should be 0 in cross-origin request! 
-PASS connectStart should be 0 in cross-origin request! 
-PASS connectEnd should be 0 in cross-origin request! 
-PASS requestStart should be 0 in cross-origin request! 
-PASS responseStart should be 0 in cross-origin request! 
-PASS secureConnectionStart should be 0 in cross-origin request! 
-PASS fetchStart should be greater than 0 in cross-origin request! 
-PASS responseEnd should be greater than 0 in cross-origin request! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_resource_request.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_resource_request.html
index 164b2223..d538256 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_resource_request.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_resource_request.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>resource timing information for cross-origin resource request</title>
+        <title>This test validates the values in resource timing for a cross-origin resource request.</title>
         <link rel="author" title="Intel" href="http://www.intel.com/" />
         <link rel="help" href="http://www.w3.org/TR/resource-timing/#performanceresourcetiming"/>
         <script src="/w3c/resources/testharness.js"></script>
@@ -40,10 +40,6 @@
 
     </head>
     <body>
-        <h1>Description</h1>
-        <p>This test validates the values in resource timing for a cross-origin resource request.</p>
-
-        <br />
         <iframe id="frameContext" src="" style="width: 250px; height: 250px;"></iframe>
         <script>
             test_equals(document.location.host, pageOrigin, 'Starting document.location.hostname is correct (' + pageOrigin + ')');

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_on_shrink_buffer_size-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_on_shrink_buffer_size-expected.txt
deleted file mode 100644
index 9b9b61ab..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_on_shrink_buffer_size-expected.txt
+++ /dev/null

@@ -1,10 +0,0 @@
-Description
-
-This test validates the behavior of shrink resource timing buffer size.
-
-This is a testharness.js-based test.
-PASS There should be entries in resource timing buffer! 
-PASS Resource timing buffer should never been changed even buffer size is shrunk! 
-PASS There should be no entries in resource timing buffer after clearResourceTimings 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_on_shrink_buffer_size.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_on_shrink_buffer_size.html
index 79e05d2f..7babcf04 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_on_shrink_buffer_size.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_on_shrink_buffer_size.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>shrink resource timing buffer size</title>
+        <title>This test validates the behavior of shrink resource timing buffer size.</title>
         <link rel="author" title="Intel" href="http://www.intel.com/" />
         <link rel="help" href="http://www.w3.org/TR/resource-timing/#performanceresourcetiming"/>
         <script src="/w3c/resources/testharness.js"></script>
@@ -28,7 +28,5 @@
         </script>
     </head>
     <body onload=onload_test()>
-        <h1>Description</h1>
-        <p>This test validates the behavior of shrink resource timing buffer size.</p>
     </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_same_origin_redirect-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_same_origin_redirect-expected.txt
deleted file mode 100644
index b9bdcb69..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_same_origin_redirect-expected.txt
+++ /dev/null

@@ -1,13 +0,0 @@
-Description
-
-This test validates the values of the redirectStart/End in resource timing for a same-origin resource redirect.
-
-
-This is a testharness.js-based test.
-PASS Starting document.location.hostname is correct (127.0.0.1:8000) 
-PASS redirectStart should be greater than 0 in same-origin redirect! 
-PASS redirectStart should be equal to startTime in same-origin redirect! 
-PASS redirectEnd should be no less than redirectStart in same-origin redirect! 
-PASS fetchStart should be no less than redirectEnd in same-origin redirect! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_same_origin_redirect.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_same_origin_redirect.html
index 4c44fb6..5cc82d3 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_same_origin_redirect.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_same_origin_redirect.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>redirectStart and redirectEnd information in same-origin redirect resource timing</title>
+        <title>This test validates the values of the redirectStart/End in resource timing for a same-origin resource redirect.</title>
         <link rel="author" title="Intel" href="http://www.intel.com/" />
         <link rel="help" href="http://www.w3.org/TR/resource-timing/#performanceresourcetiming"/>
         <script src="/w3c/resources/testharness.js"></script>
@@ -30,8 +30,6 @@
 
     </head>
     <body>
-        <h1>Description</h1>
-        <p>This test validates the values of the redirectStart/End in resource timing for a same-origin resource redirect.</p>
         <iframe id="frameContext" src="" style="width: 250px; height: 250px;"></iframe>
         <script>
             test_equals(document.location.host, pageOrigin, 'Starting document.location.hostname is correct (' + pageOrigin + ')');

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_store_and_clear_during_callback-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_store_and_clear_during_callback-expected.txt
deleted file mode 100644
index f30babe0..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_store_and_clear_during_callback-expected.txt
+++ /dev/null

@@ -1,9 +0,0 @@
-Description
-
-This test validates the behavior of read and clear operation in onresourcetimingbufferfull callback of resource timing.
-
-This is a testharness.js-based test.
-PASS No entry should be stored in resource timing buffer since it's cleared once an item arrived! 
-PASS 4 resource timing entries should be moved to global buffer! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_store_and_clear_during_callback.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_store_and_clear_during_callback.html
index 3ca1ad758..89781b89 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_store_and_clear_during_callback.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_store_and_clear_during_callback.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>read and clear resource timing entry in onresourcetimingbufferfull callback</title>
+        <title>This test validates the behavior of read and clear operation in onresourcetimingbufferfull callback of resource timing.</title>
         <script src="/w3c/webperf/resources/webperftestharnessextension.js"></script>
         <script>
             var context = new PerformanceContext(performance);
@@ -34,7 +34,5 @@
         </script>
     </head>
     <body onload=onload_test()>
-        <h1>Description</h1>
-        <p>This test validates the behavior of read and clear operation in onresourcetimingbufferfull callback of resource timing.</p>
     </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_timing_allow_cross_origin_resource_request-expected.txt b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_timing_allow_cross_origin_resource_request-expected.txt
deleted file mode 100644
index 6e3cc025..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_timing_allow_cross_origin_resource_request-expected.txt
+++ /dev/null

@@ -1,21 +0,0 @@
-Description
-
-This test validates the values in resource timing for a timing-allow-origin cross-origin resource request.
-
-
-
-This is a testharness.js-based test.
-PASS Starting document.location.hostname is correct (127.0.0.1:8000) 
-PASS redirectStart should be 0 in cross-origin request since no redirect! 
-PASS redirectEnd should be 0 in cross-origin request since no redirect! 
-PASS domainLookupStart should not be 0 in timing-allow cross-origin request! 
-PASS domainLookupEnd should not be 0 in timing-allow cross-origin request! 
-PASS connectStart should not be 0 in timing-allow cross-origin request! 
-PASS connectEnd should not be 0 in timing-allow cross-origin request! 
-PASS requestStart should not be 0 in timing-allow cross-origin request! 
-PASS responseStart should not be 0 in timing-allow cross-origin request! 
-PASS secureConnectionStart should be 0 in cross-origin request since no ssl! 
-PASS fetchStart should not be 0 in timing-allow cross-origin request! 
-PASS responseEnd should not be 0 in timing-allow cross-origin request! 
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_timing_allow_cross_origin_resource_request.html b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_timing_allow_cross_origin_resource_request.html
index 3228ef4b..bcfc0b4 100644
--- a/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_timing_allow_cross_origin_resource_request.html
+++ b/third_party/WebKit/LayoutTests/http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_timing_allow_cross_origin_resource_request.html

@@ -2,7 +2,7 @@
 <html>
     <head>
         <meta charset="utf-8" />
-        <title>resource timing information for cross-origin resource request with timing-allow-origin</title>
+        <title>This test validates the values in resource timing for a timing-allow-origin cross-origin resource request.</title>
         <link rel="author" title="Intel" href="http://www.intel.com/" />
         <link rel="help" href="http://www.w3.org/TR/resource-timing/#performanceresourcetiming"/>
         <script src="/w3c/resources/testharness.js"></script>
@@ -39,10 +39,6 @@
 
     </head>
     <body>
-        <h1>Description</h1>
-        <p>This test validates the values in resource timing for a timing-allow-origin cross-origin resource request.</p>
-
-        <br />
         <iframe id="frameContext" src="" style="width: 250px; height: 250px;"></iframe>
         <script>
             test_equals(document.location.host, pageOrigin, 'Starting document.location.hostname is correct (' + pageOrigin + ')');

diff --git a/third_party/WebKit/PerformanceTests/Bindings/post-message.html b/third_party/WebKit/PerformanceTests/Bindings/post-message.html
index 862aa824..57458617 100644
--- a/third_party/WebKit/PerformanceTests/Bindings/post-message.html
+++ b/third_party/WebKit/PerformanceTests/Bindings/post-message.html

@@ -2,19 +2,38 @@
 <body>
 <script src="../resources/runner.js"></script>
 <script>
+var isDone = false;
 
-var times = 100000;
-var worker = new Worker('resources/worker.js');
-worker.onmessage = function(event) {
-    console.log("received");
+function runTest() {
+    var numRound = 1000;
+    var worker = new Worker('resources/worker.js');
+
+    var startTime = PerfTestRunner.now();
+    worker.onmessage = function(event) {
+        numRound--;
+        if (numRound > 0) {
+            worker.postMessage('next');
+        } else {
+            PerfTestRunner.measureValueAsync(PerfTestRunner.now() - startTime);
+            if (!isDone)
+                runTest();
+        }
+    };
+    worker.postMessage('start');
+}
+
+function testDone() {
+    isDone = true;
+}
+
+window.onload = function () {
+    PerfTestRunner.prepareToMeasureValuesAsync({
+        description: "Measures time to run 1000 postMessage round trips in serial.",
+        unit: 'ms',
+        done: testDone,
+    });
+    runTest();
 };
-
-PerfTestRunner.measureTime({
-    description: "Measures performance of postMessage().",
-    run: function() {
-        for (var i = 0; i < times; i++)
-            worker.postMessage('foo');
-    }
-});
 </script>
+<div id="log"></div>
 </body>

diff --git a/third_party/WebKit/Source/bindings/core/v8/Microtask.cpp b/third_party/WebKit/Source/bindings/core/v8/Microtask.cpp
index ade8bba..dd24e7e 100644
--- a/third_party/WebKit/Source/bindings/core/v8/Microtask.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/Microtask.cpp

@@ -56,7 +56,7 @@
 
 void Microtask::enqueueMicrotask(PassOwnPtr<SameThreadClosure> callback)
 {
-    enqueueMicrotask(adoptPtr(new SameThreadTask(callback)));
+    enqueueMicrotask(adoptPtr(new SameThreadTask(std::move(callback))));
 }
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp b/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp
index 6afc899..33618aad 100644
--- a/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp

@@ -217,10 +217,10 @@
 
     // Then look it up in the reported errors.
     for (size_t i = 0; i < m_reportedAsErrors.size(); ++i) {
-        auto& message = m_reportedAsErrors.at(i);
+        OwnPtr<Message>& message = m_reportedAsErrors.at(i);
         if (!message->isCollected() && message->hasPromise(data.GetPromise())) {
             message->makePromiseStrong();
-            Platform::current()->currentThread()->scheduler()->timerTaskRunner()->postTask(BLINK_FROM_HERE, bind(&RejectedPromises::revokeNow, this, message.release()));
+            Platform::current()->currentThread()->scheduler()->timerTaskRunner()->postTask(BLINK_FROM_HERE, bind(&RejectedPromises::revokeNow, this, passed(message.release())));
             m_reportedAsErrors.remove(i);
             return;
         }
@@ -249,7 +249,7 @@
 
     OwnPtr<MessageQueue> queue = createMessageQueue();
     queue->swap(m_queue);
-    Platform::current()->currentThread()->scheduler()->timerTaskRunner()->postTask(BLINK_FROM_HERE, bind(&RejectedPromises::processQueueNow, PassRefPtr<RejectedPromises>(this), queue.release()));
+    Platform::current()->currentThread()->scheduler()->timerTaskRunner()->postTask(BLINK_FROM_HERE, bind(&RejectedPromises::processQueueNow, PassRefPtr<RejectedPromises>(this), passed(queue.release())));
 }
 
 void RejectedPromises::processQueueNow(PassOwnPtr<MessageQueue> queue)

diff --git a/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.h b/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.h
index efa1b75..d86d4b4 100644
--- a/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.h
+++ b/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.h

@@ -6,7 +6,10 @@
 #define RejectedPromises_h
 
 #include "core/fetch/AccessControlStatus.h"
-#include "platform/heap/Handle.h"
+#include "wtf/Deque.h"
+#include "wtf/Forward.h"
+#include "wtf/RefCounted.h"
+#include "wtf/Vector.h"
 
 namespace v8 {
 class PromiseRejectMessage;

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptCallStack.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptCallStack.cpp
index 9c5a86b..46239cc 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptCallStack.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptCallStack.cpp

@@ -75,7 +75,7 @@
 }
 
 ScriptCallStack::ScriptCallStack(PassOwnPtr<V8StackTrace> stackTrace)
-    : m_stackTrace(stackTrace)
+    : m_stackTrace(std::move(stackTrace))
 {
 }
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp
index bdd6199..94bb106 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp

@@ -541,7 +541,7 @@
             return;
         }
 
-        ScriptStreamerThread::shared()->postTask(threadSafeBind(&ScriptStreamerThread::runScriptStreamingTask, scriptStreamingTask.release(), AllowCrossThreadAccess(this)));
+        ScriptStreamerThread::shared()->postTask(threadSafeBind(&ScriptStreamerThread::runScriptStreamingTask, passed(scriptStreamingTask.release()), AllowCrossThreadAccess(this)));
         recordStartedStreamingHistogram(m_scriptType, 1);
     }
     if (m_stream)

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp
index f28bcd3..c9d91d31 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp

@@ -59,7 +59,7 @@
     MutexLocker locker(m_mutex);
     ASSERT(!m_runningTask);
     m_runningTask = true;
-    platformThread().getWebTaskRunner()->postTask(BLINK_FROM_HERE, task);
+    platformThread().getWebTaskRunner()->postTask(BLINK_FROM_HERE, std::move(task));
 }
 
 void ScriptStreamerThread::taskDone()

diff --git a/third_party/WebKit/Source/bindings/core/v8/ToV8Test.cpp b/third_party/WebKit/Source/bindings/core/v8/ToV8Test.cpp
index e4ac84c..79d85a2 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ToV8Test.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ToV8Test.cpp

@@ -224,58 +224,6 @@
     TEST_TOV8("hoge,fuga,", v);
 }
 
-TEST_F(ToV8Test, stringHeapVectors)
-{
-    HeapVector<String> stringVector;
-    stringVector.append("foo");
-    stringVector.append("bar");
-    TEST_TOV8("foo,bar", stringVector);
-
-    HeapVector<AtomicString> atomicStringVector;
-    atomicStringVector.append("quux");
-    atomicStringVector.append("bar");
-    TEST_TOV8("quux,bar", atomicStringVector);
-}
-
-TEST_F(ToV8Test, basicTypeHeapVectors)
-{
-    HeapVector<int> intVector;
-    intVector.append(42);
-    intVector.append(23);
-    TEST_TOV8("42,23", intVector);
-
-    HeapVector<long> longVector;
-    longVector.append(31773);
-    longVector.append(404);
-    TEST_TOV8("31773,404", longVector);
-
-    HeapVector<unsigned> unsignedVector;
-    unsignedVector.append(1);
-    unsignedVector.append(2);
-    TEST_TOV8("1,2", unsignedVector);
-
-    HeapVector<unsigned long> unsignedLongVector;
-    unsignedLongVector.append(1001);
-    unsignedLongVector.append(2002);
-    TEST_TOV8("1001,2002", unsignedLongVector);
-
-    HeapVector<float> floatVector;
-    floatVector.append(0.125);
-    floatVector.append(1.);
-    TEST_TOV8("0.125,1", floatVector);
-
-    HeapVector<double> doubleVector;
-    doubleVector.append(2.3);
-    doubleVector.append(4.2);
-    TEST_TOV8("2.3,4.2", doubleVector);
-
-    HeapVector<bool> boolVector;
-    boolVector.append(true);
-    boolVector.append(true);
-    boolVector.append(false);
-    TEST_TOV8("true,true,false", boolVector);
-}
-
 TEST_F(ToV8Test, withScriptState)
 {
     ScriptValue value(m_scope.getScriptState(), v8::Number::New(m_scope.isolate(), 1234.0));

diff --git a/third_party/WebKit/Source/core/dom/CrossThreadTask.h b/third_party/WebKit/Source/core/dom/CrossThreadTask.h
index 014ad9c16..c91e2ef 100644
--- a/third_party/WebKit/Source/core/dom/CrossThreadTask.h
+++ b/third_party/WebKit/Source/core/dom/CrossThreadTask.h

@@ -94,27 +94,27 @@
 // (P = <P1, ..., Pn>, MP = <MP1, ..., MPn, ExecutionContext*>)
 template<typename... P, typename... MP,
     typename RETTYPE = PassOwnPtr<ExecutionContextTask>, size_t PS = sizeof...(P), size_t MPS = sizeof...(MP)>
-typename std::enable_if<PS + 1 == MPS, RETTYPE>::type createCrossThreadTask(void (*function)(MP...), const P&... parameters)
+typename std::enable_if<PS + 1 == MPS, RETTYPE>::type createCrossThreadTask(void (*function)(MP...), P&&... parameters)
 {
-    return internal::CallClosureWithExecutionContextTask<WTF::CrossThreadAffinity>::create(threadSafeBind<ExecutionContext*>(function, parameters...));
+    return internal::CallClosureWithExecutionContextTask<WTF::CrossThreadAffinity>::create(threadSafeBind<ExecutionContext*>(function, std::forward<P>(parameters)...));
 }
 
 // [2] createCrossThreadTask() for member functions of class C (with ExecutionContext* argument) + raw pointer (C*).
 // (P = <P1, ..., Pn>, MP = <MP1, ..., MPn, ExecutionContext*>)
 template<typename C, typename... P, typename... MP,
     typename RETTYPE = PassOwnPtr<ExecutionContextTask>, size_t PS = sizeof...(P), size_t MPS = sizeof...(MP)>
-typename std::enable_if<PS + 1 == MPS, RETTYPE>::type createCrossThreadTask(void (C::*function)(MP...), C* p, const P&... parameters)
+typename std::enable_if<PS + 1 == MPS, RETTYPE>::type createCrossThreadTask(void (C::*function)(MP...), C* p, P&&... parameters)
 {
-    return internal::CallClosureWithExecutionContextTask<WTF::CrossThreadAffinity>::create(threadSafeBind<ExecutionContext*>(function, AllowCrossThreadAccess(p), parameters...));
+    return internal::CallClosureWithExecutionContextTask<WTF::CrossThreadAffinity>::create(threadSafeBind<ExecutionContext*>(function, AllowCrossThreadAccess(p), std::forward<P>(parameters)...));
 }
 
 // [3] createCrossThreadTask() for non-member functions
 // (P = <P1, ..., Pn>, MP = <MP1, ..., MPn>)
 template<typename... P, typename... MP,
     typename RETTYPE = PassOwnPtr<ExecutionContextTask>, size_t PS = sizeof...(P), size_t MPS = sizeof...(MP)>
-typename std::enable_if<PS == MPS, RETTYPE>::type createCrossThreadTask(void (*function)(MP...), const P&... parameters)
+typename std::enable_if<PS == MPS, RETTYPE>::type createCrossThreadTask(void (*function)(MP...), P&&... parameters)
 {
-    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, parameters...));
+    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, std::forward<P>(parameters)...));
 }
 
 // [4] createCrossThreadTask() for member functions of class C + raw pointer (C*)
@@ -122,25 +122,26 @@
 // (P = <P1, ..., Pn>, MP = <MP1, ..., MPn>)
 template<typename C, typename... P, typename... MP,
     typename RETTYPE = PassOwnPtr<ExecutionContextTask>, size_t PS = sizeof...(P), size_t MPS = sizeof...(MP)>
-typename std::enable_if<PS == MPS, RETTYPE>::type createCrossThreadTask(void (C::*function)(MP...), C* p, const P&... parameters)
+typename std::enable_if<PS == MPS, RETTYPE>::type createCrossThreadTask(void (C::*function)(MP...), C* p, P&&... parameters)
 {
-    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, AllowCrossThreadAccess(p), parameters...));
+    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, AllowCrossThreadAccess(p), std::forward<P>(parameters)...));
 }
 
 template<typename C, typename... P, typename... MP,
     typename RETTYPE = PassOwnPtr<ExecutionContextTask>, size_t PS = sizeof...(P), size_t MPS = sizeof...(MP)>
-typename std::enable_if<PS == MPS, RETTYPE>::type createCrossThreadTask(void (C::*function)(MP...), const WeakPtr<C>& p, const P&... parameters)
+typename std::enable_if<PS == MPS, RETTYPE>::type createCrossThreadTask(void (C::*function)(MP...), const WeakPtr<C>& p, P&&... parameters)
 {
-    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, AllowCrossThreadAccess(p), parameters...));
+    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, AllowCrossThreadAccess(p), std::forward<P>(parameters)...));
 }
 
 // [6] createCrossThreadTask() for member functions + pointers to class C other than C* or const WeakPtr<C>&
 // (P = <P0, P1, ..., Pn>, MP = <MP1, ..., MPn>)
-template<typename C, typename... P, typename... MP,
+template<typename C, typename P0, typename... P, typename... MP,
     typename RETTYPE = PassOwnPtr<ExecutionContextTask>, size_t PS = sizeof...(P), size_t MPS = sizeof...(MP)>
-typename std::enable_if<PS == MPS + 1, RETTYPE>::type createCrossThreadTask(void (C::*function)(MP...), const P&... parameters)
+typename std::enable_if<PS == MPS && !WTF::IsSubclassOfTemplate<typename std::decay<P0>::type, WeakPtr>::value && !std::is_pointer<typename std::decay<P0>::type>::value, RETTYPE>::type
+createCrossThreadTask(void (C::*function)(MP...), P0&& parameter0, P&&... parameters)
 {
-    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, parameters...));
+    return internal::CallClosureTask<WTF::CrossThreadAffinity>::create(threadSafeBind(function, std::forward<P0>(parameter0), std::forward<P>(parameters)...));
 }
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/core/dom/TreeScope.cpp b/third_party/WebKit/Source/core/dom/TreeScope.cpp
index 377a865..2d1a1b6e 100644
--- a/third_party/WebKit/Source/core/dom/TreeScope.cpp
+++ b/third_party/WebKit/Source/core/dom/TreeScope.cpp

@@ -373,8 +373,10 @@
     DCHECK(this);
     DCHECK(!node.isDocumentNode());
     TreeScopeAdopter adopter(node, *this);
-    if (adopter.needsScopeChange())
+    if (adopter.needsScopeChange()) {
+        ScriptForbiddenScope forbidScript;
         adopter.execute();
+    }
 }
 
 Element* TreeScope::retarget(const Element& target) const

diff --git a/third_party/WebKit/Source/core/editing/Selection.idl b/third_party/WebKit/Source/core/editing/Selection.idl
index 19be361c..b6f216f 100644
--- a/third_party/WebKit/Source/core/editing/Selection.idl
+++ b/third_party/WebKit/Source/core/editing/Selection.idl

@@ -58,10 +58,7 @@
     [MeasureAs=SelectionSelectAllChildren, RaisesException] void selectAllChildren(Node node);
     [MeasureAs=SelectionDeleteDromDocument, CustomElementCallbacks] void deleteFromDocument();
     [MeasureAs=SelectionContainsNode] boolean containsNode(Node node, optional boolean allowPartialContainment = false);
-    // TODO(philipj): The spec does not use [NotEnumerable]. See also:
-    // https://codereview.chromium.org/345983004/
-    // https://www.w3.org/Bugs/Public/show_bug.cgi?id=26179
-    [MeasureAs=SelectionDOMString, NotEnumerable] stringifier DOMString();
+    [MeasureAs=SelectionDOMString] stringifier;
 
     // Non-standard APIs
 

diff --git a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
index b7306f1..82dee5c 100644
--- a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp

@@ -125,7 +125,7 @@
     // to destroy them when the |type| attribute gets set by the parser to
     // something else than 'text'.
     , m_inputType(createdByParser ? nullptr : InputType::createText(*this))
-    , m_inputTypeView(m_inputType)
+    , m_inputTypeView(m_inputType ? m_inputType->createView() : nullptr)
 {
     setHasCustomStyleCallbacks();
 }
@@ -254,14 +254,14 @@
     if (customError())
         return customValidationMessage();
 
-    return m_inputType->validationMessage().first;
+    return m_inputType->validationMessage(*m_inputTypeView).first;
 }
 
 String HTMLInputElement::validationSubMessage() const
 {
     if (!willValidate() || customError())
         return String();
-    return m_inputType->validationMessage().second;
+    return m_inputType->validationMessage(*m_inputTypeView).second;
 }
 
 double HTMLInputElement::minimum() const
@@ -1699,7 +1699,7 @@
 
 String HTMLInputElement::defaultToolTip() const
 {
-    return m_inputType->defaultToolTip();
+    return m_inputType->defaultToolTip(*m_inputTypeView);
 }
 
 bool HTMLInputElement::shouldAppearIndeterminate() const

diff --git a/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.cpp b/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.cpp
index bd286ca9..c25488f9 100644
--- a/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.cpp

@@ -41,6 +41,17 @@
 
 using namespace HTMLNames;
 
+DEFINE_TRACE(BaseCheckableInputType)
+{
+    InputTypeView::trace(visitor);
+    InputType::trace(visitor);
+}
+
+InputTypeView* BaseCheckableInputType::createView()
+{
+    return this;
+}
+
 FormControlState BaseCheckableInputType::saveFormControlState() const
 {
     return FormControlState(element().checked() ? "on" : "off");
@@ -83,7 +94,7 @@
 // FIXME: Could share this with BaseClickableWithKeyInputType and RangeInputType if we had a common base class.
 void BaseCheckableInputType::accessKeyAction(bool sendMouseEvents)
 {
-    InputType::accessKeyAction(sendMouseEvents);
+    InputTypeView::accessKeyAction(sendMouseEvents);
 
     element().dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
 }

diff --git a/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.h b/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.h
index be3fe504..f53fc3a 100644
--- a/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.h
+++ b/third_party/WebKit/Source/core/html/forms/BaseCheckableInputType.h

@@ -32,14 +32,21 @@
 #define BaseCheckableInputType_h
 
 #include "core/html/forms/InputType.h"
+#include "core/html/forms/InputTypeView.h"
 
 namespace blink {
 
 // Base of checkbox and radio types.
-class BaseCheckableInputType : public InputType {
+class BaseCheckableInputType : public InputType, public InputTypeView {
+    USING_GARBAGE_COLLECTED_MIXIN(BaseCheckableInputType);
+public:
+    DECLARE_VIRTUAL_TRACE();
+    using InputType::element;
+
 protected:
     BaseCheckableInputType(HTMLInputElement& element)
         : InputType(element)
+        , InputTypeView(element)
         , m_isInClickHandler(false)
     {
     }
@@ -48,6 +55,7 @@
     bool m_isInClickHandler;
 
 private:
+    InputTypeView* createView() override;
     FormControlState saveFormControlState() const final;
     void restoreFormControlState(const FormControlState&) final;
     void appendToFormData(FormData&) const final;

diff --git a/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.cpp b/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.cpp
index 207e4419..7859f40 100644
--- a/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.cpp

@@ -94,7 +94,7 @@
 
 void BaseClickableWithKeyInputType::accessKeyAction(bool sendMouseEvents)
 {
-    InputType::accessKeyAction(sendMouseEvents);
+    InputTypeView::accessKeyAction(sendMouseEvents);
     accessKeyAction(element(), sendMouseEvents);
 }
 

diff --git a/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.h b/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.h
index 5fd31a9..8bf91a1 100644
--- a/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.h
+++ b/third_party/WebKit/Source/core/html/forms/BaseClickableWithKeyInputType.h

@@ -33,21 +33,31 @@
 
 #include "core/CoreExport.h"
 #include "core/html/forms/InputType.h"
+#include "core/html/forms/InputTypeView.h"
 
 namespace blink {
 
 // Base of input types that dispatches a simulated click on space/return key.
-class CORE_EXPORT BaseClickableWithKeyInputType : public InputType {
+class CORE_EXPORT BaseClickableWithKeyInputType : public InputType, public InputTypeView {
+    USING_GARBAGE_COLLECTED_MIXIN(BaseClickableWithKeyInputType);
 public:
+    DEFINE_INLINE_VIRTUAL_TRACE()
+    {
+        InputTypeView::trace(visitor);
+        InputType::trace(visitor);
+    }
+    using InputType::element;
+
     static void handleKeydownEvent(HTMLInputElement&, KeyboardEvent*);
     static void handleKeypressEvent(HTMLInputElement&, KeyboardEvent*);
     static void handleKeyupEvent(InputTypeView&, KeyboardEvent*);
     static void accessKeyAction(HTMLInputElement&, bool sendMouseEvents);
 
 protected:
-    BaseClickableWithKeyInputType(HTMLInputElement& element) : InputType(element) { }
+    BaseClickableWithKeyInputType(HTMLInputElement& element) : InputType(element), InputTypeView(element) { }
 
 private:
+    InputTypeView* createView() override { return this; }
     void handleKeydownEvent(KeyboardEvent*) override;
     void handleKeypressEvent(KeyboardEvent*) override;
     void handleKeyupEvent(KeyboardEvent*) override;

diff --git a/third_party/WebKit/Source/core/html/forms/FileInputType.cpp b/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
index d76ced7..d51959d 100644
--- a/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/FileInputType.cpp

@@ -359,7 +359,7 @@
     return m_droppedFileSystemId;
 }
 
-String FileInputType::defaultToolTip() const
+String FileInputType::defaultToolTip(const InputTypeView&) const
 {
     FileList* fileList = m_fileList.get();
     unsigned listSize = fileList->length();

diff --git a/third_party/WebKit/Source/core/html/forms/FileInputType.h b/third_party/WebKit/Source/core/html/forms/FileInputType.h
index 38e99150..888eab1b 100644
--- a/third_party/WebKit/Source/core/html/forms/FileInputType.h
+++ b/third_party/WebKit/Source/core/html/forms/FileInputType.h

@@ -73,7 +73,7 @@
     void createShadowSubtree() override;
     void disabledAttributeChanged() override;
     void multipleAttributeChanged() override;
-    String defaultToolTip() const override;
+    String defaultToolTip(const InputTypeView&) const override;
 
     // FileChooserClient implementation.
     void filesChosen(const Vector<FileChooserFileInfo>&) override;

diff --git a/third_party/WebKit/Source/core/html/forms/HiddenInputType.cpp b/third_party/WebKit/Source/core/html/forms/HiddenInputType.cpp
index 7035bd2..ebf7327 100644
--- a/third_party/WebKit/Source/core/html/forms/HiddenInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/HiddenInputType.cpp

@@ -47,6 +47,17 @@
     return new HiddenInputType(element);
 }
 
+DEFINE_TRACE(HiddenInputType)
+{
+    InputTypeView::trace(visitor);
+    InputType::trace(visitor);
+}
+
+InputTypeView* HiddenInputType::createView()
+{
+    return this;
+}
+
 const AtomicString& HiddenInputType::formControlType() const
 {
     return InputTypeNames::hidden;

diff --git a/third_party/WebKit/Source/core/html/forms/HiddenInputType.h b/third_party/WebKit/Source/core/html/forms/HiddenInputType.h
index 060480b6..94b38c9 100644
--- a/third_party/WebKit/Source/core/html/forms/HiddenInputType.h
+++ b/third_party/WebKit/Source/core/html/forms/HiddenInputType.h

@@ -32,15 +32,20 @@
 #define HiddenInputType_h
 
 #include "core/html/forms/InputType.h"
+#include "core/html/forms/InputTypeView.h"
 
 namespace blink {
 
-class HiddenInputType final : public InputType {
+class HiddenInputType final : public InputType, private InputTypeView {
+    USING_GARBAGE_COLLECTED_MIXIN(HiddenInputType);
 public:
     static InputType* create(HTMLInputElement&);
+    DECLARE_VIRTUAL_TRACE();
+    using InputType::element;
 
 private:
-    HiddenInputType(HTMLInputElement& element) : InputType(element) { }
+    HiddenInputType(HTMLInputElement& element) : InputType(element), InputTypeView(element) { }
+    InputTypeView* createView() override;
     const AtomicString& formControlType() const override;
     FormControlState saveFormControlState() const override;
     void restoreFormControlState(const FormControlState&) override;

diff --git a/third_party/WebKit/Source/core/html/forms/InputType.cpp b/third_party/WebKit/Source/core/html/forms/InputType.cpp
index fff2c70..38b62415 100644
--- a/third_party/WebKit/Source/core/html/forms/InputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/InputType.cpp

@@ -141,12 +141,7 @@
 
 DEFINE_TRACE(InputType)
 {
-    InputTypeView::trace(visitor);
-}
-
-InputTypeView* InputType::createView()
-{
-    return this;
+    visitor->trace(m_element);
 }
 
 bool InputType::isTextField() const
@@ -356,13 +351,13 @@
     return locale().queryString(WebLocalizedString::ValidationValueMissing);
 }
 
-std::pair<String, String> InputType::validationMessage() const
+std::pair<String, String> InputType::validationMessage(const InputTypeView& inputTypeView) const
 {
     const String value = element().value();
 
     // The order of the following checks is meaningful. e.g. We'd like to show the
     // badInput message even if the control has other validation errors.
-    if (hasBadInput())
+    if (inputTypeView.hasBadInput())
         return std::make_pair(badInputText(), emptyString());
 
     if (valueMissing(value))
@@ -667,11 +662,11 @@
     return false;
 }
 
-String InputType::defaultToolTip() const
+String InputType::defaultToolTip(const InputTypeView& inputTypeView) const
 {
     if (element().form() && element().form()->noValidate())
         return String();
-    return validationMessage().first;
+    return validationMessage(inputTypeView).first;
 }
 
 Decimal InputType::findClosestTickMarkValue(const Decimal&)

diff --git a/third_party/WebKit/Source/core/html/forms/InputType.h b/third_party/WebKit/Source/core/html/forms/InputType.h
index c03341c..27e57da 100644
--- a/third_party/WebKit/Source/core/html/forms/InputType.h
+++ b/third_party/WebKit/Source/core/html/forms/InputType.h

@@ -37,7 +37,6 @@
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLTextFormControlElement.h"
 #include "core/html/forms/ColorChooserClient.h"
-#include "core/html/forms/InputTypeView.h"
 #include "core/html/forms/StepRange.h"
 
 namespace blink {
@@ -47,22 +46,22 @@
 class ExceptionState;
 class FileList;
 class FormData;
+class InputTypeView;
 
 // An InputType object represents the type-specific part of an HTMLInputElement.
 // Do not expose instances of InputType and classes derived from it to classes
 // other than HTMLInputElement.
 // FIXME: InputType should not inherit InputTypeView. It's conceptually wrong.
-class CORE_EXPORT InputType : public GarbageCollectedFinalized<InputType>, public InputTypeView {
+class CORE_EXPORT InputType : public GarbageCollectedFinalized<InputType> {
     WTF_MAKE_NONCOPYABLE(InputType);
-    USING_GARBAGE_COLLECTED_MIXIN(InputType);
 public:
     static InputType* create(HTMLInputElement&, const AtomicString&);
     static InputType* createText(HTMLInputElement&);
     static const AtomicString& normalizeTypeName(const AtomicString&);
-    ~InputType() override;
+    virtual ~InputType();
     DECLARE_VIRTUAL_TRACE();
 
-    virtual InputTypeView* createView();
+    virtual InputTypeView* createView() = 0;
     virtual const AtomicString& formControlType() const = 0;
 
     // Type query functions
@@ -101,7 +100,7 @@
 
     // Returns a validation message as .first, and title attribute value as
     // .second if patternMismatch.
-    virtual std::pair<String, String> validationMessage() const;
+    std::pair<String, String> validationMessage(const InputTypeView&) const;
     virtual bool supportsValidation() const;
     virtual bool typeMismatchFor(const String&) const;
     // Type check for the current input value. We do nothing for some types
@@ -173,7 +172,7 @@
     virtual int minLength() const;
     virtual bool supportsPlaceholder() const;
     virtual bool supportsReadOnly() const;
-    virtual String defaultToolTip() const;
+    virtual String defaultToolTip(const InputTypeView&) const;
     virtual Decimal findClosestTickMarkValue(const Decimal&);
     virtual bool hasLegalLinkAttribute(const QualifiedName&) const;
     virtual const QualifiedName& subResourceAttributeName() const;
@@ -209,7 +208,8 @@
     virtual ColorChooserClient* colorChooserClient();
 
 protected:
-    InputType(HTMLInputElement& element) : InputTypeView(element) { }
+    InputType(HTMLInputElement& element) : m_element(element) { }
+    HTMLInputElement& element() const { return *m_element; }
     ChromeClient* chromeClient() const;
     Locale& locale() const;
     Decimal parseToNumberOrNaN(const String&) const;
@@ -224,6 +224,8 @@
 private:
     // Helper for stepUp()/stepDown(). Adds step value * count to the current value.
     void applyStep(const Decimal&, int count, AnyStepHandling, TextFieldEventBehavior, ExceptionState&);
+
+    Member<HTMLInputElement> m_element;
 };
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/core/html/forms/NumberInputType.cpp b/third_party/WebKit/Source/core/html/forms/NumberInputType.cpp
index 23bbc46..d3052b3 100644
--- a/third_party/WebKit/Source/core/html/forms/NumberInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/NumberInputType.cpp

@@ -278,7 +278,7 @@
 
 void NumberInputType::minOrMaxAttributeChanged()
 {
-    InputType::minOrMaxAttributeChanged();
+    TextFieldInputType::minOrMaxAttributeChanged();
 
     if (element().layoutObject())
         element().layoutObject()->setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation(LayoutInvalidationReason::AttributeChanged);
@@ -286,7 +286,7 @@
 
 void NumberInputType::stepAttributeChanged()
 {
-    InputType::stepAttributeChanged();
+    TextFieldInputType::stepAttributeChanged();
 
     if (element().layoutObject())
         element().layoutObject()->setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation(LayoutInvalidationReason::AttributeChanged);

diff --git a/third_party/WebKit/Source/core/html/forms/RangeInputType.cpp b/third_party/WebKit/Source/core/html/forms/RangeInputType.cpp
index 6a8d18a..8624ac4 100644
--- a/third_party/WebKit/Source/core/html/forms/RangeInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/RangeInputType.cpp

@@ -81,10 +81,22 @@
 
 RangeInputType::RangeInputType(HTMLInputElement& element)
     : InputType(element)
+    , InputTypeView(element)
     , m_tickMarkValuesDirty(true)
 {
 }
 
+DEFINE_TRACE(RangeInputType)
+{
+    InputTypeView::trace(visitor);
+    InputType::trace(visitor);
+}
+
+InputTypeView* RangeInputType::createView()
+{
+    return this;
+}
+
 void RangeInputType::countUsage()
 {
     countUsageIfVisible(UseCounter::InputTypeRange);
@@ -270,7 +282,7 @@
 // FIXME: Could share this with BaseClickableWithKeyInputType and BaseCheckableInputType if we had a common base class.
 void RangeInputType::accessKeyAction(bool sendMouseEvents)
 {
-    InputType::accessKeyAction(sendMouseEvents);
+    InputTypeView::accessKeyAction(sendMouseEvents);
 
     element().dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
 }

diff --git a/third_party/WebKit/Source/core/html/forms/RangeInputType.h b/third_party/WebKit/Source/core/html/forms/RangeInputType.h
index 28c351e..e18c911b 100644
--- a/third_party/WebKit/Source/core/html/forms/RangeInputType.h
+++ b/third_party/WebKit/Source/core/html/forms/RangeInputType.h

@@ -32,18 +32,24 @@
 #define RangeInputType_h
 
 #include "core/html/forms/InputType.h"
+#include "core/html/forms/InputTypeView.h"
 
 namespace blink {
 
 class ExceptionState;
 class SliderThumbElement;
 
-class RangeInputType final : public InputType {
+class RangeInputType final : public InputType, public InputTypeView {
+    USING_GARBAGE_COLLECTED_MIXIN(RangeInputType);
+
 public:
     static InputType* create(HTMLInputElement&);
+    DECLARE_VIRTUAL_TRACE();
+    using InputType::element;
 
 private:
     RangeInputType(HTMLInputElement&);
+    InputTypeView* createView() override;
     void countUsage() override;
     const AtomicString& formControlType() const override;
     double valueAsDouble() const override;

diff --git a/third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp b/third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp
index f231c08..ee6539e9 100644
--- a/third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp

@@ -109,6 +109,7 @@
 
 TextFieldInputType::TextFieldInputType(HTMLInputElement& element)
     : InputType(element)
+    , InputTypeView(element)
 {
 }
 
@@ -116,6 +117,17 @@
 {
 }
 
+DEFINE_TRACE(TextFieldInputType)
+{
+    InputTypeView::trace(visitor);
+    InputType::trace(visitor);
+}
+
+InputTypeView* TextFieldInputType::createView()
+{
+    return this;
+}
+
 SpinButtonElement* TextFieldInputType::spinButtonElement() const
 {
     return toSpinButtonElement(element().userAgentShadowRoot()->getElementById(ShadowElementNames::spinButton()));
@@ -241,13 +253,13 @@
 
 void TextFieldInputType::handleFocusEvent(Element* oldFocusedNode, WebFocusType focusType)
 {
-    InputType::handleFocusEvent(oldFocusedNode, focusType);
+    InputTypeView::handleFocusEvent(oldFocusedNode, focusType);
     element().beginEditing();
 }
 
 void TextFieldInputType::handleBlurEvent()
 {
-    InputType::handleBlurEvent();
+    InputTypeView::handleBlurEvent();
     element().endEditing();
     if (SpinButtonElement *spinButton = spinButtonElement())
         spinButton->releaseCapture();
@@ -255,7 +267,7 @@
 
 bool TextFieldInputType::shouldSubmitImplicitly(Event* event)
 {
-    return (event->type() == EventTypeNames::textInput && event->hasInterface(EventNames::TextEvent) && toTextEvent(event)->data() == "\n") || InputType::shouldSubmitImplicitly(event);
+    return (event->type() == EventTypeNames::textInput && event->hasInterface(EventNames::TextEvent) && toTextEvent(event)->data() == "\n") || InputTypeView::shouldSubmitImplicitly(event);
 }
 
 LayoutObject* TextFieldInputType::createLayoutObject(const ComputedStyle&) const
@@ -311,7 +323,7 @@
 
 void TextFieldInputType::destroyShadowSubtree()
 {
-    InputType::destroyShadowSubtree();
+    InputTypeView::destroyShadowSubtree();
     if (SpinButtonElement* spinButton = spinButtonElement())
         spinButton->removeSpinButtonOwner();
 }

diff --git a/third_party/WebKit/Source/core/html/forms/TextFieldInputType.h b/third_party/WebKit/Source/core/html/forms/TextFieldInputType.h
index 61cb5887b..4fe3d96 100644
--- a/third_party/WebKit/Source/core/html/forms/TextFieldInputType.h
+++ b/third_party/WebKit/Source/core/html/forms/TextFieldInputType.h

@@ -32,6 +32,7 @@
 #define TextFieldInputType_h
 
 #include "core/html/forms/InputType.h"
+#include "core/html/forms/InputTypeView.h"
 #include "core/html/shadow/SpinButtonElement.h"
 
 namespace blink {
@@ -40,10 +41,14 @@
 
 // The class represents types of which UI contain text fields.
 // It supports not only the types for BaseTextInputType but also type=number.
-class TextFieldInputType : public InputType, protected SpinButtonElement::SpinButtonOwner {
+class TextFieldInputType
+    : public InputType
+    , public InputTypeView
+    , protected SpinButtonElement::SpinButtonOwner {
     USING_GARBAGE_COLLECTED_MIXIN(TextFieldInputType);
 public:
-    DEFINE_INLINE_VIRTUAL_TRACE() { InputType::trace(visitor); }
+    DECLARE_VIRTUAL_TRACE();
+    using InputType::element;
 
 protected:
     TextFieldInputType(HTMLInputElement&);
@@ -76,6 +81,7 @@
     Element* containerElement() const;
 
 private:
+    InputTypeView* createView() override;
     bool shouldShowFocusRingOnMouseFocus() const final;
     bool isTextField() const final;
     bool valueMissing(const String&) const override;

diff --git a/third_party/WebKit/Source/core/layout/line/LineWidth.h b/third_party/WebKit/Source/core/layout/line/LineWidth.h
index 2c9ccb8..6f18faa 100644
--- a/third_party/WebKit/Source/core/layout/line/LineWidth.h
+++ b/third_party/WebKit/Source/core/layout/line/LineWidth.h

@@ -71,7 +71,7 @@
     void applyOverhang(LineLayoutRubyRun, LineLayoutItem startLayoutItem, LineLayoutItem endLayoutItem);
     void fitBelowFloats(bool isFirstLine = false);
     void setTrailingWhitespaceWidth(float width) { m_trailingWhitespaceWidth = width; }
-    void snapUncommittedWidth() { m_uncommittedWidth = LayoutUnit(m_uncommittedWidth).toFloat(); }
+    void snapUncommittedWidth() { m_uncommittedWidth = LayoutUnit::fromFloatCeil(m_uncommittedWidth).toFloat(); }
 
     IndentTextOrNot indentText() const { return m_indentText; }
 

diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGContainer.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGContainer.cpp
index e273b6c..e0e76dd 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGContainer.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGContainer.cpp

@@ -81,6 +81,7 @@
         LayoutSVGModelObject::setNeedsBoundariesUpdate();
     }
 
+    ASSERT(!m_needsBoundariesUpdate);
     clearNeedsLayout();
 }
 

diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGImage.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGImage.cpp
index ccb9c17..91867b2 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGImage.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGImage.cpp

@@ -79,29 +79,32 @@
     ASSERT(needsLayout());
     LayoutAnalyzer::Scope analyzer(*this);
 
+    // Invalidate all resources of this client if our layout changed.
+    if (everHadLayout() && selfNeedsLayout())
+        SVGResourcesCache::clientLayoutChanged(this);
+
     updateBoundingBox();
 
-    bool transformOrBoundariesUpdate = m_needsTransformUpdate || m_needsBoundariesUpdate;
+    bool updateParentBoundaries = false;
     if (m_needsTransformUpdate) {
         m_localTransform = toSVGImageElement(element())->calculateAnimatedLocalTransform();
         m_needsTransformUpdate = false;
+        updateParentBoundaries = true;
     }
 
     if (m_needsBoundariesUpdate) {
         m_paintInvalidationBoundingBox = m_objectBoundingBox;
         SVGLayoutSupport::intersectPaintInvalidationRectWithResources(this, m_paintInvalidationBoundingBox);
-
         m_needsBoundariesUpdate = false;
+        updateParentBoundaries = true;
     }
 
-    // Invalidate all resources of this client if our layout changed.
-    if (everHadLayout() && selfNeedsLayout())
-        SVGResourcesCache::clientLayoutChanged(this);
-
     // If our bounds changed, notify the parents.
-    if (transformOrBoundariesUpdate)
+    if (updateParentBoundaries)
         LayoutSVGModelObject::setNeedsBoundariesUpdate();
 
+    ASSERT(!m_needsBoundariesUpdate);
+    ASSERT(!m_needsTransformUpdate);
     clearNeedsLayout();
 }
 

diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.cpp
index b7671c46..a049d043 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.cpp

@@ -156,31 +156,40 @@
 
 void LayoutSVGShape::layout()
 {
-    bool updateCachedBoundariesInParents = false;
     LayoutAnalyzer::Scope analyzer(*this);
 
-    if (m_needsShapeUpdate || m_needsBoundariesUpdate) {
-        updateShapeFromElement();
-        m_needsShapeUpdate = false;
-        updatePaintInvalidationBoundingBox();
-        m_needsBoundariesUpdate = false;
-        updateCachedBoundariesInParents = true;
-    }
-
-    if (m_needsTransformUpdate) {
-        updateLocalTransform();
-        m_needsTransformUpdate = false;
-        updateCachedBoundariesInParents = true;
-    }
-
     // Invalidate all resources of this client if our layout changed.
     if (everHadLayout() && selfNeedsLayout())
         SVGResourcesCache::clientLayoutChanged(this);
 
+    bool updateParentBoundaries = false;
+    // updateShapeFromElement() also updates the object & stroke bounds - which
+    // feeds into the paint invalidation rect - so we need to call it for both
+    // the shape-update and the bounds-update flag, since .
+    if (m_needsShapeUpdate || m_needsBoundariesUpdate) {
+        updateShapeFromElement();
+        m_needsShapeUpdate = false;
+
+        m_paintInvalidationBoundingBox = strokeBoundingBox();
+        SVGLayoutSupport::intersectPaintInvalidationRectWithResources(this, m_paintInvalidationBoundingBox);
+        m_needsBoundariesUpdate = false;
+
+        updateParentBoundaries = true;
+    }
+
+    if (m_needsTransformUpdate) {
+        updateLocalTransform();
+        m_needsTransformUpdate = false;
+        updateParentBoundaries = true;
+    }
+
     // If our bounds changed, notify the parents.
-    if (updateCachedBoundariesInParents)
+    if (updateParentBoundaries)
         LayoutSVGModelObject::setNeedsBoundariesUpdate();
 
+    ASSERT(!m_needsShapeUpdate);
+    ASSERT(!m_needsBoundariesUpdate);
+    ASSERT(!m_needsTransformUpdate);
     clearNeedsLayout();
 }
 
@@ -283,12 +292,6 @@
     return strokeBoundingBox;
 }
 
-void LayoutSVGShape::updatePaintInvalidationBoundingBox()
-{
-    m_paintInvalidationBoundingBox = strokeBoundingBox();
-    SVGLayoutSupport::intersectPaintInvalidationRectWithResources(this, m_paintInvalidationBoundingBox);
-}
-
 float LayoutSVGShape::strokeWidth() const
 {
     SVGLengthContext lengthContext(element());

diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.h b/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.h
index 55b53b8..d32716a 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.h
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGShape.h

@@ -124,7 +124,6 @@
     FloatRect strokeBoundingBox() const final { return m_strokeBoundingBox; }
     FloatRect calculateObjectBoundingBox() const;
     FloatRect calculateStrokeBoundingBox() const;
-    void updatePaintInvalidationBoundingBox();
     void updateLocalTransform();
 
 private:

diff --git a/third_party/WebKit/Source/platform/CrossThreadCopier.cpp b/third_party/WebKit/Source/platform/CrossThreadCopier.cpp
index d6536815..7c583b2 100644
--- a/third_party/WebKit/Source/platform/CrossThreadCopier.cpp
+++ b/third_party/WebKit/Source/platform/CrossThreadCopier.cpp

@@ -55,12 +55,12 @@
 
 CrossThreadCopier<ResourceRequest>::Type CrossThreadCopier<ResourceRequest>::copy(const ResourceRequest& request)
 {
-    return request.copyData();
+    return passed(request.copyData());
 }
 
 CrossThreadCopier<ResourceResponse>::Type CrossThreadCopier<ResourceResponse>::copy(const ResourceResponse& response)
 {
-    return response.copyData();
+    return passed(response.copyData());
 }
 
 // Test CrossThreadCopier using static_assert.

diff --git a/third_party/WebKit/Source/platform/CrossThreadCopier.h b/third_party/WebKit/Source/platform/CrossThreadCopier.h
index 17c7a80..de30baa0 100644
--- a/third_party/WebKit/Source/platform/CrossThreadCopier.h
+++ b/third_party/WebKit/Source/platform/CrossThreadCopier.h

@@ -43,6 +43,13 @@
 
 class SkRefCnt;
 
+namespace WTF {
+
+template <typename T>
+class PassedWrapper;
+
+}
+
 namespace blink {
 
 class IntRect;
@@ -160,6 +167,13 @@
     }
 };
 
+template <typename T>
+struct CrossThreadCopier<WTF::PassedWrapper<T>> {
+    STATIC_ONLY(CrossThreadCopier);
+    using Type = WTF::PassedWrapper<typename CrossThreadCopier<T>::Type>;
+    static Type copy(WTF::PassedWrapper<T>&& value) { return passed(CrossThreadCopier<T>::copy(value.moveOut())); }
+};
+
 template<typename T>
 struct CrossThreadCopier<CrossThreadWeakPersistentThisPointer<T>> : public CrossThreadCopierPassThrough<CrossThreadWeakPersistentThisPointer<T>> {
     STATIC_ONLY(CrossThreadCopier);
@@ -189,14 +203,14 @@
 template <>
 struct CrossThreadCopier<ResourceRequest> {
     STATIC_ONLY(CrossThreadCopier);
-    typedef PassOwnPtr<CrossThreadResourceRequestData> Type;
+    typedef WTF::PassedWrapper<PassOwnPtr<CrossThreadResourceRequestData>> Type;
     PLATFORM_EXPORT static Type copy(const ResourceRequest&);
 };
 
 template <>
 struct CrossThreadCopier<ResourceResponse> {
     STATIC_ONLY(CrossThreadCopier);
-    typedef PassOwnPtr<CrossThreadResourceResponseData> Type;
+    typedef WTF::PassedWrapper<PassOwnPtr<CrossThreadResourceResponseData>> Type;
     PLATFORM_EXPORT static Type copy(const ResourceResponse&);
 };
 

diff --git a/third_party/WebKit/Source/platform/ThreadSafeFunctional.h b/third_party/WebKit/Source/platform/ThreadSafeFunctional.h
index 855cdb5..7b6a422 100644
--- a/third_party/WebKit/Source/platform/ThreadSafeFunctional.h
+++ b/third_party/WebKit/Source/platform/ThreadSafeFunctional.h

@@ -7,6 +7,7 @@
 
 #include "platform/CrossThreadCopier.h"
 #include "wtf/Functional.h"
+#include <type_traits>
 
 namespace blink {
 
@@ -29,11 +30,11 @@
 template<typename... FreeVariableTypes, typename FunctionType, typename... Ps>
 PassOwnPtr<Function<typename WTF::FunctionWrapper<FunctionType>::ResultType(FreeVariableTypes...), WTF::CrossThreadAffinity>> threadSafeBind(
     FunctionType function,
-    const Ps&... parameters)
+    Ps&&... parameters)
 {
     return WTF::bindInternal<WTF::CrossThreadAffinity, FreeVariableTypes...>(
         function,
-        CrossThreadCopier<Ps>::copy(parameters)...);
+        CrossThreadCopier<typename std::decay<Ps>::type>::copy(std::forward<Ps>(parameters))...);
 }
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/platform/TimerTest.cpp b/third_party/WebKit/Source/platform/TimerTest.cpp
index 080ac90..6d961b0 100644
--- a/third_party/WebKit/Source/platform/TimerTest.cpp
+++ b/third_party/WebKit/Source/platform/TimerTest.cpp

@@ -11,6 +11,7 @@
 #include "public/platform/WebViewScheduler.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "wtf/RefCounted.h"
 #include <queue>
 
 using testing::ElementsAre;

diff --git a/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp b/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp
index 00f39c38..a0d4ad3 100644
--- a/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp
+++ b/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp

@@ -10,18 +10,19 @@
 
 namespace blink {
 
-PassOwnPtr<WebThreadSupportingGC> WebThreadSupportingGC::create(const char* name)
+PassOwnPtr<WebThreadSupportingGC> WebThreadSupportingGC::create(const char* name, bool perThreadHeapEnabled)
 {
-    return adoptPtr(new WebThreadSupportingGC(name, nullptr));
+    return adoptPtr(new WebThreadSupportingGC(name, nullptr, perThreadHeapEnabled));
 }
 
-PassOwnPtr<WebThreadSupportingGC> WebThreadSupportingGC::createForThread(WebThread* thread)
+PassOwnPtr<WebThreadSupportingGC> WebThreadSupportingGC::createForThread(WebThread* thread, bool perThreadHeapEnabled)
 {
-    return adoptPtr(new WebThreadSupportingGC(nullptr, thread));
+    return adoptPtr(new WebThreadSupportingGC(nullptr, thread, perThreadHeapEnabled));
 }
 
-WebThreadSupportingGC::WebThreadSupportingGC(const char* name, WebThread* thread)
+WebThreadSupportingGC::WebThreadSupportingGC(const char* name, WebThread* thread, bool perThreadHeapEnabled)
     : m_thread(thread)
+    , m_perThreadHeapEnabled(perThreadHeapEnabled)
 {
 #if ENABLE(ASSERT)
     ASSERT(!name || !thread);
@@ -47,7 +48,7 @@
 
 void WebThreadSupportingGC::initialize()
 {
-    ThreadState::attachCurrentThread();
+    ThreadState::attachCurrentThread(m_perThreadHeapEnabled);
     m_gcTaskRunner = adoptPtr(new GCTaskRunner(m_thread));
 }
 

diff --git a/third_party/WebKit/Source/platform/WebThreadSupportingGC.h b/third_party/WebKit/Source/platform/WebThreadSupportingGC.h
index 32ea91a..b64835ba 100644
--- a/third_party/WebKit/Source/platform/WebThreadSupportingGC.h
+++ b/third_party/WebKit/Source/platform/WebThreadSupportingGC.h

@@ -29,8 +29,8 @@
     USING_FAST_MALLOC(WebThreadSupportingGC);
     WTF_MAKE_NONCOPYABLE(WebThreadSupportingGC);
 public:
-    static PassOwnPtr<WebThreadSupportingGC> create(const char* name);
-    static PassOwnPtr<WebThreadSupportingGC> createForThread(WebThread*);
+    static PassOwnPtr<WebThreadSupportingGC> create(const char* name, bool perThreadHeapEnabled = false);
+    static PassOwnPtr<WebThreadSupportingGC> createForThread(WebThread*, bool perThreadHeapEnabled = false);
     ~WebThreadSupportingGC();
 
     void postTask(const WebTraceLocation& location, PassOwnPtr<SameThreadClosure> task)
@@ -78,7 +78,7 @@
     }
 
 private:
-    WebThreadSupportingGC(const char* name, WebThread*);
+    WebThreadSupportingGC(const char* name, WebThread*, bool perThreadHeapEnabled);
 
     OwnPtr<GCTaskRunner> m_gcTaskRunner;
 
@@ -87,6 +87,7 @@
     // existing thread via createForThread().
     WebThread* m_thread = nullptr;
     OwnPtr<WebThread> m_owningThread;
+    bool m_perThreadHeapEnabled;
 };
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/platform/heap/GarbageCollected.h b/third_party/WebKit/Source/platform/heap/GarbageCollected.h
index 95804041..182a044 100644
--- a/third_party/WebKit/Source/platform/heap/GarbageCollected.h
+++ b/third_party/WebKit/Source/platform/heap/GarbageCollected.h

@@ -273,86 +273,6 @@
     template<typename U, bool> friend struct FinalizerTraitImpl;
 };
 
-// Base class for objects that are in the Blink garbage-collected heap
-// and are still reference counted.
-//
-// This class should be used sparingly and only to gradually move
-// objects from being reference counted to being managed by the blink
-// garbage collector.
-//
-// While the current reference counting keeps one of these objects
-// alive it will have a Persistent handle to itself allocated so we
-// will not reclaim the memory.  When the reference count reaches 0 the
-// persistent handle will be deleted.  When the garbage collector
-// determines that there are no other references to the object it will
-// be reclaimed and the destructor of the reclaimed object will be
-// called at that time.
-template<typename T>
-class RefCountedGarbageCollected : public GarbageCollectedFinalized<T> {
-    WTF_MAKE_NONCOPYABLE(RefCountedGarbageCollected);
-
-public:
-    RefCountedGarbageCollected()
-        : m_refCount(0)
-    {
-    }
-
-    // Implement method to increase reference count for use with RefPtrs.
-    //
-    // In contrast to the normal WTF::RefCounted, the reference count can reach
-    // 0 and increase again.  This happens in the following scenario:
-    //
-    // (1) The reference count becomes 0, but members, persistents, or
-    //     on-stack pointers keep references to the object.
-    //
-    // (2) The pointer is assigned to a RefPtr again and the reference
-    //     count becomes 1.
-    //
-    // In this case, we have to resurrect m_keepAlive.
-    void ref()
-    {
-        if (UNLIKELY(!m_refCount)) {
-            ASSERT(ThreadState::current()->findPageFromAddress(reinterpret_cast<Address>(this)));
-            makeKeepAlive();
-        }
-        ++m_refCount;
-    }
-
-    // Implement method to decrease reference count for use with RefPtrs.
-    //
-    // In contrast to the normal WTF::RefCounted implementation, the
-    // object itself is not deleted when the reference count reaches
-    // 0.  Instead, the keep-alive persistent handle is deallocated so
-    // that the object can be reclaimed when the garbage collector
-    // determines that there are no other references to the object.
-    void deref()
-    {
-        ASSERT(m_refCount > 0);
-        if (!--m_refCount) {
-            delete m_keepAlive;
-            m_keepAlive = 0;
-        }
-    }
-
-    bool hasOneRef()
-    {
-        return m_refCount == 1;
-    }
-
-protected:
-    ~RefCountedGarbageCollected() { }
-
-private:
-    void makeKeepAlive()
-    {
-        ASSERT(!m_keepAlive);
-        m_keepAlive = new Persistent<T>(static_cast<T*>(this));
-    }
-
-    int m_refCount;
-    Persistent<T>* m_keepAlive;
-};
-
 template<typename T, bool = WTF::IsSubclassOfTemplate<typename std::remove_const<T>::type, GarbageCollected>::value> class NeedsAdjustAndMark;
 
 template<typename T>
@@ -390,10 +310,6 @@
 
 namespace WTF {
 
-// Adoption is not needed nor wanted for RefCountedGarbageCollected<>-derived types.
-template<typename T>
-PassRefPtr<T> adoptRef(blink::RefCountedGarbageCollected<T>*) = delete;
-
 } // namespace WTF
 
 #endif

diff --git a/third_party/WebKit/Source/platform/heap/Handle.h b/third_party/WebKit/Source/platform/heap/Handle.h
index e45d1e1..7a42f169 100644
--- a/third_party/WebKit/Source/platform/heap/Handle.h
+++ b/third_party/WebKit/Source/platform/heap/Handle.h

@@ -43,7 +43,6 @@
 #include "wtf/Functional.h"
 #include "wtf/HashFunctions.h"
 #include "wtf/Locker.h"
-#include "wtf/RefCounted.h"
 #include "wtf/TypeTraits.h"
 
 #if defined(LEAK_SANITIZER)

diff --git a/third_party/WebKit/Source/platform/heap/HeapAllocator.h b/third_party/WebKit/Source/platform/heap/HeapAllocator.h
index 11cd004c..31441f1f 100644
--- a/third_party/WebKit/Source/platform/heap/HeapAllocator.h
+++ b/third_party/WebKit/Source/platform/heap/HeapAllocator.h

@@ -316,6 +316,7 @@
     typename MappedTraitsArg = HashTraits<MappedArg>>
 class HeapHashMap : public HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg, HeapAllocator> {
     IS_GARBAGE_COLLECTED_TYPE();
+    static_assert(WTF::IsWeak<KeyArg>::value || WTF::IsWeak<MappedArg>::value || WTF::NeedsTracing<KeyArg>::value || WTF::NeedsTracing<MappedArg>::value, "For hash maps without traceable elements, use HashMap<> instead of HeapHashMap<>");
 };
 
 template<
@@ -324,6 +325,7 @@
     typename TraitsArg = HashTraits<ValueArg>>
 class HeapHashSet : public HashSet<ValueArg, HashArg, TraitsArg, HeapAllocator> {
     IS_GARBAGE_COLLECTED_TYPE();
+    static_assert(WTF::IsWeak<ValueArg>::value || WTF::NeedsTracing<ValueArg>::value, "For hash sets without traceable elements, use HashSet<> instead of HeapHashSet<>");
 };
 
 template<
@@ -332,6 +334,7 @@
     typename TraitsArg = HashTraits<ValueArg>>
 class HeapLinkedHashSet : public LinkedHashSet<ValueArg, HashArg, TraitsArg, HeapAllocator> {
     IS_GARBAGE_COLLECTED_TYPE();
+    static_assert(WTF::IsWeak<ValueArg>::value || WTF::NeedsTracing<ValueArg>::value, "For sets without traceable elements, use LinkedHashSet<> instead of HeapLinkedHashSet<>");
 };
 
 template<
@@ -340,6 +343,7 @@
     typename HashArg = typename DefaultHash<ValueArg>::Hash>
 class HeapListHashSet : public ListHashSet<ValueArg, inlineCapacity, HashArg, HeapListHashSetAllocator<ValueArg, inlineCapacity>> {
     IS_GARBAGE_COLLECTED_TYPE();
+    static_assert(WTF::IsWeak<ValueArg>::value || WTF::NeedsTracing<ValueArg>::value, "For sets without traceable elements, use ListHashSet<> instead of HeapListHashSet<>");
 };
 
 template<
@@ -348,13 +352,17 @@
     typename Traits = HashTraits<Value>>
 class HeapHashCountedSet : public HashCountedSet<Value, HashFunctions, Traits, HeapAllocator> {
     IS_GARBAGE_COLLECTED_TYPE();
+    static_assert(WTF::IsWeak<Value>::value || WTF::NeedsTracing<Value>::value, "For counted sets without traceable elements, use HashCountedSet<> instead of HeapHashCountedSet<>");
 };
 
 template<typename T, size_t inlineCapacity = 0>
 class HeapVector : public Vector<T, inlineCapacity, HeapAllocator> {
     IS_GARBAGE_COLLECTED_TYPE();
 public:
-    HeapVector() { }
+    HeapVector()
+    {
+        static_assert(WTF::NeedsTracing<T>::value, "For vectors without traceable elements, use Vector<> instead of HeapVector<>");
+    }
 
     explicit HeapVector(size_t size) : Vector<T, inlineCapacity, HeapAllocator>(size)
     {
@@ -375,7 +383,10 @@
 class HeapDeque : public Deque<T, inlineCapacity, HeapAllocator> {
     IS_GARBAGE_COLLECTED_TYPE();
 public:
-    HeapDeque() { }
+    HeapDeque()
+    {
+        static_assert(WTF::NeedsTracing<T>::value, "For vectors without traceable elements, use Deque<> instead of HeapDeque<>");
+    }
 
     explicit HeapDeque(size_t size) : Deque<T, inlineCapacity, HeapAllocator>(size)
     {

diff --git a/third_party/WebKit/Source/platform/heap/HeapTest.cpp b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
index 69bd7ef..0c4bcb0 100644
--- a/third_party/WebKit/Source/platform/heap/HeapTest.cpp
+++ b/third_party/WebKit/Source/platform/heap/HeapTest.cpp

@@ -232,6 +232,11 @@
     static bool isDeletedValue(const blink::PairWithWeakHandling& value) { return value.isHashTableDeletedValue(); }
 };
 
+template<>
+struct NeedsTracing<blink::PairWithWeakHandling> {
+    static const bool value = NeedsTracing<blink::StrongWeakPair>::value;
+};
+
 } // namespace WTF
 
 namespace blink {
@@ -520,7 +525,7 @@
     void runThread() override
     {
         OwnPtr<GlobalIntWrapperPersistent> longLivingPersistent;
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
 
         longLivingPersistent = createGlobalPersistent(0x2a2a2a2a);
         int gcCount = 0;
@@ -579,7 +584,7 @@
 private:
     void runThread() override
     {
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
 
         int gcCount = 0;
         while (!done()) {
@@ -673,7 +678,7 @@
 
     void runThread() override
     {
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
 
         PersistentChain::create(100);
 
@@ -978,11 +983,22 @@
 
 int LargeHeapObject::s_destructorCalls = 0;
 
-class RefCountedAndGarbageCollected : public RefCountedGarbageCollected<RefCountedAndGarbageCollected> {
+// This test class served a more important role while Blink
+// was transitioned over to using Oilpan. That required classes
+// that were hybrid, both ref-counted and on the Oilpan heap
+// (the RefCountedGarbageCollected<> class providing just that.)
+//
+// There's no current need for having a ref-counted veneer on
+// top of a GCed class, but we preserve it here to exercise the
+// implementation technique that it used -- keeping an internal
+// "keep alive" persistent reference that is set & cleared across
+// ref-counting operations.
+//
+class RefCountedAndGarbageCollected : public GarbageCollectedFinalized<RefCountedAndGarbageCollected> {
 public:
     static RefCountedAndGarbageCollected* create()
     {
-        return new RefCountedAndGarbageCollected();
+        return new RefCountedAndGarbageCollected;
     }
 
     ~RefCountedAndGarbageCollected()
@@ -990,10 +1006,21 @@
         ++s_destructorCalls;
     }
 
-    // These are here with their default implementations so you can break in
-    // them in the debugger.
-    void ref() { RefCountedGarbageCollected<RefCountedAndGarbageCollected>::ref(); }
-    void deref() { RefCountedGarbageCollected<RefCountedAndGarbageCollected>::deref(); }
+    void ref()
+    {
+        if (UNLIKELY(!m_refCount)) {
+            ASSERT(ThreadState::current()->findPageFromAddress(reinterpret_cast<Address>(this)));
+            m_keepAlive = this;
+        }
+        ++m_refCount;
+    }
+
+    void deref()
+    {
+        ASSERT(m_refCount > 0);
+        if (!--m_refCount)
+            m_keepAlive.clear();
+    }
 
     DEFINE_INLINE_TRACE() { }
 
@@ -1001,17 +1028,21 @@
 
 private:
     RefCountedAndGarbageCollected()
+        : m_refCount(0)
     {
     }
+
+    int m_refCount;
+    SelfKeepAlive<RefCountedAndGarbageCollected> m_keepAlive;
 };
 
 int RefCountedAndGarbageCollected::s_destructorCalls = 0;
 
-class RefCountedAndGarbageCollected2 : public HeapTestOtherSuperClass, public RefCountedGarbageCollected<RefCountedAndGarbageCollected2> {
+class RefCountedAndGarbageCollected2 : public HeapTestOtherSuperClass, public GarbageCollectedFinalized<RefCountedAndGarbageCollected2> {
 public:
     static RefCountedAndGarbageCollected2* create()
     {
-        return new RefCountedAndGarbageCollected2();
+        return new RefCountedAndGarbageCollected2;
     }
 
     ~RefCountedAndGarbageCollected2()
@@ -1019,14 +1050,34 @@
         ++s_destructorCalls;
     }
 
+    void ref()
+    {
+        if (UNLIKELY(!m_refCount)) {
+            ASSERT(ThreadState::current()->findPageFromAddress(reinterpret_cast<Address>(this)));
+            m_keepAlive = this;
+        }
+        ++m_refCount;
+    }
+
+    void deref()
+    {
+        ASSERT(m_refCount > 0);
+        if (!--m_refCount)
+            m_keepAlive.clear();
+    }
+
     DEFINE_INLINE_TRACE() { }
 
     static int s_destructorCalls;
 
 private:
     RefCountedAndGarbageCollected2()
+        : m_refCount(0)
     {
     }
+
+    int m_refCount;
+    SelfKeepAlive<RefCountedAndGarbageCollected2> m_keepAlive;
 };
 
 int RefCountedAndGarbageCollected2::s_destructorCalls = 0;
@@ -1486,31 +1537,6 @@
 
 int SubClass::s_aliveCount = 0;
 
-class TransitionRefCounted : public RefCountedGarbageCollected<TransitionRefCounted> {
-public:
-    static TransitionRefCounted* create()
-    {
-        return new TransitionRefCounted;
-    }
-
-    ~TransitionRefCounted()
-    {
-        --s_aliveCount;
-    }
-
-    DEFINE_INLINE_TRACE() { }
-
-    static int s_aliveCount;
-
-private:
-    TransitionRefCounted()
-    {
-        ++s_aliveCount;
-    }
-};
-
-int TransitionRefCounted::s_aliveCount = 0;
-
 class Mixin : public GarbageCollectedMixin {
 public:
     DEFINE_INLINE_VIRTUAL_TRACE() { }
@@ -1693,13 +1719,14 @@
 TEST(HeapTest, Transition)
 {
     {
-        Persistent<TransitionRefCounted> refCounted = TransitionRefCounted::create();
-        EXPECT_EQ(1, TransitionRefCounted::s_aliveCount);
+        RefCountedAndGarbageCollected::s_destructorCalls = 0;
+        Persistent<RefCountedAndGarbageCollected> refCounted = RefCountedAndGarbageCollected::create();
         preciselyCollectGarbage();
-        EXPECT_EQ(1, TransitionRefCounted::s_aliveCount);
+        EXPECT_EQ(0, RefCountedAndGarbageCollected::s_destructorCalls);
     }
     preciselyCollectGarbage();
-    EXPECT_EQ(0, TransitionRefCounted::s_aliveCount);
+    EXPECT_EQ(1, RefCountedAndGarbageCollected::s_destructorCalls);
+    RefCountedAndGarbageCollected::s_destructorCalls = 0;
 
     Persistent<PointsBack> pointsBack1 = PointsBack::create();
     Persistent<PointsBack> pointsBack2 = PointsBack::create();
@@ -1711,7 +1738,7 @@
     EXPECT_EQ(1, SubData::s_aliveCount);
 
     preciselyCollectGarbage();
-    EXPECT_EQ(0, TransitionRefCounted::s_aliveCount);
+    EXPECT_EQ(0, RefCountedAndGarbageCollected::s_destructorCalls);
     EXPECT_EQ(2, PointsBack::s_aliveCount);
     EXPECT_EQ(2, SuperClass::s_aliveCount);
     EXPECT_EQ(1, SubClass::s_aliveCount);
@@ -4066,20 +4093,9 @@
         preciselyCollectGarbage();
         EXPECT_EQ(0, SimpleFinalizedObject::s_destructorCalls);
 
-        // Since VectorObjectNoTrace has no trace method it will
-        // not be traced and hence be collected when doing GC.
-        // We trace items in a collection braced on the item's
-        // having a trace method. This is determined via the
-        // NeedsTracing trait in wtf/TypeTraits.h.
-        PersistentHeapVector<VectorObjectNoTrace> vectorNoTrace;
-        VectorObjectNoTrace n1, n2;
-        vectorNoTrace.append(n1);
-        vectorNoTrace.append(n2);
-        preciselyCollectGarbage();
-        EXPECT_EQ(2, SimpleFinalizedObject::s_destructorCalls);
     }
     preciselyCollectGarbage();
-    EXPECT_EQ(8, SimpleFinalizedObject::s_destructorCalls);
+    EXPECT_EQ(6, SimpleFinalizedObject::s_destructorCalls);
 }
 
 TEST(HeapTest, EmbeddedInDeque)
@@ -4104,21 +4120,9 @@
 
         preciselyCollectGarbage();
         EXPECT_EQ(0, SimpleFinalizedObject::s_destructorCalls);
-
-        // Since VectorObjectNoTrace has no trace method it will
-        // not be traced and hence be collected when doing GC.
-        // We trace items in a collection braced on the item's
-        // having a trace method. This is determined via the
-        // NeedsTracing trait in wtf/TypeTraits.h.
-        PersistentHeapDeque<VectorObjectNoTrace> dequeNoTrace;
-        VectorObjectNoTrace n1, n2;
-        dequeNoTrace.append(n1);
-        dequeNoTrace.append(n2);
-        preciselyCollectGarbage();
-        EXPECT_EQ(2, SimpleFinalizedObject::s_destructorCalls);
     }
     preciselyCollectGarbage();
-    EXPECT_EQ(8, SimpleFinalizedObject::s_destructorCalls);
+    EXPECT_EQ(6, SimpleFinalizedObject::s_destructorCalls);
 }
 
 class InlinedVectorObject {
@@ -4535,26 +4539,12 @@
 
 TEST(HeapTest, DestructorsCalled)
 {
-    HeapHashMap<SimpleClassWithDestructor*, OwnPtr<SimpleClassWithDestructor>> map;
+    HeapHashMap<Member<IntWrapper>, OwnPtr<SimpleClassWithDestructor>> map;
     SimpleClassWithDestructor* hasDestructor = new SimpleClassWithDestructor();
-    map.add(hasDestructor, adoptPtr(hasDestructor));
+    map.add(IntWrapper::create(1), adoptPtr(hasDestructor));
     SimpleClassWithDestructor::s_wasDestructed = false;
     map.clear();
     EXPECT_TRUE(SimpleClassWithDestructor::s_wasDestructed);
-
-    destructorsCalledOnClear<HeapHashSet<RefPtr<RefCountedWithDestructor>>>(false);
-    destructorsCalledOnClear<HeapListHashSet<RefPtr<RefCountedWithDestructor>>>(false);
-    destructorsCalledOnClear<HeapLinkedHashSet<RefPtr<RefCountedWithDestructor>>>(false);
-    destructorsCalledOnClear<HeapHashSet<RefPtr<RefCountedWithDestructor>>>(true);
-    destructorsCalledOnClear<HeapListHashSet<RefPtr<RefCountedWithDestructor>>>(true);
-    destructorsCalledOnClear<HeapLinkedHashSet<RefPtr<RefCountedWithDestructor>>>(true);
-
-    destructorsCalledOnGC<HeapHashSet<RefPtr<RefCountedWithDestructor>>>(false);
-    destructorsCalledOnGC<HeapListHashSet<RefPtr<RefCountedWithDestructor>>>(false);
-    destructorsCalledOnGC<HeapLinkedHashSet<RefPtr<RefCountedWithDestructor>>>(false);
-    destructorsCalledOnGC<HeapHashSet<RefPtr<RefCountedWithDestructor>>>(true);
-    destructorsCalledOnGC<HeapListHashSet<RefPtr<RefCountedWithDestructor>>>(true);
-    destructorsCalledOnGC<HeapLinkedHashSet<RefPtr<RefCountedWithDestructor>>>(true);
 }
 
 class MixinA : public GarbageCollectedMixin {
@@ -4730,7 +4720,7 @@
 private:
     static void sleeperMainFunc()
     {
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
         s_sleeperRunning = true;
 
         // Simulate a long running op that is not entering a safepoint.
@@ -5415,7 +5405,7 @@
     {
         MutexLocker locker(workerThreadMutex());
 
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
 
         {
             // Create a worker object that is not kept alive except the
@@ -5536,7 +5526,7 @@
     {
         MutexLocker locker(workerThreadMutex());
 
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
 
         {
             Persistent<WeakCollectionType> collection = allocateCollection();
@@ -5697,7 +5687,7 @@
     static void workerThreadMain()
     {
         MutexLocker locker(workerThreadMutex());
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
 
         DestructorLockingObject* dlo = DestructorLockingObject::create();
         ASSERT_UNUSED(dlo, dlo);
@@ -6109,6 +6099,8 @@
     {
     }
 
+    DEFINE_INLINE_TRACE() { }
+
     int value() const { return m_value->value(); }
 
 private:
@@ -6384,7 +6376,7 @@
 {
     // Step 2: Create an object and store the pointer.
     MutexLocker locker(workerThreadMutex());
-    ThreadState::attachCurrentThread();
+    ThreadState::attachCurrentThread(false);
     *object = DestructorLockingObject::create();
     wakeMainThread();
     parkWorkerThread();
@@ -6508,7 +6500,7 @@
 private:
     void runThread() override
     {
-        ThreadState::attachCurrentThread();
+        ThreadState::attachCurrentThread(false);
         EXPECT_EQ(42, threadSpecificIntWrapper().value());
         ThreadState::detachCurrentThread();
         atomicDecrement(&m_threadsToFinish);

diff --git a/third_party/WebKit/Source/platform/heap/PersistentNode.cpp b/third_party/WebKit/Source/platform/heap/PersistentNode.cpp
index 329a0370..233fbc3 100644
--- a/third_party/WebKit/Source/platform/heap/PersistentNode.cpp
+++ b/third_party/WebKit/Source/platform/heap/PersistentNode.cpp

@@ -49,7 +49,7 @@
 // a PersistentNodeSlot that contains only freed PersistentNodes,
 // we delete the PersistentNodeSlot. This function rebuilds the free
 // list of PersistentNodes.
-void PersistentRegion::tracePersistentNodes(Visitor* visitor)
+void PersistentRegion::tracePersistentNodes(Visitor* visitor, ShouldTraceCallback shouldTrace)
 {
     size_t debugMarkedObjectSize = ProcessHeap::totalMarkedObjectSize();
     base::debug::Alias(&debugMarkedObjectSize);
@@ -71,8 +71,10 @@
                 freeListNext = node;
                 ++freeCount;
             } else {
-                node->tracePersistentNode(visitor);
                 ++persistentCount;
+                if (!shouldTrace(visitor, node))
+                    continue;
+                node->tracePersistentNode(visitor);
                 debugMarkedObjectSize = ProcessHeap::totalMarkedObjectSize();
             }
         }
@@ -102,6 +104,16 @@
 };
 }
 
+bool CrossThreadPersistentRegion::shouldTracePersistentNode(Visitor* visitor, PersistentNode* node)
+{
+    CrossThreadPersistent<GCObject>* persistent = reinterpret_cast<CrossThreadPersistent<GCObject>*>(node->self());
+    ASSERT(persistent);
+    Address rawObject = reinterpret_cast<Address>(persistent->get());
+    if (!rawObject)
+        return false;
+    return &visitor->heap() == &ThreadState::fromObject(rawObject)->heap();
+}
+
 void CrossThreadPersistentRegion::prepareForThreadStateTermination(ThreadState* threadState)
 {
     // For heaps belonging to a thread that's detaching, any cross-thread persistents

diff --git a/third_party/WebKit/Source/platform/heap/PersistentNode.h b/third_party/WebKit/Source/platform/heap/PersistentNode.h
index ebaf0604..260e585 100644
--- a/third_party/WebKit/Source/platform/heap/PersistentNode.h
+++ b/third_party/WebKit/Source/platform/heap/PersistentNode.h

@@ -148,7 +148,11 @@
         --m_persistentCount;
 #endif
     }
-    void tracePersistentNodes(Visitor*);
+
+    static bool shouldTracePersistentNode(Visitor*, PersistentNode*) { return true; }
+
+    using ShouldTraceCallback = bool (*)(Visitor*, PersistentNode*);
+    void tracePersistentNodes(Visitor*, ShouldTraceCallback = PersistentRegion::shouldTracePersistentNode);
     int numberOfPersistents();
 
 private:
@@ -183,11 +187,13 @@
     void tracePersistentNodes(Visitor* visitor)
     {
         MutexLocker lock(m_mutex);
-        m_persistentRegion->tracePersistentNodes(visitor);
+        m_persistentRegion->tracePersistentNodes(visitor, CrossThreadPersistentRegion::shouldTracePersistentNode);
     }
 
     void prepareForThreadStateTermination(ThreadState*);
 
+    static bool shouldTracePersistentNode(Visitor*, PersistentNode*);
+
 private:
     // We don't make CrossThreadPersistentRegion inherit from PersistentRegion
     // because we don't want to virtualize performance-sensitive methods

diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.cpp b/third_party/WebKit/Source/platform/heap/ThreadState.cpp
index d8882ad..155e311 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.cpp
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.cpp

@@ -73,7 +73,7 @@
 uintptr_t ThreadState::s_mainThreadUnderestimatedStackSize = 0;
 uint8_t ThreadState::s_mainThreadStateStorage[sizeof(ThreadState)];
 
-ThreadState::ThreadState()
+ThreadState::ThreadState(bool perThreadHeapEnabled)
     : m_thread(currentThread())
     , m_persistentRegion(adoptPtr(new PersistentRegion()))
 #if OS(WIN) && COMPILER(MSVC)
@@ -90,6 +90,7 @@
     , m_accumulatedSweepingTime(0)
     , m_vectorBackingArenaIndex(BlinkGC::Vector1ArenaIndex)
     , m_currentArenaAges(0)
+    , m_perThreadHeapEnabled(perThreadHeapEnabled)
     , m_isTerminating(false)
     , m_gcMixinMarker(nullptr)
     , m_shouldFlushHeapDoesNotContainCache(false)
@@ -110,7 +111,12 @@
     ASSERT(!**s_threadSpecific);
     **s_threadSpecific = this;
 
-    if (isMainThread()) {
+    // TODO(keishi) Remove when per thread heap is ready.
+    CHECK(!m_perThreadHeapEnabled);
+
+    if (m_perThreadHeapEnabled) {
+        m_heap = new ThreadHeap();
+    } else if (isMainThread()) {
         s_mainThreadStackStart = reinterpret_cast<uintptr_t>(m_startOfStack) - sizeof(void*);
         size_t underestimatedStackSize = StackFrameDepth::getUnderestimatedStackSize();
         if (underestimatedStackSize > sizeof(void*))
@@ -189,13 +195,13 @@
 {
     RELEASE_ASSERT(!ProcessHeap::s_shutdownComplete);
     s_threadSpecific = new WTF::ThreadSpecific<ThreadState*>();
-    new (s_mainThreadStateStorage) ThreadState();
+    new (s_mainThreadStateStorage) ThreadState(false);
 }
 
-void ThreadState::attachCurrentThread()
+void ThreadState::attachCurrentThread(bool perThreadHeapEnabled)
 {
     RELEASE_ASSERT(!ProcessHeap::s_shutdownComplete);
-    new ThreadState();
+    new ThreadState(perThreadHeapEnabled);
 }
 
 void ThreadState::cleanupPages()

diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.h b/third_party/WebKit/Source/platform/heap/ThreadState.h
index 255c5c6..572810d 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.h
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.h

@@ -173,6 +173,8 @@
     void lockThreadAttachMutex();
     void unlockThreadAttachMutex();
 
+    bool perThreadHeapEnabled() const { return m_perThreadHeapEnabled; }
+
     bool isTerminating() { return m_isTerminating; }
 
     static void attachMainThread();
@@ -182,7 +184,7 @@
     // Associate ThreadState object with the current thread. After this
     // call thread can start using the garbage collected heap infrastructure.
     // It also has to periodically check for safepoints.
-    static void attachCurrentThread();
+    static void attachCurrentThread(bool perThreadHeapEnabled);
 
     // Disassociate attached ThreadState from the current thread. The thread
     // can no longer use the garbage collected heap after this call.
@@ -527,7 +529,7 @@
         FreelistSnapshot
     };
 
-    ThreadState();
+    ThreadState(bool perThreadHeapEnabled);
     ~ThreadState();
 
     NO_SANITIZE_ADDRESS void copyStackUntilSafePointScope();
@@ -637,6 +639,7 @@
     size_t m_arenaAges[BlinkGC::NumberOfArenas];
     size_t m_currentArenaAges;
 
+    bool m_perThreadHeapEnabled;
     bool m_isTerminating;
     GarbageCollectedMixinConstructorMarker* m_gcMixinMarker;
 

diff --git a/third_party/WebKit/Source/platform/heap/Visitor.h b/third_party/WebKit/Source/platform/heap/Visitor.h
index 46260bdd..8ee8243 100644
--- a/third_party/WebKit/Source/platform/heap/Visitor.h
+++ b/third_party/WebKit/Source/platform/heap/Visitor.h

@@ -313,6 +313,8 @@
 
     inline MarkingMode getMarkingMode() const { return m_markingMode; }
 
+    inline ThreadHeap& heap() const { return m_state->heap(); }
+
 protected:
     Visitor(ThreadState*, MarkingMode);
 

diff --git a/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp b/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp
index 0968152..75282894 100644
--- a/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp
+++ b/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp

@@ -35,6 +35,7 @@
 #include "core/dom/SecurityContext.h"
 #include "core/fetch/SubstituteData.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
+#include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/WorkerDebuggerAgent.h"
 #include "core/inspector/WorkerInspectorController.h"
@@ -55,6 +56,7 @@
 #include "public/platform/Platform.h"
 #include "public/platform/WebURLRequest.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerProvider.h"
+#include "public/web/WebConsoleMessage.h"
 #include "public/web/WebDevToolsAgent.h"
 #include "public/web/WebSettings.h"
 #include "public/web/WebView.h"
@@ -203,6 +205,30 @@
         devtoolsAgent->dispatchOnInspectorBackend(sessionId, message);
 }
 
+void WebEmbeddedWorkerImpl::addMessageToConsole(const WebConsoleMessage& message)
+{
+    MessageLevel webCoreMessageLevel;
+    switch (message.level) {
+    case WebConsoleMessage::LevelDebug:
+        webCoreMessageLevel = DebugMessageLevel;
+        break;
+    case WebConsoleMessage::LevelLog:
+        webCoreMessageLevel = LogMessageLevel;
+        break;
+    case WebConsoleMessage::LevelWarning:
+        webCoreMessageLevel = WarningMessageLevel;
+        break;
+    case WebConsoleMessage::LevelError:
+        webCoreMessageLevel = ErrorMessageLevel;
+        break;
+    default:
+        NOTREACHED();
+        return;
+    }
+
+    m_mainFrame->frame()->document()->addConsoleMessage(ConsoleMessage::create(OtherMessageSource, webCoreMessageLevel, message.text, message.url, message.lineNumber, message.columnNumber));
+}
+
 void WebEmbeddedWorkerImpl::postMessageToPageInspector(const String& message)
 {
     m_workerInspectorProxy->dispatchMessageFromWorker(message);

diff --git a/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.h b/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.h
index 369ef4e..34e88d3 100644
--- a/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.h
+++ b/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.h

@@ -67,6 +67,7 @@
     void reattachDevTools(const WebString& hostId, int sessionId, const WebString& savedState) override;
     void detachDevTools() override;
     void dispatchDevToolsMessage(int sessionId, const WebString&) override;
+    void addMessageToConsole(const WebConsoleMessage&) override;
 
     void postMessageToPageInspector(const WTF::String&);
 

diff --git a/third_party/WebKit/public/platform/WebPrivatePtr.h b/third_party/WebKit/public/platform/WebPrivatePtr.h
index 0ff0258..4925f35 100644
--- a/third_party/WebKit/public/platform/WebPrivatePtr.h
+++ b/third_party/WebKit/public/platform/WebPrivatePtr.h

@@ -66,18 +66,14 @@
 enum LifetimeManagementType {
     RefCountedLifetime,
     GarbageCollectedLifetime,
-    RefCountedGarbageCollectedLifetime
 };
 
 template<typename T>
 struct LifetimeOf {
 private:
     static const bool isGarbageCollected = WTF::IsSubclassOfTemplate<T, GarbageCollected>::value || IsGarbageCollectedMixin<T>::value;
-    static const bool isRefCountedGarbageCollected = WTF::IsSubclassOfTemplate<T, RefCountedGarbageCollected>::value;
 public:
-    static const LifetimeManagementType value =
-        !isGarbageCollected ? RefCountedLifetime :
-        isRefCountedGarbageCollected ? RefCountedGarbageCollectedLifetime : GarbageCollectedLifetime;
+    static const LifetimeManagementType value = !isGarbageCollected ? RefCountedLifetime : GarbageCollectedLifetime;
 };
 
 template<typename T, WebPrivatePtrDestruction crossThreadDestruction, WebPrivatePtrStrength strongOrWeak, LifetimeManagementType lifetime>
@@ -173,14 +169,6 @@
 };
 
 template<typename T, WebPrivatePtrDestruction crossThreadDestruction, WebPrivatePtrStrength strongOrWeak>
-class PtrStorageImpl<T, crossThreadDestruction, strongOrWeak, RefCountedGarbageCollectedLifetime> : public PtrStorageImpl<T, crossThreadDestruction, strongOrWeak, GarbageCollectedLifetime> {
-public:
-    void assign(T* val) { PtrStorageImpl<T, crossThreadDestruction, strongOrWeak, GarbageCollectedLifetime>::assign(val); }
-
-    void assign(const PtrStorageImpl& other) { PtrStorageImpl<T, crossThreadDestruction, strongOrWeak, GarbageCollectedLifetime>::assign(other.get()); }
-};
-
-template<typename T, WebPrivatePtrDestruction crossThreadDestruction, WebPrivatePtrStrength strongOrWeak>
 class PtrStorage : public PtrStorageImpl<T, crossThreadDestruction, strongOrWeak, LifetimeOf<T>::value> {
 public:
     static PtrStorage& fromSlot(void** slot)

diff --git a/third_party/WebKit/public/web/WebEmbeddedWorker.h b/third_party/WebKit/public/web/WebEmbeddedWorker.h
index ec0092c3b..89fd878 100644
--- a/third_party/WebKit/public/web/WebEmbeddedWorker.h
+++ b/third_party/WebKit/public/web/WebEmbeddedWorker.h

@@ -38,6 +38,7 @@
 class WebServiceWorkerContextClient;
 class WebString;
 class WebWorkerContentSettingsClientProxy;
+struct WebConsoleMessage;
 struct WebEmbeddedWorkerStartData;
 
 // An interface to start and terminate an embedded worker.
@@ -67,6 +68,7 @@
     virtual void reattachDevTools(const WebString& hostId, int sessionId, const WebString& savedState) = 0;
     virtual void detachDevTools() = 0;
     virtual void dispatchDevToolsMessage(int sessionId, const WebString&) = 0;
+    virtual void addMessageToConsole(const WebConsoleMessage&) = 0;
 };
 
 } // namespace blink

diff --git a/third_party/WebKit/public/web/WebExternalPopupMenu.h b/third_party/WebKit/public/web/WebExternalPopupMenu.h
index 44a2e8b8..22c89b1 100644
--- a/third_party/WebKit/public/web/WebExternalPopupMenu.h
+++ b/third_party/WebKit/public/web/WebExternalPopupMenu.h

@@ -38,6 +38,8 @@
 class WebExternalPopupMenu {
 public:
     virtual void show(const WebRect& bounds) = 0;
+    // Close the popup menu widget. This function should not call
+    // WebExternalPopupMenuClient functions.
     virtual void close() = 0;
 };
 

diff --git a/third_party/brotli/README.chromium b/third_party/brotli/README.chromium
index 63f8a24..45f649c 100644
--- a/third_party/brotli/README.chromium
+++ b/third_party/brotli/README.chromium

@@ -1,6 +1,6 @@
 Name: Brotli
 URL: https://github.com/google/brotli
-Version: 722f8996b05bdec7c375462f9139e72ed33e3c85
+Version: 510131d1db47f91602f45b9a8d7b1ee54d12a629
 License: MIT
 License File: LICENSE
 Security Critical: yes

diff --git a/third_party/brotli/dec/bit_reader.h b/third_party/brotli/dec/bit_reader.h
index e77d114..7096afa 100644
--- a/third_party/brotli/dec/bit_reader.h
+++ b/third_party/brotli/dec/bit_reader.h

@@ -14,10 +14,6 @@
 #include "./port.h"
 #include "./types.h"
 
-#ifdef BROTLI_DECODE_DEBUG
-#include <stdio.h>
-#endif
-
 #if defined(__cplusplus) || defined(c_plusplus)
 extern "C" {
 #endif
@@ -66,13 +62,13 @@
 } BrotliBitReaderState;
 
 /* Initializes the bitreader fields. */
-void BrotliInitBitReader(BrotliBitReader* const br);
+BROTLI_INTERNAL void BrotliInitBitReader(BrotliBitReader* const br);
 
 /* Ensures that accumulator is not empty. May consume one byte of input.
    Returns 0 if data is required but there is no input available.
    For BROTLI_ALIGNED_READ this function also prepares bit reader for aligned
    reading. */
-int BrotliWarmupBitReader(BrotliBitReader* const br);
+BROTLI_INTERNAL int BrotliWarmupBitReader(BrotliBitReader* const br);
 
 static BROTLI_INLINE void BrotliBitReaderSaveState(
     BrotliBitReader* const from, BrotliBitReaderState* to) {
@@ -298,10 +294,8 @@
 static BROTLI_INLINE void BrotliTakeBits(
   BrotliBitReader* const br, uint32_t n_bits, uint32_t* val) {
   *val = (uint32_t)BrotliGetBitsUnmasked(br) & BitMask(n_bits);
-#ifdef BROTLI_DECODE_DEBUG
-  printf("[BrotliReadBits]  %d %d %d val: %6x\n",
-         (int)br->avail_in, (int)br->bit_pos_, n_bits, (int)*val);
-#endif
+  BROTLI_LOG(("[BrotliReadBits]  %d %d %d val: %6x\n",
+      (int)br->avail_in, (int)br->bit_pos_, n_bits, (int)*val));
   BrotliDropBits(br, n_bits);
 }
 

diff --git a/third_party/brotli/dec/decode.c b/third_party/brotli/dec/decode.c
index a81706b0..a3cc89e 100644
--- a/third_party/brotli/dec/decode.c
+++ b/third_party/brotli/dec/decode.c

@@ -10,7 +10,6 @@
 #include <arm_neon.h>
 #endif
 
-#include <stdio.h>  /* printf (debug output) */
 #include <stdlib.h>  /* free, malloc */
 #include <string.h>  /* memcpy, memset */
 
@@ -20,38 +19,20 @@
 #include "./huffman.h"
 #include "./port.h"
 #include "./prefix.h"
+#include "./state.h"
 #include "./transform.h"
 
 #if defined(__cplusplus) || defined(c_plusplus)
 extern "C" {
 #endif
 
-/* BROTLI_FAILURE macro unwraps to BROTLI_RESULT_ERROR in non-debug build. */
-/* In debug build it dumps file name, line and pretty function name. */
-#if defined(_MSC_VER) || \
-  (!defined(BROTLI_DEBUG) && !defined(BROTLI_DECODE_DEBUG))
-#define BROTLI_FAILURE() BROTLI_RESULT_ERROR
-#else
-#define BROTLI_FAILURE() BrotliFailure(__FILE__, __LINE__, __PRETTY_FUNCTION__)
-static inline BrotliResult BrotliFailure(const char* f, int l, const char* fn) {
-  fprintf(stderr, "ERROR at %s:%d (%s)\n", f, l, fn);
-  fflush(stderr);
-  return BROTLI_RESULT_ERROR;
-}
-#endif
+#define BROTLI_FAILURE() (BROTLI_DUMP(), BROTLI_RESULT_ERROR)
 
-#ifdef BROTLI_DECODE_DEBUG
 #define BROTLI_LOG_UINT(name)                                       \
-  printf("[%s] %s = %lu\n", __func__, #name, (unsigned long)(name))
+  BROTLI_LOG(("[%s] %s = %lu\n", __func__, #name, (unsigned long)(name)))
 #define BROTLI_LOG_ARRAY_INDEX(array_name, idx)                     \
-  printf("[%s] %s[%lu] = %lu\n", __func__, #array_name,             \
-         (unsigned long)(idx), (unsigned long)array_name[idx])
-#define BROTLI_LOG(x) printf x
-#else
-#define BROTLI_LOG_UINT(name)
-#define BROTLI_LOG_ARRAY_INDEX(array_name, idx)
-#define BROTLI_LOG(x)
-#endif
+  BROTLI_LOG(("[%s] %s[%lu] = %lu\n", __func__, #array_name,        \
+         (unsigned long)(idx), (unsigned long)array_name[idx]))
 
 static const uint32_t kDefaultCodeLength = 8;
 static const uint32_t kCodeLengthRepeatCode = 16;
@@ -89,7 +70,7 @@
     state = (BrotliState*)alloc_func(opaque, sizeof(BrotliState));
   }
   if (state == 0) {
-    (void)BROTLI_FAILURE();
+    BROTLI_DUMP();
     return 0;
   }
   BrotliStateInitWithCustomAllocators(state, alloc_func, free_func, opaque);
@@ -376,7 +357,6 @@
   return SafeDecodeSymbol(table, br, result);
 }
 
-
 /* Makes a look-up in first level Huffman table. Peeks 8 bits. */
 static BROTLI_INLINE void PreloadSymbol(int safe,
                                         const HuffmanCode* table,
@@ -514,7 +494,7 @@
   *repeat += repeat_delta + 3U;
   repeat_delta = *repeat - old_repeat;
   if (*symbol + repeat_delta > alphabet_size) {
-    (void)BROTLI_FAILURE();
+    BROTLI_DUMP();
     *symbol = alphabet_size;
     *space = 0xFFFFF;
     return;
@@ -886,7 +866,6 @@
   state->mtf_upper_bound = upper_bound;
 }
 
-
 /* Decodes a series of Huffman table using ReadHuffmanCode function. */
 static BrotliResult HuffmanTreeGroupDecode(HuffmanTreeGroup* group,
                                            BrotliState* s) {
@@ -1248,7 +1227,7 @@
       }
     }
   }
-  return BROTLI_FAILURE();
+  BROTLI_DCHECK(0);  /* Unreachable */
 }
 
 int BrotliDecompressedSize(size_t encoded_size,
@@ -1287,7 +1266,8 @@
 static void BROTLI_NOINLINE BrotliCalculateRingBufferSize(BrotliState* s,
     BrotliBitReader* br) {
   int is_last = s->is_last_metablock;
-  s->ringbuffer_size = 1 << s->window_bits;
+  int window_size = 1 << s->window_bits;
+  s->ringbuffer_size = window_size;
 
   if (s->is_uncompressed) {
     int next_block_header =
@@ -1299,20 +1279,21 @@
     }
   }
 
+  /* Limit custom dictionary size to stream window size. */
+  if (s->custom_dict_size >= window_size) {
+    s->custom_dict += s->custom_dict_size - window_size;
+    s->custom_dict_size = window_size;
+  }
+
   /* We need at least 2 bytes of ring buffer size to get the last two
      bytes for context from there */
   if (is_last) {
-    while (s->ringbuffer_size >= s->meta_block_remaining_len * 2 &&
-           s->ringbuffer_size > 32) {
+    int min_size_x2 = (s->meta_block_remaining_len + s->custom_dict_size) * 2;
+    while (s->ringbuffer_size >= min_size_x2 && s->ringbuffer_size > 32) {
       s->ringbuffer_size >>= 1;
     }
   }
 
-  /* But make it fit the custom dictionary if there is one. */
-  while (s->ringbuffer_size < s->custom_dict_size) {
-    s->ringbuffer_size <<= 1;
-  }
-
   s->ringbuffer_mask = s->ringbuffer_size - 1;
 }
 

diff --git a/third_party/brotli/dec/decode.h b/third_party/brotli/dec/decode.h
index 074b2f5..7ac771e 100644
--- a/third_party/brotli/dec/decode.h
+++ b/third_party/brotli/dec/decode.h

@@ -9,13 +9,14 @@
 #ifndef BROTLI_DEC_DECODE_H_
 #define BROTLI_DEC_DECODE_H_
 
-#include "./state.h"
 #include "./types.h"
 
 #if defined(__cplusplus) || defined(c_plusplus)
 extern "C" {
 #endif
 
+typedef struct BrotliStateStruct BrotliState;
+
 typedef enum {
   /* Decoding error, e.g. corrupt input or memory allocation problem */
   BROTLI_RESULT_ERROR = 0,
@@ -80,14 +81,21 @@
    Not to be confused with the built-in transformable dictionary of Brotli.
    The dictionary must exist in memory until decoding is done and is owned by
    the caller. To use:
-    1) initialize state with BrotliStateInit
-    2) use BrotliSetCustomDictionary
-    3) use BrotliDecompressStream
-    4) clean up with BrotliStateCleanup
+    1) Allocate and initialize state with BrotliCreateState
+    2) Use BrotliSetCustomDictionary
+    3) Use BrotliDecompressStream
+    4) Clean up and free state with BrotliDestroyState
 */
 void BrotliSetCustomDictionary(
     size_t size, const uint8_t* dict, BrotliState* s);
 
+/* Returns 1, if s is in a state where we have not read any input bytes yet,
+   and 0 otherwise */
+int BrotliStateIsStreamStart(const BrotliState* s);
+
+/* Returns 1, if s is in a state where we reached the end of the input and
+   produced all of the output, and 0 otherwise. */
+int BrotliStateIsStreamEnd(const BrotliState* s);
 
 #if defined(__cplusplus) || defined(c_plusplus)
 } /* extern "C" */

diff --git a/third_party/brotli/dec/huffman.c b/third_party/brotli/dec/huffman.c
index 159ac1c..3775ffe 100644
--- a/third_party/brotli/dec/huffman.c
+++ b/third_party/brotli/dec/huffman.c

@@ -99,7 +99,6 @@
   return len - root_bits;
 }
 
-
 void BrotliBuildCodeLengthsHuffmanTable(HuffmanCode* table,
                                         const uint8_t* const code_lengths,
                                         uint16_t* count) {

diff --git a/third_party/brotli/dec/huffman.h b/third_party/brotli/dec/huffman.h
index 7cbec80..fc88081 100644
--- a/third_party/brotli/dec/huffman.h
+++ b/third_party/brotli/dec/huffman.h

@@ -10,6 +10,7 @@
 #define BROTLI_DEC_HUFFMAN_H_
 
 #include "./types.h"
+#include "./port.h"
 
 #if defined(__cplusplus) || defined(c_plusplus)
 extern "C" {
@@ -36,27 +37,21 @@
   uint16_t value;  /* symbol value or table offset */
 } HuffmanCode;
 
-
 /* Builds Huffman lookup table assuming code lengths are in symbol order. */
-void BrotliBuildCodeLengthsHuffmanTable(HuffmanCode* root_table,
-                                        const uint8_t* const code_lengths,
-                                        uint16_t* count);
+BROTLI_INTERNAL void BrotliBuildCodeLengthsHuffmanTable(HuffmanCode* root_table,
+    const uint8_t* const code_lengths, uint16_t* count);
 
 /* Builds Huffman lookup table assuming code lengths are in symbol order. */
 /* Returns size of resulting table. */
-uint32_t BrotliBuildHuffmanTable(HuffmanCode* root_table,
-                                 int root_bits,
-                                 const uint16_t* const symbol_lists,
-                                 uint16_t* count_arg);
+BROTLI_INTERNAL uint32_t BrotliBuildHuffmanTable(HuffmanCode* root_table,
+    int root_bits, const uint16_t* const symbol_lists, uint16_t* count_arg);
 
 /* Builds a simple Huffman table. The num_symbols parameter is to be */
 /* interpreted as follows: 0 means 1 symbol, 1 means 2 symbols, 2 means 3 */
 /* symbols, 3 means 4 symbols with lengths 2,2,2,2, 4 means 4 symbols with */
 /* lengths 1,2,3,3. */
-uint32_t BrotliBuildSimpleHuffmanTable(HuffmanCode* table,
-                                       int root_bits,
-                                       uint16_t* symbols,
-                                       uint32_t num_symbols);
+BROTLI_INTERNAL uint32_t BrotliBuildSimpleHuffmanTable(HuffmanCode* table,
+    int root_bits, uint16_t* symbols, uint32_t num_symbols);
 
 /* Contains a collection of Huffman trees with the same alphabet size. */
 typedef struct {

diff --git a/third_party/brotli/dec/port.h b/third_party/brotli/dec/port.h
index 6cbe498..30b5cac7 100644
--- a/third_party/brotli/dec/port.h
+++ b/third_party/brotli/dec/port.h

@@ -18,13 +18,16 @@
       read and overlapping memcpy; this reduces decompression speed by 5%
     * BROTLI_DEBUG dumps file name and line number when decoder detects stream
       or memory error
-    * BROTLI_DECODE_DEBUG enables asserts and dumps various state information
+    * BROTLI_ENABLE_LOG enables asserts and dumps various state information
  */
 
 #ifndef BROTLI_DEC_PORT_H_
 #define BROTLI_DEC_PORT_H_
 
+#if defined(BROTLI_ENABLE_LOG) || defined(BROTLI_DEBUG)
 #include <assert.h>
+#include <stdio.h>
+#endif
 
 /* Compatibility with non-clang compilers. */
 #ifndef __has_builtin
@@ -84,12 +87,13 @@
 #endif
 
 #ifdef BROTLI_BUILD_PORTABLE
-#define BROTLI_ALIGNED_READ 1
+#define BROTLI_ALIGNED_READ (!!1)
 #elif defined(BROTLI_TARGET_X86) || defined(BROTLI_TARGET_X64) || \
      defined(BROTLI_TARGET_ARMV7) || defined(BROTLI_TARGET_ARMV8)
-#define BROTLI_ALIGNED_READ 0  /* Allow unaligned access on whitelisted CPUs. */
+/* Allow unaligned read only for whitelisted CPUs. */
+#define BROTLI_ALIGNED_READ (!!0)
 #else
-#define BROTLI_ALIGNED_READ 1
+#define BROTLI_ALIGNED_READ (!!1)
 #endif
 
 /* Define "PREDICT_TRUE" and "PREDICT_FALSE" macros for capable compilers.
@@ -119,9 +123,9 @@
 
 /* IS_CONSTANT macros returns true for compile-time constant expressions. */
 #if BROTLI_MODERN_COMPILER || __has_builtin(__builtin_constant_p)
-#define IS_CONSTANT(x) __builtin_constant_p(x)
+#define IS_CONSTANT(x) (!!__builtin_constant_p(x))
 #else
-#define IS_CONSTANT(x) 0
+#define IS_CONSTANT(x) (!!0)
 #endif
 
 #if BROTLI_MODERN_COMPILER || __has_attribute(always_inline)
@@ -130,6 +134,16 @@
 #define ATTRIBUTE_ALWAYS_INLINE
 #endif
 
+#if BROTLI_MODERN_COMPILER || __has_attribute(visibility)
+#define ATTRIBUTE_VISIBILITY_HIDDEN __attribute__ ((visibility ("hidden")))
+#else
+#define ATTRIBUTE_VISIBILITY_HIDDEN
+#endif
+
+#ifndef BROTLI_INTERNAL
+#define BROTLI_INTERNAL ATTRIBUTE_VISIBILITY_HIDDEN
+#endif
+
 #ifndef _MSC_VER
 #if defined(__cplusplus) || !defined(__STRICT_ANSI__) || \
     __STDC_VERSION__ >= 199901L
@@ -141,10 +155,22 @@
 #define BROTLI_INLINE __forceinline
 #endif  /* _MSC_VER */
 
-#ifdef BROTLI_DECODE_DEBUG
+#ifdef BROTLI_ENABLE_LOG
 #define BROTLI_DCHECK(x) assert(x)
+#define BROTLI_LOG(x) printf x
 #else
 #define BROTLI_DCHECK(x)
+#define BROTLI_LOG(x)
+#endif
+
+#if defined(BROTLI_DEBUG) || defined(BROTLI_ENABLE_LOG)
+static inline void BrotliDump(const char* f, int l, const char* fn) {
+  fprintf(stderr, "%s:%d (%s)\n", f, l, fn);
+  fflush(stderr);
+}
+#define BROTLI_DUMP() BrotliDump(__FILE__, __LINE__, __FUNCTION__)
+#else
+#define BROTLI_DUMP() (void)(0)
 #endif
 
 #if defined(BROTLI_BUILD_64_BIT)
@@ -207,9 +233,9 @@
 #endif  /* gcc || clang */
 
 #if defined(BROTLI_TARGET_ARM)
-#define BROTLI_HAS_UBFX 1
+#define BROTLI_HAS_UBFX (!!1)
 #else
-#define BROTLI_HAS_UBFX 0
+#define BROTLI_HAS_UBFX (!!0)
 #endif
 
 #define BROTLI_ALLOC(S, L) S->alloc_func(S->memory_manager_opaque, L)

diff --git a/third_party/brotli/dec/state.c b/third_party/brotli/dec/state.c
index 52c0e6c..183cc9d 100644
--- a/third_party/brotli/dec/state.c
+++ b/third_party/brotli/dec/state.c

@@ -15,6 +15,10 @@
 extern "C" {
 #endif
 
+/* Declared in decode.h */
+int BrotliStateIsStreamStart(const BrotliState* s);
+int BrotliStateIsStreamEnd(const BrotliState* s);
+
 static void* DefaultAllocFunc(void* opaque, size_t size) {
   BROTLI_UNUSED(opaque);
   return malloc(size);
@@ -76,7 +80,6 @@
   s->distance_hgroup.codes = NULL;
   s->distance_hgroup.htrees = NULL;
 
-
   s->custom_dict = NULL;
   s->custom_dict_size = 0;
 

diff --git a/third_party/brotli/dec/state.h b/third_party/brotli/dec/state.h
index 925fa149..3360372 100644
--- a/third_party/brotli/dec/state.h
+++ b/third_party/brotli/dec/state.h

@@ -12,6 +12,7 @@
 #include "./bit_reader.h"
 #include "./huffman.h"
 #include "./types.h"
+#include "./port.h"
 
 #if defined(__cplusplus) || defined(c_plusplus)
 extern "C" {
@@ -156,7 +157,6 @@
   uint32_t repeat_code_len;
   uint32_t prev_code_len;
 
-
   int copy_length;
   int distance_code;
 
@@ -220,27 +220,19 @@
   uint8_t* context_modes;
 };
 
-typedef struct BrotliStateStruct BrotliState;
+typedef struct BrotliStateStruct BrotliStateInternal;
+#define BrotliState BrotliStateInternal
 
-void BrotliStateInit(BrotliState* s);
-void BrotliStateInitWithCustomAllocators(BrotliState* s,
-                                         brotli_alloc_func alloc_func,
-                                         brotli_free_func free_func,
-                                         void* opaque);
-void BrotliStateCleanup(BrotliState* s);
-void BrotliStateMetablockBegin(BrotliState* s);
-void BrotliStateCleanupAfterMetablock(BrotliState* s);
-void BrotliHuffmanTreeGroupInit(BrotliState* s, HuffmanTreeGroup* group,
-                                uint32_t alphabet_size, uint32_t ntrees);
-void BrotliHuffmanTreeGroupRelease(BrotliState* s, HuffmanTreeGroup* group);
-
-/* Returns 1, if s is in a state where we have not read any input bytes yet,
-   and 0 otherwise */
-int BrotliStateIsStreamStart(const BrotliState* s);
-
-/* Returns 1, if s is in a state where we reached the end of the input and
-   produced all of the output, and 0 otherwise. */
-int BrotliStateIsStreamEnd(const BrotliState* s);
+BROTLI_INTERNAL void BrotliStateInit(BrotliState* s);
+BROTLI_INTERNAL void BrotliStateInitWithCustomAllocators(BrotliState* s,
+    brotli_alloc_func alloc_func, brotli_free_func free_func, void* opaque);
+BROTLI_INTERNAL void BrotliStateCleanup(BrotliState* s);
+BROTLI_INTERNAL void BrotliStateMetablockBegin(BrotliState* s);
+BROTLI_INTERNAL void BrotliStateCleanupAfterMetablock(BrotliState* s);
+BROTLI_INTERNAL void BrotliHuffmanTreeGroupInit(BrotliState* s,
+    HuffmanTreeGroup* group, uint32_t alphabet_size, uint32_t ntrees);
+BROTLI_INTERNAL void BrotliHuffmanTreeGroupRelease(BrotliState* s,
+    HuffmanTreeGroup* group);
 
 #if defined(__cplusplus) || defined(c_plusplus)
 }  /* extern "C" */

diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
index 4b2d8c3b..3058b50 100755
--- a/tools/clang/scripts/update.py
+++ b/tools/clang/scripts/update.py

@@ -799,6 +799,9 @@
                       'picks /opt/foo/bin/gcc')
   parser.add_argument('--lto-gold-plugin', action='store_true',
                       help='build LLVM Gold plugin with LTO')
+  parser.add_argument('--llvm-force-head-revision', action='store_true',
+                      help=('use the revision in the repo when printing '
+                            'the revision'))
   parser.add_argument('--print-revision', action='store_true',
                       help='print current clang revision and exit.')
   parser.add_argument('--print-clang-version', action='store_true',
@@ -842,7 +845,7 @@
 
   global CLANG_REVISION, PACKAGE_VERSION
   if args.print_revision:
-    if use_head_revision:
+    if use_head_revision or args.llvm_force_head_revision:
       print GetSvnRevision(LLVM_DIR)
     else:
       print PACKAGE_VERSION

diff --git a/tools/gn/args.cc b/tools/gn/args.cc
index 1034ea1..496ba18 100644
--- a/tools/gn/args.cc
+++ b/tools/gn/args.cc

@@ -194,25 +194,12 @@
   if (all_overrides.empty())
     return true;
 
-  // Get a list of all possible overrides for help with error finding.
-  //
-  // It might be nice to do edit distance checks to see if we can find one close
-  // to what you typed.
-  std::string all_declared_str;
-  for (const auto& map_pair : declared_arguments_per_toolchain_) {
-    for (const auto& cur_str : map_pair.second) {
-      if (!all_declared_str.empty())
-        all_declared_str += ", ";
-      all_declared_str += cur_str.first.as_string();
-    }
-  }
-
   *err = Err(
       all_overrides.begin()->second.origin(), "Build argument has no effect.",
       "The variable \"" + all_overrides.begin()->first.as_string() +
           "\" was set as a build argument\nbut never appeared in a " +
-          "declare_args() block in any buildfile.\n\nPossible arguments: " +
-          all_declared_str);
+          "declare_args() block in any buildfile.\n\n"
+          "To view possible args, run \"gn args --list <builddir>\"");
   return false;
 }
 

diff --git a/tools/gn/docs/reference.md b/tools/gn/docs/reference.md
index 600daea9..7b345d7 100644
--- a/tools/gn/docs/reference.md
+++ b/tools/gn/docs/reference.md

@@ -70,7 +70,29 @@
 
 
 ```
-## **\--markdown**: write the output in the Markdown format.
+## **\--fail-on-unused-args**: Treat unused build args as fatal errors.
+
+```
+  If you set a value in a build's "gn args" and never use it in the
+  build (in a declare_args() block), GN will normally print an error
+  but not fail the build.
+
+  In many cases engineers would use build args to enable or disable
+  features that would sometimes get removed. It would by annoying to
+  block work for typically benign problems. In Chrome in particular,
+  flags might be configured for build bots in a separate infrastructure
+  repository, or a declare_args block might be changed in a third party
+  repository. Treating these errors as blocking forced complex multi-
+  way patches to land what would otherwise be simple changes.
+
+  In some cases, such concerns are not as important, and a mismatch
+  in build flags between the invoker of the build and the build files
+  represents a critical mismatch that should be immediately fixed. Such
+  users can set this flag to force GN to fail in that case.
+
+
+```
+## **\--markdown**: Write help output in the Markdown format.
 
 ## **\--[no]color**: Forces colored output on or off.
 
@@ -5925,7 +5947,8 @@
 **  \--args**: Specifies build arguments overrides.
 **  \--color**: Force colored output.
 **  \--dotfile**: Override the name of the ".gn" file.
-**  \--markdown**: write the output in the Markdown format.
+**  \--fail-on-unused-args**: Treat unused build args as fatal errors.
+**  \--markdown**: Write help output in the Markdown format.
 **  \--nocolor**: Force non-colored output.
 **  -q**: Quiet mode. Don't print output on success.
 **  \--root**: Explicitly specify source root.

diff --git a/tools/gn/setup.cc b/tools/gn/setup.cc
index 384a2af1..7f8e286 100644
--- a/tools/gn/setup.cc
+++ b/tools/gn/setup.cc

@@ -332,9 +332,13 @@
     }
 
     if (!build_settings_.build_args().VerifyAllOverridesUsed(&err)) {
-      // TODO(brettw) implement a system of warnings. Until we have a better
-      // system, print the error but don't return failure.
+      // TODO(brettw) implement a system to have a different marker for
+      // warnings. Until we have a better system, print the error but don't
+      // return failure unless requested on the command line.
       err.PrintToStdout();
+      if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kFailOnUnusedArgs))
+        return false;
       return true;
     }
   }

diff --git a/tools/gn/switches.cc b/tools/gn/switches.cc
index df167b3..45b25e6 100644
--- a/tools/gn/switches.cc
+++ b/tools/gn/switches.cc

@@ -69,11 +69,34 @@
     "  Note that this interacts with \"--root\" in a possibly incorrect way.\n"
     "  It would be nice to test the edge cases and document or fix.\n";
 
+const char kFailOnUnusedArgs[] = "fail-on-unused-args";
+const char kFailOnUnusedArgs_HelpShort[] =
+    "--fail-on-unused-args: Treat unused build args as fatal errors.";
+const char kFailOnUnusedArgs_Help[] =
+    "--fail-on-unused-args: Treat unused build args as fatal errors.\n"
+    "\n"
+    "  If you set a value in a build's \"gn args\" and never use it in the\n"
+    "  build (in a declare_args() block), GN will normally print an error\n"
+    "  but not fail the build.\n"
+    "\n"
+    "  In many cases engineers would use build args to enable or disable\n"
+    "  features that would sometimes get removed. It would by annoying to\n"
+    "  block work for typically benign problems. In Chrome in particular,\n"
+    "  flags might be configured for build bots in a separate infrastructure\n"
+    "  repository, or a declare_args block might be changed in a third party\n"
+    "  repository. Treating these errors as blocking forced complex multi-\n"
+    "  way patches to land what would otherwise be simple changes.\n"
+    "\n"
+    "  In some cases, such concerns are not as important, and a mismatch\n"
+    "  in build flags between the invoker of the build and the build files\n"
+    "  represents a critical mismatch that should be immediately fixed. Such\n"
+    "  users can set this flag to force GN to fail in that case.\n";
+
 const char kMarkdown[] = "markdown";
 const char kMarkdown_HelpShort[] =
-    "--markdown: write the output in the Markdown format.";
+    "--markdown: Write help output in the Markdown format.";
 const char kMarkdown_Help[] =
-    "--markdown: write the output in the Markdown format.\n";
+    "--markdown: Write help output in the Markdown format.\n";
 
 const char kNoColor[] = "nocolor";
 const char kNoColor_HelpShort[] =
@@ -223,6 +246,7 @@
     INSERT_VARIABLE(Args)
     INSERT_VARIABLE(Color)
     INSERT_VARIABLE(Dotfile)
+    INSERT_VARIABLE(FailOnUnusedArgs)
     INSERT_VARIABLE(Markdown)
     INSERT_VARIABLE(NoColor)
     INSERT_VARIABLE(Root)

diff --git a/tools/gn/switches.h b/tools/gn/switches.h
index 3dc5b9f..cebb19c9 100644
--- a/tools/gn/switches.h
+++ b/tools/gn/switches.h

@@ -40,6 +40,10 @@
 extern const char kDotfile_HelpShort[];
 extern const char kDotfile_Help[];
 
+extern const char kFailOnUnusedArgs[];
+extern const char kFailOnUnusedArgs_HelpShort[];
+extern const char kFailOnUnusedArgs_Help[];
+
 extern const char kMarkdown[];
 extern const char kMarkdown_HelpShort[];
 extern const char kMarkdown_Help[];

diff --git a/tools/mb/mb.py b/tools/mb/mb.py
index b2d0851d..029cab7 100755
--- a/tools/mb/mb.py
+++ b/tools/mb/mb.py

@@ -1079,6 +1079,21 @@
     # Ensure that we have an environment that only contains
     # the exact values of the GYP variables we need.
     env = os.environ.copy()
+
+    # This is a terrible hack to work around the fact that
+    # //tools/clang/scripts/update.py is invoked by GYP and GN but
+    # currently relies on an environment variable to figure out
+    # what revision to embed in the command line #defines.
+    # For GN, we've made this work via a gn arg that will cause update.py
+    # to get an additional command line arg, but getting that to work
+    # via GYP_DEFINES has proven difficult, so we rewrite the GYP_DEFINES
+    # to get rid of the arg and add the old var in, instead.
+    # See crbug.com/582737 for more on this. This can hopefully all
+    # go away with GYP.
+    if 'llvm_force_head_revision=1' in gyp_defines:
+      env['LLVM_FORCE_HEAD_REVISION'] = 1
+      gyp_defines = gyp_defines.replace('llvm_force_head_revision=1', '')
+
     env['GYP_GENERATORS'] = 'ninja'
     if 'GYP_CHROMIUM_NO_ACTION' in env:
       del env['GYP_CHROMIUM_NO_ACTION']

diff --git a/tools/mb/mb_config.pyl b/tools/mb/mb_config.pyl
index 80788a07..9968a2d 100644
--- a/tools/mb/mb_config.pyl
+++ b/tools/mb/mb_config.pyl

@@ -83,12 +83,6 @@
 
     'chromium.fyi': {
       'ChromiumOS Linux Tests': 'tbd',
-      'ClangToTAndroidASan':
-        'android_clang_no_chrome_plugins_asan_gn_debug_bot_minimal_symbols',
-      'ClangToTLinux': 'tbd',
-      'ClangToTLinux (dbg)': 'tbd',
-      'ClangToTLinuxASan': 'tbd',
-      'ClangToTLinuxUBSanVptr': 'tbd',
       'ClangToTMac': 'tbd',
       'ClangToTMac (dbg)': 'tbd',
       'ClangToTMacASan': 'tbd',
@@ -145,9 +139,17 @@
         'swarming_gyp_clang_official_release_bot_minimal_symbols_x64',
       'CrWinGoma': 'gyp_release_bot_minimal_symbols_x86',
       'CrWinGoma(dll)': 'gyp_shared_release_bot_minimal_symbols_x86',
+      'ClangToTAndroidASan':
+        'android_clang_tot_asan_gn_debug_bot_minimal_symbols',
       'ClangToTAndroidASan tester': 'none',
+      'ClangToTLinux':
+        'swarming_gyp_clang_tot_linux_dump_symbols_shared_release',
       'ClangToTLinux tester': 'none',
+      'ClangToTLinux (dbg)': 'swarming_gyp_clang_tot_shared_debug',
+      'ClangToTLinuxASan': 'swarming_gyp_clang_tot_asan_lsan_static_release',
       'ClangToTLinuxASan tester': 'none',
+      'ClangToTLinuxUBSanVptr':
+        'swarming_gyp_clang_tot_edge_ubsan_no_recover_hack_static_release',
       'ClangToTLinuxUBSanVptr tester': 'none',
       'ClangToTMac tester': 'none',
       'ClangToTMacASan tester': 'none',
@@ -893,9 +895,8 @@
       'android', 'blink_logging', 'gyp', 'debug_static_bot', 'arm64',
     ],
 
-    'android_clang_no_chrome_plugins_asan_gn_debug_bot_minimal_symbols': [
-      'android', 'clang_no_chrome_plugins', 'asan', 'gn',
-      'debug_bot_minimal_symbols',
+    'android_clang_tot_asan_gn_debug_bot_minimal_symbols': [
+      'android', 'clang_tot', 'asan', 'gn', 'debug_bot_minimal_symbols',
     ],
 
     'android_clang_asan_findbugs_gyp_debug_bot_minimal_symbols': [
@@ -1494,6 +1495,26 @@
       'chromeos_with_codecs', 'goma', 'gyp', 'ozone', 'static', 'swarming',
     ],
 
+    'swarming_gyp_clang_tot_edge_ubsan_no_recover_hack_static_release': [
+      'swarming', 'gyp', 'clang_tot', 'edge', 'ubsan_no_recover_hack',
+      'static', 'release',
+    ],
+
+    'swarming_gyp_clang_tot_asan_lsan_static_release': [
+      'swarming', 'gyp', 'clang_tot', 'asan', 'lsan', 'static', 'release',
+    ],
+
+    'swarming_gyp_clang_tot_shared_debug': [
+      'swarming', 'gyp', 'clang_tot', 'shared', 'debug',
+    ],
+
+    'swarming_gyp_clang_tot_linux_dump_symbols_shared_release': [
+      # Enable debug info, as on official builders, to catch issues with
+      # optimized debug info.
+      'swarming', 'gyp', 'clang_tot', 'linux_dump_symbols',
+      'shared', 'release',
+    ],
+
     'swarming_gyp_debug_trybot': [
       'swarming', 'gyp', 'debug_trybot',
     ],
@@ -1891,9 +1912,9 @@
       'mixins': ['chromeos', 'chromeos_codecs'],
     },
 
-    'clang_no_chrome_plugins': {
-      'gn_args': 'clang_use_chrome_plugins=false',
-      'gyp_defines': 'clang_use_chrome_plugins=0',
+    'clang_tot': {
+      'gn_args': 'llvm_force_head_revision=true clang_use_chrome_plugins=false',
+      'gyp_defines': 'llvm_force_head_revision=1 clang_use_chrome_plugins=0',
       'mixins': ['clang'],
     },
 
@@ -2044,6 +2065,11 @@
       'gyp_defines': 'debug_extra_cflags="-gline-tables-only"',
     },
 
+    'linux_dump_symbols': {
+      'gn_args': 'error', # TODO(crbug.com/605819): implement this.
+      'gyp_defines': 'linux_dump_symbols=1',
+    },
+
     'ubsan_security': { 'gn_args': 'is_ubsan_security=true' },
 
     'lsan': {
@@ -2183,6 +2209,14 @@
       'gyp_defines': 'ubsan=1',
     },
 
+    'ubsan_no_recover_hack': {
+      # TODO(krasin): Remove when https://llvm.org/bugs/show_bug.cgi?id=25569
+      # is fixed and just use ubsan_vptr instead.
+      'mixins': ['ubsan_vptr'],
+      'gn_args': 'error', # TODO(GYP): need a GN equivalent for this
+      'gyp_defines': 'release_extra_cflags=-fno-sanitize-recover=undefined',
+    },
+
     'ubsan_vptr': {
       'gn_args': 'is_ubsan_vptr=true',
       'gyp_defines': 'ubsan_vptr=1',

diff --git a/ui/views/mus/BUILD.gn b/ui/views/mus/BUILD.gn
index 7fc833c..bb087d4 100644
--- a/ui/views/mus/BUILD.gn
+++ b/ui/views/mus/BUILD.gn

@@ -5,7 +5,6 @@
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//mojo/public/mojo_application.gni")
-import("//mojo/public/mojo_application_manifest.gni")
 import("//testing/test.gni")
 import("//tools/grit/repack.gni")
 
@@ -196,7 +195,6 @@
   ]
 
   data_deps = [
-    ":unittests_manifest",
     "//mash/wm",
   ]
 
@@ -232,12 +230,6 @@
   }
 }
 
-mojo_application_manifest("unittests_manifest") {
-  type = "exe"
-  application_name = "views_mus_unittests"
-  source = "unittests_manifest.json"
-}
-
 group("for_component") {
   public_deps = [
     ":mus",

diff --git a/ui/views/mus/platform_test_helper_mus.cc b/ui/views/mus/platform_test_helper_mus.cc
index 71f9ff5..023c530 100644
--- a/ui/views/mus/platform_test_helper_mus.cc
+++ b/ui/views/mus/platform_test_helper_mus.cc

@@ -20,7 +20,7 @@
 namespace views {
 namespace {
 
-const char kTestName[] = "exe:views_mus_unittests";
+const char kTestName[] = "mojo:test-app";
 
 class DefaultShellClient : public shell::ShellClient {
  public:
@@ -31,11 +31,20 @@
   DISALLOW_COPY_AND_ASSIGN(DefaultShellClient);
 };
 
+std::unique_ptr<shell::TestCatalogStore> BuildTestCatalogStore() {
+  std::unique_ptr<base::ListValue> apps(new base::ListValue);
+  apps->Append(shell::BuildPermissiveSerializedAppInfo(kTestName, "test"));
+  return base::WrapUnique(new shell::TestCatalogStore(std::move(apps)));
+}
+
 class PlatformTestHelperMus : public PlatformTestHelper {
  public:
   PlatformTestHelperMus() {
     background_shell_.reset(new BackgroundShell);
-    background_shell_->Init(nullptr);
+    std::unique_ptr<BackgroundShell::InitParams> init_params(
+        new BackgroundShell::InitParams);
+    init_params->catalog_store = BuildTestCatalogStore();
+    background_shell_->Init(std::move(init_params));
     shell_client_.reset(new DefaultShellClient);
     shell_connection_.reset(new shell::ShellConnection(
         shell_client_.get(),

diff --git a/ui/views/mus/screen_mus_unittest.cc b/ui/views/mus/screen_mus_unittest.cc
index 621d50f..fe80a72b 100644
--- a/ui/views/mus/screen_mus_unittest.cc
+++ b/ui/views/mus/screen_mus_unittest.cc

@@ -14,7 +14,7 @@
 namespace views {
 namespace {
 
-TEST(ScreenMusTest, DISABLED_ConsistentDisplayInHighDPI) {
+TEST(ScreenMusTest, ConsistentDisplayInHighDPI) {
   base::MessageLoop message_loop(base::MessageLoop::TYPE_UI);
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
       switches::kForceDeviceScaleFactor, "2");

diff --git a/ui/views/mus/unittests_manifest.json b/ui/views/mus/unittests_manifest.json
deleted file mode 100644
index c467eeb..0000000
--- a/ui/views/mus/unittests_manifest.json
+++ /dev/null

@@ -1,13 +0,0 @@
-{
-  "manifest_version":  1,
-  "name": "mojo:views_mus_unittests",
-  "display_name": "Views Mus Unittests",
-  "capabilities": {
-    "required": {
-      "mojo:desktop_wm": { "interfaces": [ "*" ] },
-      "mojo:mus": {
-        "classes": [ "mus:core" ]
-      }
-    }
-  }
-}