diff --git a/DEPS b/DEPS
index 8658fc0..363d30d8 100644
--- a/DEPS
+++ b/DEPS
@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'b7babbd9977c15a991c601eec24fb33e67177bd0',
+  'v8_revision': 'c637865d5cb133882ef8c9b7eec4a6dca22dc4d5',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/android_webview/browser/aw_permission_manager.cc b/android_webview/browser/aw_permission_manager.cc
index 6a4c4f5..e6eafa0 100644
--- a/android_webview/browser/aw_permission_manager.cc
+++ b/android_webview/browser/aw_permission_manager.cc
@@ -504,12 +504,6 @@
   return PermissionStatus::DENIED;
 }
 
-void AwPermissionManager::RegisterPermissionUsage(
-    PermissionType permission,
-    const GURL& requesting_origin,
-    const GURL& embedding_origin) {
-}
-
 int AwPermissionManager::SubscribePermissionStatusChange(
     PermissionType permission,
     const GURL& requesting_origin,
diff --git a/android_webview/browser/aw_permission_manager.h b/android_webview/browser/aw_permission_manager.h
index e6a3580..f138d7f 100644
--- a/android_webview/browser/aw_permission_manager.h
+++ b/android_webview/browser/aw_permission_manager.h
@@ -47,9 +47,6 @@
       content::PermissionType permission,
       const GURL& requesting_origin,
       const GURL& embedding_origin) override;
-  void RegisterPermissionUsage(content::PermissionType permission,
-                               const GURL& requesting_origin,
-                               const GURL& embedding_origin) override;
   int SubscribePermissionStatusChange(
       content::PermissionType permission,
       const GURL& requesting_origin,
diff --git a/ash/common/wm/default_state.cc b/ash/common/wm/default_state.cc
index 862355d..8149d7f 100644
--- a/ash/common/wm/default_state.cc
+++ b/ash/common/wm/default_state.cc
@@ -280,6 +280,11 @@
     return;
   }
 
+  if (event->type() == WM_EVENT_SNAP_LEFT ||
+      event->type() == WM_EVENT_SNAP_RIGHT) {
+    window_state->set_bounds_changed_by_user(true);
+  }
+
   EnterToNextState(window_state, next_state_type);
 }
 
diff --git a/ash/wm/workspace_controller_unittest.cc b/ash/wm/workspace_controller_unittest.cc
index 9137bd7..db4d586 100644
--- a/ash/wm/workspace_controller_unittest.cc
+++ b/ash/wm/workspace_controller_unittest.cc
@@ -14,6 +14,7 @@
 #include "ash/common/test/test_shelf_delegate.h"
 #include "ash/common/wm/panels/panel_layout_manager.h"
 #include "ash/common/wm/window_state.h"
+#include "ash/common/wm/wm_event.h"
 #include "ash/common/wm/workspace/workspace_window_resizer.h"
 #include "ash/common/wm_shell.h"
 #include "ash/common/wm_window.h"
@@ -1310,6 +1311,38 @@
   EXPECT_EQ(GetWindowNames(parent), GetLayerNames(parent));
 }
 
+// Test that minimizing and restoring a snapped window should restore to the
+// snapped bounds. When a window is created and snapped, it must be a
+// user-initiated operation, no need to do rearrangement for restoring this
+// window (crbug.com/692175).
+TEST_F(WorkspaceControllerTest, RestoreMinimizedSnappedWindow) {
+  // Create an auto-positioned window.
+  std::unique_ptr<aura::Window> window(CreateTestWindowInShellWithId(0));
+  wm::WindowState* window_state = wm::GetWindowState(window.get());
+  window_state->set_window_position_managed(true);
+  window->SetBounds(gfx::Rect(10, 20, 100, 200));
+  window->Show();
+
+  // Left snap |window|.
+  EXPECT_FALSE(window_state->bounds_changed_by_user());
+  const wm::WMEvent snap_left(wm::WM_EVENT_SNAP_LEFT);
+  window_state->OnWMEvent(&snap_left);
+  const gfx::Rect work_area =
+      display::Screen::GetScreen()
+          ->GetDisplayNearestPoint(window->bounds().origin())
+          .work_area();
+  gfx::Rect snapped_bounds(work_area.x(), work_area.y(), work_area.width() / 2,
+                           work_area.height());
+  EXPECT_EQ(snapped_bounds, window->bounds());
+  EXPECT_TRUE(window_state->bounds_changed_by_user());
+
+  // Minimize and Restore |window|, the restored bounds should be equal to the
+  // bounds of left snapped state.
+  window_state->Minimize();
+  window_state->Restore();
+  EXPECT_EQ(snapped_bounds, window->bounds());
+}
+
 namespace {
 
 // Used by DragMaximizedNonTrackedWindow to track how many times the window
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java b/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java
index 8faf1380..9cf3a82 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java
@@ -10,18 +10,10 @@
 import android.net.Uri;
 import android.view.ViewGroup;
 
-import org.chromium.base.ThreadUtils;
-import org.chromium.base.test.util.CallbackHelper;
-import org.chromium.base.test.util.UrlUtils;
 import org.chromium.chrome.browser.ShortcutHelper;
 import org.chromium.chrome.test.ChromeActivityTestCaseBase;
 import org.chromium.content.browser.test.util.Criteria;
 import org.chromium.content.browser.test.util.CriteriaHelper;
-import org.chromium.content.browser.test.util.TestWebContentsObserver;
-import org.chromium.content_public.browser.LoadUrlParams;
-import org.chromium.ui.base.PageTransition;
-
-import java.util.concurrent.TimeoutException;
 
 /**
  * The base class of the WebappActivity tests. It provides the common methods to access the activity
@@ -67,8 +59,6 @@
             + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
             + "AAAAAAAAAOA3AvAAAdln8YgAAAAASUVORK5CYII=";
 
-    TestWebContentsObserver mTestObserver;
-
     public WebappActivityTestBase() {
         super(WebappActivity0.class);
     }
@@ -114,17 +104,6 @@
     protected final void startWebappActivity(Intent intent) throws Exception {
         setActivityIntent(intent);
         waitUntilIdle();
-
-        // TODO(yfriedman): Change callers to be executed on the UI thread. Unfortunately this is
-        // super convenient as the caller is nearly always on the test thread which is fine to
-        // block and it's cumbersome to keep bouncing to the UI thread.
-        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
-            @Override
-            public void run() {
-                mTestObserver = new TestWebContentsObserver(
-                        getActivity().getActivityTab().getWebContents());
-            }
-        });
     }
 
     /**
@@ -143,42 +122,6 @@
         getInstrumentation().waitForIdleSync();
     }
 
-    /**
-     * Loads the URL in the WebappActivity and waits until it has been fully loaded.
-     * @param url URL to load.
-     */
-    @Override
-    public int loadUrl(final String url) throws IllegalArgumentException, InterruptedException {
-        waitUntilIdle();
-
-        final CallbackHelper startLoadingHelper = mTestObserver.getOnPageStartedHelper();
-        final CallbackHelper finishLoadingHelper = mTestObserver.getOnPageFinishedHelper();
-
-        int startLoadingCount = startLoadingHelper.getCallCount();
-        int finishLoadingCount = finishLoadingHelper.getCallCount();
-
-        getInstrumentation().runOnMainSync(new Runnable() {
-            @Override
-            public void run() {
-                int pageTransition = PageTransition.TYPED | PageTransition.FROM_ADDRESS_BAR;
-                getActivity().getActivityTab().loadUrl(new LoadUrlParams(url, pageTransition));
-            }
-        });
-
-        try {
-            startLoadingHelper.waitForCallback(startLoadingCount);
-        } catch (TimeoutException e) {
-            fail();
-        }
-
-        try {
-            finishLoadingHelper.waitForCallback(finishLoadingCount);
-        } catch (TimeoutException e) {
-            fail();
-        }
-        return 0;
-    }
-
     @Override
     public final void startMainActivity() throws InterruptedException {
         // Do nothing; the WebappActivity may not have been completely set up, yet.
diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index a5ca732..03fd0ba4 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
@@ -2247,6 +2247,9 @@
     <message name="IDS_SETTINGS_PEOPLE_PASSWORD_PROMPT_TITLE" desc="Title of the password prompt dialog popup.">
       Confirm your password
     </message>
+    <message name="IDS_SETTINGS_ADD_FINGERPRINT_DIALOG_ADD_ANOTHER_BUTTON" desc="Text on the button in the fingerprint setup dialog which allows users to add another fingerprint once a fingerprint has been setup.">
+      Add another
+    </message>
     <message name="IDS_SETTINGS_PEOPLE_PASSWORD_PROMPT_ENTER_PASSWORD" desc="Text above a password input field that tells the user they need to submit their password to configure these settings.">
       Enter your password to configure screen lock.
     </message>
diff --git a/chrome/browser/banners/app_banner_manager.cc b/chrome/browser/banners/app_banner_manager.cc
index 98e09647..00baa31 100644
--- a/chrome/browser/banners/app_banner_manager.cc
+++ b/chrome/browser/banners/app_banner_manager.cc
@@ -92,6 +92,8 @@
 
   is_active_ = true;
   is_debug_mode_ = is_debug_mode;
+  was_canceled_by_page_ = false;
+  page_requested_prompt_ = false;
 
   // We only need to call ReportStatus if we aren't in debug mode (this avoids
   // skew from testing).
@@ -332,8 +334,6 @@
   event_.reset();
 
   is_active_ = false;
-  was_canceled_by_page_ = false;
-  page_requested_prompt_ = false;
   need_to_log_status_ = false;
 }
 
diff --git a/chrome/browser/banners/app_banner_manager_browsertest.cc b/chrome/browser/banners/app_banner_manager_browsertest.cc
index ee8fd31..dda2b5d 100644
--- a/chrome/browser/banners/app_banner_manager_browsertest.cc
+++ b/chrome/browser/banners/app_banner_manager_browsertest.cc
@@ -5,6 +5,8 @@
 #include <vector>
 
 #include "base/command_line.h"
+#include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "base/test/histogram_tester.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -35,12 +37,13 @@
 
   bool will_show() { return will_show_.get() && *will_show_; }
 
+  void clear_will_show() { will_show_.reset(); }
+
   bool is_active() { return AppBannerManager::is_active(); }
 
   bool need_to_log_status() { return need_to_log_status_; }
 
   void Prepare(base::Closure quit_closure) {
-    will_show_.reset(nullptr);
     quit_closure_ = quit_closure;
   }
 
@@ -71,6 +74,8 @@
 
   base::Closure quit_closure_;
   std::unique_ptr<bool> will_show_;
+
+  DISALLOW_COPY_AND_ASSIGN(AppBannerManagerTest);
 };
 
 class AppBannerManagerBrowserTest : public InProcessBrowserTest {
@@ -88,25 +93,38 @@
   }
 
  protected:
+  // Returns a test server URL to page |page_url| with |manifest_url| injected
+  // as the manifest tag.
+  std::string GetURLOfPageWithManifest(const std::string& page_url,
+                                       const std::string& manifest_url) {
+    return page_url + embedded_test_server()->GetURL(manifest_url).spec();
+  }
+
   // Returns a test server URL to a page controlled by a service worker with
   // |manifest_url| injected as the manifest tag.
   std::string GetURLOfPageWithServiceWorkerAndManifest(
       const std::string& manifest_url) {
-    return "/banners/manifest_test_page.html?manifest=" +
-           embedded_test_server()->GetURL(manifest_url).spec();
+    return GetURLOfPageWithManifest(
+        "/banners/manifest_test_page.html?manifest=", manifest_url);
+  }
+
+  std::unique_ptr<AppBannerManagerTest> CreateAppBannerManager(
+      Browser* browser) {
+    content::WebContents* web_contents =
+        browser->tab_strip_model()->GetActiveWebContents();
+    return base::MakeUnique<AppBannerManagerTest>(web_contents);
   }
 
   void RunBannerTest(Browser* browser,
+                     AppBannerManagerTest* manager,
                      const std::string& url,
                      const std::vector<double>& engagement_scores,
                      InstallableStatusCode expected_code_for_histogram,
                      bool expected_to_show) {
     base::HistogramTester histograms;
     GURL test_url = embedded_test_server()->GetURL(url);
-    content::WebContents* web_contents =
-        browser->tab_strip_model()->GetActiveWebContents();
-    std::unique_ptr<AppBannerManagerTest> manager(
-        new AppBannerManagerTest(web_contents));
+
+    manager->clear_will_show();
 
     // Loop through the vector of engagement scores. We only expect the banner
     // pipeline to trigger on the last one; otherwise, nothing is expected to
@@ -133,6 +151,7 @@
     // navigation should generate the final engagement to show the banner. Spin
     // the run loop, which should be quit by either Stop() or ShowBanner().
     base::RunLoop run_loop;
+    manager->clear_will_show();
     manager->Prepare(run_loop.QuitClosure());
     ui_test_utils::NavigateToURL(browser, test_url);
     run_loop.Run();
@@ -159,109 +178,155 @@
 };
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, WebAppBannerCreated) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{0, 10};
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest,
                        WebAppBannerCreatedImmediately) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{10};
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest,
                        WebAppBannerCreatedAfterSeveralVisits) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{0, 1, 2, 3, 4, 5, 10};
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest,
                        WebAppBannerNotSeenAfterShowing) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{0, 10};
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 
   AppBannerManager::SetTimeDeltaForTesting(1);
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, PREVIOUSLY_IGNORED, false);
 
   AppBannerManager::SetTimeDeltaForTesting(13);
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, PREVIOUSLY_IGNORED, false);
 
   AppBannerManager::SetTimeDeltaForTesting(14);
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 
   AppBannerSettingsHelper::SetDaysAfterDismissAndIgnoreToTrigger(90, 2);
 
   AppBannerManager::SetTimeDeltaForTesting(16);
-  RunBannerTest(browser(), "/banners/manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/manifest_test_page.html",
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest,
                        WebAppBannerNoTypeInManifest) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{0, 10};
-  RunBannerTest(browser(), GetURLOfPageWithServiceWorkerAndManifest(
-                               "/banners/manifest_no_type.json"),
+  RunBannerTest(browser(), manager.get(),
+                GetURLOfPageWithServiceWorkerAndManifest(
+                    "/banners/manifest_no_type.json"),
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest,
                        WebAppBannerNoTypeInManifestCapsExtension) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{0, 10};
-  RunBannerTest(browser(), GetURLOfPageWithServiceWorkerAndManifest(
-                               "/banners/manifest_no_type_caps.json"),
+  RunBannerTest(browser(), manager.get(),
+                GetURLOfPageWithServiceWorkerAndManifest(
+                    "/banners/manifest_no_type_caps.json"),
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, NoManifest) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{10};
-  RunBannerTest(browser(), "/banners/no_manifest_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/no_manifest_test_page.html",
                 engagement_scores, NO_MANIFEST, false);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, MissingManifest) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{10};
-  RunBannerTest(browser(), GetURLOfPageWithServiceWorkerAndManifest(
-                               "/banners/manifest_missing.json"),
+  RunBannerTest(browser(), manager.get(),
+                GetURLOfPageWithServiceWorkerAndManifest(
+                    "/banners/manifest_missing.json"),
                 engagement_scores, MANIFEST_EMPTY, false);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, CancelBannerDirect) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{10};
-  RunBannerTest(browser(), "/banners/cancel_test_page.html", engagement_scores,
-                RENDERER_CANCELLED, false);
+  RunBannerTest(browser(), manager.get(), "/banners/cancel_test_page.html",
+                engagement_scores, RENDERER_CANCELLED, false);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, PromptBanner) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{0, 5, 10};
-  RunBannerTest(browser(), "/banners/prompt_test_page.html", engagement_scores,
-                SHOWING_WEB_APP_BANNER, true);
-}
-
-IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, PromptBannerInHandler) {
-  std::vector<double> engagement_scores{0, 2, 5, 10};
-  RunBannerTest(browser(), "/banners/prompt_in_handler_test_page.html",
+  RunBannerTest(browser(), manager.get(), "/banners/prompt_test_page.html",
                 engagement_scores, SHOWING_WEB_APP_BANNER, true);
 }
 
-IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, WebAppBannerInIFrame) {
+IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, PromptBannerInHandler) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
+  std::vector<double> engagement_scores{0, 2, 5, 10};
+  RunBannerTest(browser(), manager.get(),
+                "/banners/prompt_in_handler_test_page.html", engagement_scores,
+                SHOWING_WEB_APP_BANNER, true);
+}
+
+IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest,
+                       CancelBannerAfterPromptInHandler) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
   std::vector<double> engagement_scores{10};
-  RunBannerTest(browser(), "/banners/iframe_test_page.html", engagement_scores,
-                NO_MANIFEST, false);
+  RunBannerTest(browser(), manager.get(),
+                "/banners/prompt_in_handler_test_page.html", engagement_scores,
+                SHOWING_WEB_APP_BANNER, true);
+  std::string cancel_test_page_url =
+      GetURLOfPageWithManifest("/banners/cancel_test_page.html?manifest=",
+                               "/banners/manifest_different_start_url.json");
+  RunBannerTest(browser(), manager.get(), cancel_test_page_url,
+                engagement_scores, RENDERER_CANCELLED, false);
+}
+
+IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, WebAppBannerInIFrame) {
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(browser()));
+  std::vector<double> engagement_scores{10};
+  RunBannerTest(browser(), manager.get(), "/banners/iframe_test_page.html",
+                engagement_scores, NO_MANIFEST, false);
 }
 
 IN_PROC_BROWSER_TEST_F(AppBannerManagerBrowserTest, DoesNotShowInIncognito) {
-  std::vector<double> engagement_scores{10};
   Browser* incognito_browser =
       OpenURLOffTheRecord(browser()->profile(), GURL("about:blank"));
-  RunBannerTest(incognito_browser, "/banners/manifest_test_page.html",
-                engagement_scores, IN_INCOGNITO, false);
+  std::unique_ptr<AppBannerManagerTest> manager(
+      CreateAppBannerManager(incognito_browser));
+  std::vector<double> engagement_scores{10};
+  RunBannerTest(incognito_browser, manager.get(),
+                "/banners/manifest_test_page.html", engagement_scores,
+                IN_INCOGNITO, false);
 }
 
 }  // namespace banners
diff --git a/chrome/browser/browser_about_handler_unittest.cc b/chrome/browser/browser_about_handler_unittest.cc
index 321fd720..f9df2da 100644
--- a/chrome/browser/browser_about_handler_unittest.cc
+++ b/chrome/browser/browser_about_handler_unittest.cc
@@ -82,9 +82,6 @@
 // Chrome OS defaults to showing Options in a window and including About in
 // Options.
 TEST_F(BrowserAboutHandlerTest, WillHandleBrowserAboutURLForOptionsChromeOS) {
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(features::kMaterialDesignSettings);
-
   std::string chrome_prefix(content::kChromeUIScheme);
   chrome_prefix.append(url::kStandardSchemeSeparator);
   std::vector<AboutURLTestCase> test_cases(
@@ -98,9 +95,6 @@
 
 #else
 TEST_F(BrowserAboutHandlerTest, WillHandleBrowserAboutURLForOptions) {
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(features::kMaterialDesignSettings);
-
   std::string chrome_prefix(content::kChromeUIScheme);
   chrome_prefix.append(url::kStandardSchemeSeparator);
   std::vector<AboutURLTestCase> test_cases(
diff --git a/chrome/browser/chrome_content_browser_client_browsertest.cc b/chrome/browser/chrome_content_browser_client_browsertest.cc
index e0e82fe9..fa57c299 100644
--- a/chrome/browser/chrome_content_browser_client_browsertest.cc
+++ b/chrome/browser/chrome_content_browser_client_browsertest.cc
@@ -4,12 +4,10 @@
 
 #include "base/command_line.h"
 #include "base/macros.h"
-#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/common/chrome_features.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
@@ -34,19 +32,11 @@
         GetController().GetLastCommittedEntry();
   }
 
-  void SetUpInProcessBrowserTestFixture() override {
-    disable_md_settings_.InitAndDisableFeature(
-        features::kMaterialDesignSettings);
-  }
-
 #if defined(OS_CHROMEOS)
   void SetUpCommandLine(base::CommandLine* command_line) override {
     command_line->AppendSwitch(switches::kDisableSettingsWindow);
   }
 #endif
-
- private:
-  base::test::ScopedFeatureList disable_md_settings_;
 };
 
 IN_PROC_BROWSER_TEST_F(ChromeContentBrowserClientBrowserTest,
diff --git a/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc b/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc
index 01ed8497..dc79a45 100644
--- a/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc
+++ b/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc
@@ -11,7 +11,6 @@
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
-#include "base/test/simple_test_clock.h"
 #include "base/threading/platform_thread.h"
 #include "base/values.h"
 #include "chrome/browser/content_settings/content_settings_mock_observer.h"
@@ -135,7 +134,7 @@
 }
 
 // Tests that fullscreen and mouselock content settings are cleared.
-TEST_F(PrefProviderTest, DiscardObsoletePreferences) {
+TEST_F(PrefProviderTest, DiscardObsoleteFullscreenAndMouselockPreferences) {
   static const char kFullscreenPrefPath[] =
       "profile.content_settings.exceptions.fullscreen";
 #if !defined(OS_ANDROID)
@@ -179,6 +178,68 @@
                                          std::string(), false));
 }
 
+// Tests that last usage content settings are cleared.
+TEST_F(PrefProviderTest, DiscardObsoleteLastUsagePreferences) {
+  std::string kGeolocationPrefPath =
+      ContentSettingsRegistry::GetInstance()
+          ->Get(CONTENT_SETTINGS_TYPE_GEOLOCATION)
+          ->website_settings_info()
+          ->pref_name();
+  std::string kMicPrefPath = ContentSettingsRegistry::GetInstance()
+                                 ->Get(CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC)
+                                 ->website_settings_info()
+                                 ->pref_name();
+  const char kObsoleteLastUsed[] = "last_used";
+
+  TestingProfile profile;
+  PrefService* prefs = profile.GetPrefs();
+
+  // Content settings prefs are structured as follows:
+  // "media_stream_mic": {
+  //   "https://example.com:443,*": {
+  //     "last_used": 1486968992.758971,
+  //     "setting": 1
+  //   }
+  // }
+  const char kPattern[] = "https://example.com:443,*";
+  GURL host("https://example.com/");
+
+  auto geolocation_pattern_data = base::MakeUnique<base::DictionaryValue>();
+  geolocation_pattern_data->SetDouble(kObsoleteLastUsed, 1485000000.0);
+  base::DictionaryValue geolocation_pref_data;
+  geolocation_pref_data.SetWithoutPathExpansion(
+      kPattern, std::move(geolocation_pattern_data));
+  prefs->Set(kGeolocationPrefPath, geolocation_pref_data);
+
+  auto mic_pattern_data = base::MakeUnique<base::DictionaryValue>();
+  mic_pattern_data->SetInteger("setting", CONTENT_SETTING_ALLOW);
+  mic_pattern_data->SetDouble(kObsoleteLastUsed, 1480000000.0);
+  base::DictionaryValue mic_pref_data;
+  mic_pref_data.SetWithoutPathExpansion(kPattern, std::move(mic_pattern_data));
+  prefs->Set(kMicPrefPath, mic_pref_data);
+
+  // Instantiate a new PrefProvider here, because we want to test the
+  // constructor's behavior after setting the above.
+  PrefProvider provider(prefs, false);
+
+  // Check that last_used data has been deleted.
+  EXPECT_TRUE(prefs->GetDictionary(kGeolocationPrefPath)->empty());
+  auto mic_prefs = prefs->GetDictionary(kMicPrefPath);
+  const base::DictionaryValue* mic_result_pattern_data;
+  ASSERT_TRUE(mic_prefs->GetDictionaryWithoutPathExpansion(
+      kPattern, &mic_result_pattern_data));
+  EXPECT_EQ(static_cast<size_t>(1), mic_result_pattern_data->size());
+  int mic_result_setting;
+  EXPECT_TRUE(
+      mic_result_pattern_data->GetInteger("setting", &mic_result_setting));
+  EXPECT_EQ(CONTENT_SETTING_ALLOW, mic_result_setting);
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            TestUtils::GetContentSetting(&provider, host, host,
+                                         CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC,
+                                         std::string(), false));
+  provider.ShutdownOnUIThread();
+}
+
 // Test for regression in which the PrefProvider modified the user pref store
 // of the OTR unintentionally: http://crbug.com/74466.
 TEST_F(PrefProviderTest, Incognito) {
@@ -399,41 +460,6 @@
   provider.ShutdownOnUIThread();
 }
 
-TEST_F(PrefProviderTest, LastUsage) {
-  TestingProfile testing_profile;
-  PrefProvider pref_content_settings_provider(testing_profile.GetPrefs(),
-                                              false);
-  base::SimpleTestClock* test_clock = new base::SimpleTestClock;
-  test_clock->SetNow(base::Time::Now());
-
-  pref_content_settings_provider.SetClockForTesting(
-      std::unique_ptr<base::Clock>(test_clock));
-  GURL host("http://example.com/");
-  ContentSettingsPattern pattern =
-      ContentSettingsPattern::FromString("[*.]example.com");
-
-  base::Time no_usage = pref_content_settings_provider.GetLastUsage(
-      pattern, pattern, CONTENT_SETTINGS_TYPE_GEOLOCATION);
-  EXPECT_EQ(no_usage.ToDoubleT(), 0);
-
-  pref_content_settings_provider.UpdateLastUsage(
-      pattern, pattern, CONTENT_SETTINGS_TYPE_GEOLOCATION);
-  base::Time first = pref_content_settings_provider.GetLastUsage(
-      pattern, pattern, CONTENT_SETTINGS_TYPE_GEOLOCATION);
-
-  test_clock->Advance(base::TimeDelta::FromSeconds(10));
-
-  pref_content_settings_provider.UpdateLastUsage(
-      pattern, pattern, CONTENT_SETTINGS_TYPE_GEOLOCATION);
-  base::Time second = pref_content_settings_provider.GetLastUsage(
-      pattern, pattern, CONTENT_SETTINGS_TYPE_GEOLOCATION);
-
-  base::TimeDelta delta = second - first;
-  EXPECT_EQ(delta.InSeconds(), 10);
-
-  pref_content_settings_provider.ShutdownOnUIThread();
-}
-
 TEST_F(PrefProviderTest, IncognitoInheritsValueMap) {
   sync_preferences::TestingPrefServiceSyncable prefs;
   PrefProvider::RegisterProfilePrefs(prefs.registry());
diff --git a/chrome/browser/geolocation/geolocation_browsertest.cc b/chrome/browser/geolocation/geolocation_browsertest.cc
index 76eb19a5..c8d635d 100644
--- a/chrome/browser/geolocation/geolocation_browsertest.cc
+++ b/chrome/browser/geolocation/geolocation_browsertest.cc
@@ -744,34 +744,3 @@
   ASSERT_TRUE(content::ExecuteScript(
       current_browser()->tab_strip_model()->GetActiveWebContents(), script));
 }
-
-IN_PROC_BROWSER_TEST_F(GeolocationBrowserTest, LastUsageUpdated) {
-  ASSERT_NO_FATAL_FAILURE(Initialize(INITIALIZATION_DEFAULT));
-  base::SimpleTestClock* clock_ = new base::SimpleTestClock();
-  GetHostContentSettingsMap()->SetPrefClockForTesting(
-      std::unique_ptr<base::Clock>(clock_));
-  clock_->SetNow(base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(10));
-
-  // Setting the permission should trigger the last usage.
-  GetHostContentSettingsMap()->SetContentSettingDefaultScope(
-      current_url(), current_url(), CONTENT_SETTINGS_TYPE_GEOLOCATION,
-      std::string(), CONTENT_SETTING_ALLOW);
-
-  // Permission has been used at the starting time.
-  EXPECT_EQ(GetHostContentSettingsMap()->GetLastUsage(
-      current_url().GetOrigin(),
-      current_url().GetOrigin(),
-      CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(), 10);
-
-  clock_->Advance(base::TimeDelta::FromSeconds(3));
-
-  // Calling watchPosition should trigger the last usage update.
-  WatchPositionAndObservePermissionRequest(false);
-  ExpectPosition(fake_latitude(), fake_longitude());
-
-  // Last usage has been updated.
-  EXPECT_EQ(GetHostContentSettingsMap()->GetLastUsage(
-      current_url().GetOrigin(),
-      current_url().GetOrigin(),
-      CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(), 13);
-}
diff --git a/chrome/browser/geolocation/geolocation_permission_context_unittest.cc b/chrome/browser/geolocation/geolocation_permission_context_unittest.cc
index d1af54d..e733a68 100644
--- a/chrome/browser/geolocation/geolocation_permission_context_unittest.cc
+++ b/chrome/browser/geolocation/geolocation_permission_context_unittest.cc
@@ -871,140 +871,3 @@
       CONTENT_SETTING_ASK,
       GetGeolocationContentSetting(requesting_frame_1, requesting_frame_0));
 }
-
-TEST_F(GeolocationPermissionContextTests, LastUsageAudited) {
-  GURL requesting_frame("https://www.example.com/geolocation");
-  NavigateAndCommit(requesting_frame);
-  RequestManagerDocumentLoadCompleted();
-
-  base::SimpleTestClock* test_clock = new base::SimpleTestClock;
-  test_clock->SetNow(base::Time::UnixEpoch() +
-                     base::TimeDelta::FromSeconds(10));
-
-  HostContentSettingsMap* map =
-      HostContentSettingsMapFactory::GetForProfile(profile());
-  map->SetPrefClockForTesting(std::unique_ptr<base::Clock>(test_clock));
-
-  // The permission shouldn't have been used yet.
-  EXPECT_EQ(map->GetLastUsage(requesting_frame.GetOrigin(),
-                              requesting_frame.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            0);
-  ASSERT_EQ(0U, GetNumberOfPrompts());
-  RequestGeolocationPermission(
-      web_contents(), RequestID(0), requesting_frame, false);
-  ASSERT_EQ(1U, GetNumberOfPrompts());
-
-  AcceptPrompt();
-  CheckTabContentsState(requesting_frame, CONTENT_SETTING_ALLOW);
-  CheckPermissionMessageSent(0, true);
-
-  // Permission has been used at the starting time.
-  EXPECT_EQ(map->GetLastUsage(requesting_frame.GetOrigin(),
-                              requesting_frame.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            10);
-
-  test_clock->Advance(base::TimeDelta::FromSeconds(3));
-  RequestGeolocationPermission(
-      web_contents(), RequestID(0), requesting_frame, false);
-
-  // Permission has been used three seconds later.
-  EXPECT_EQ(map->GetLastUsage(requesting_frame.GetOrigin(),
-                              requesting_frame.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            13);
-}
-
-TEST_F(GeolocationPermissionContextTests, LastUsageAuditedMultipleFrames) {
-  base::SimpleTestClock* test_clock = new base::SimpleTestClock;
-  test_clock->SetNow(base::Time::UnixEpoch() +
-                     base::TimeDelta::FromSeconds(10));
-
-  HostContentSettingsMap* map =
-      HostContentSettingsMapFactory::GetForProfile(profile());
-  map->SetPrefClockForTesting(std::unique_ptr<base::Clock>(test_clock));
-
-  GURL requesting_frame_0("https://www.example.com/geolocation");
-  GURL requesting_frame_1("https://www.example-2.com/geolocation");
-
-  // The permission shouldn't have been used yet.
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_0.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            0);
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_1.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            0);
-
-  NavigateAndCommit(requesting_frame_0);
-  RequestManagerDocumentLoadCompleted();
-
-  EXPECT_EQ(0U, GetNumberOfPrompts());
-
-  // Request permission for two frames.
-  RequestGeolocationPermission(
-      web_contents(), RequestID(0), requesting_frame_0, false);
-  RequestGeolocationPermission(
-      web_contents(), RequestID(1), requesting_frame_1, false);
-
-  // Ensure only one infobar is created.
-  ASSERT_EQ(1U, GetNumberOfPrompts());
-
-  // Accept the first frame.
-  AcceptPrompt();
-#if defined(OS_ANDROID)
-  infobar_service()->RemoveInfoBar(infobar_service()->infobar_at(0));
-#endif
-  CheckTabContentsState(requesting_frame_0, CONTENT_SETTING_ALLOW);
-  CheckPermissionMessageSent(0, true);
-
-  // Verify that accepting the first didn't accept because it's embedded
-  // in the other.
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_0.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            10);
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_1.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            0);
-
-  ASSERT_EQ(1U, GetNumberOfPrompts());
-
-  test_clock->Advance(base::TimeDelta::FromSeconds(1));
-
-  // Allow the second frame.
-  AcceptPrompt();
-  CheckTabContentsState(requesting_frame_1, CONTENT_SETTING_ALLOW);
-  CheckPermissionMessageSent(1, true);
-#if defined(OS_ANDROID)
-  infobar_service()->RemoveInfoBar(infobar_service()->infobar_at(0));
-#endif
-
-  // Verify that the times are different.
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_0.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            10);
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_1.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            11);
-
-  test_clock->Advance(base::TimeDelta::FromSeconds(2));
-  RequestGeolocationPermission(
-      web_contents(), RequestID(0), requesting_frame_0, false);
-
-  // Verify that requesting permission in one frame doesn't update other where
-  // it is the embedder.
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_0.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            13);
-  EXPECT_EQ(map->GetLastUsage(requesting_frame_1.GetOrigin(),
-                              requesting_frame_0.GetOrigin(),
-                              CONTENT_SETTINGS_TYPE_GEOLOCATION).ToDoubleT(),
-            11);
-}
diff --git a/chrome/browser/media/webrtc/media_stream_devices_controller.cc b/chrome/browser/media/webrtc/media_stream_devices_controller.cc
index ba1a834..1a7f75a 100644
--- a/chrome/browser/media/webrtc/media_stream_devices_controller.cc
+++ b/chrome/browser/media/webrtc/media_stream_devices_controller.cc
@@ -414,21 +414,6 @@
     }
   }  // switch
 
-  if (audio_allowed) {
-    HostContentSettingsMapFactory::GetForProfile(profile_)
-        ->UpdateLastUsageByPattern(
-            ContentSettingsPattern::FromURLNoWildcard(request_.security_origin),
-            ContentSettingsPattern::Wildcard(),
-            CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC);
-  }
-  if (video_allowed) {
-    HostContentSettingsMapFactory::GetForProfile(profile_)
-        ->UpdateLastUsageByPattern(
-            ContentSettingsPattern::FromURLNoWildcard(request_.security_origin),
-            ContentSettingsPattern::Wildcard(),
-            CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA);
-  }
-
   return devices;
 }
 
diff --git a/chrome/browser/notifications/notification_interactive_uitest.cc b/chrome/browser/notifications/notification_interactive_uitest.cc
index 611fdd44..483c74e 100644
--- a/chrome/browser/notifications/notification_interactive_uitest.cc
+++ b/chrome/browser/notifications/notification_interactive_uitest.cc
@@ -759,40 +759,6 @@
             (*notifications.rbegin())->message());
 }
 
-IN_PROC_BROWSER_TEST_F(NotificationsTest, TestLastUsage) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-
-  HostContentSettingsMap* settings_map =
-      HostContentSettingsMapFactory::GetForProfile(browser()->profile());
-  base::SimpleTestClock* clock = new base::SimpleTestClock();
-  settings_map->SetPrefClockForTesting(std::unique_ptr<base::Clock>(clock));
-  clock->SetNow(base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(10));
-
-  // Creates a simple notification.
-  AllowAllOrigins();
-  ui_test_utils::NavigateToURL(browser(), GetTestPageURL());
-
-  std::string result = CreateSimpleNotification(browser(), true);
-  EXPECT_NE("-1", result);
-
-  EXPECT_EQ(settings_map->GetLastUsage(GetTestPageURL().GetOrigin(),
-                                       GetTestPageURL().GetOrigin(),
-                                       CONTENT_SETTINGS_TYPE_NOTIFICATIONS)
-                .ToDoubleT(),
-            10);
-
-  clock->Advance(base::TimeDelta::FromSeconds(3));
-
-  result = CreateSimpleNotification(browser(), true);
-  EXPECT_NE("-1", result);
-
-  EXPECT_EQ(settings_map->GetLastUsage(GetTestPageURL().GetOrigin(),
-                                       GetTestPageURL().GetOrigin(),
-                                       CONTENT_SETTINGS_TYPE_NOTIFICATIONS)
-                .ToDoubleT(),
-            13);
-}
-
 IN_PROC_BROWSER_TEST_F(NotificationsTest,
                        TestNotificationReplacementReappearance) {
   ASSERT_TRUE(embedded_test_server()->Start());
diff --git a/chrome/browser/notifications/platform_notification_service_impl.cc b/chrome/browser/notifications/platform_notification_service_impl.cc
index 10c6a546..a3b208c 100644
--- a/chrome/browser/notifications/platform_notification_service_impl.cc
+++ b/chrome/browser/notifications/platform_notification_service_impl.cc
@@ -319,9 +319,6 @@
         base::Bind(&CancelNotification, notification.delegate_id(), profile_id,
                    profile->IsOffTheRecord());
   }
-
-  HostContentSettingsMapFactory::GetForProfile(profile)->UpdateLastUsage(
-      origin, origin, CONTENT_SETTINGS_TYPE_NOTIFICATIONS);
 }
 
 void PlatformNotificationServiceImpl::DisplayPersistentNotification(
@@ -356,9 +353,6 @@
       NotificationCommon::PERSISTENT, notification_id, notification);
   content::RecordAction(
       base::UserMetricsAction("Notifications.Persistent.Shown"));
-
-  HostContentSettingsMapFactory::GetForProfile(profile)->UpdateLastUsage(
-      origin, origin, CONTENT_SETTINGS_TYPE_NOTIFICATIONS);
 }
 
 void PlatformNotificationServiceImpl::ClosePersistentNotification(
diff --git a/chrome/browser/notifications/platform_notification_service_interactive_uitest.cc b/chrome/browser/notifications/platform_notification_service_interactive_uitest.cc
index f99ba22..6de0bdf 100644
--- a/chrome/browser/notifications/platform_notification_service_interactive_uitest.cc
+++ b/chrome/browser/notifications/platform_notification_service_interactive_uitest.cc
@@ -7,7 +7,6 @@
 #include <vector>
 
 #include "base/command_line.h"
-#include "base/feature_list.h"
 #include "base/files/file_path.h"
 #include "base/path_service.h"
 #include "base/strings/string_piece.h"
@@ -365,12 +364,8 @@
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(content::WaitForLoadStop(web_contents));
-
-  std::string url = web_contents->GetLastCommittedURL().spec();
-  if (base::FeatureList::IsEnabled(features::kMaterialDesignSettings))
-    ASSERT_EQ("chrome://settings/content/notifications", url);
-  else
-    ASSERT_EQ("chrome://settings/contentExceptions#notifications", url);
+  ASSERT_EQ("chrome://settings/contentExceptions#notifications",
+            web_contents->GetLastCommittedURL().spec());
 }
 
 IN_PROC_BROWSER_TEST_F(PlatformNotificationServiceBrowserTest,
diff --git a/chrome/browser/notifications/platform_notification_service_unittest.cc b/chrome/browser/notifications/platform_notification_service_unittest.cc
index 8ca62641..f26cae46 100644
--- a/chrome/browser/notifications/platform_notification_service_unittest.cc
+++ b/chrome/browser/notifications/platform_notification_service_unittest.cc
@@ -291,32 +291,6 @@
   EXPECT_EQ(message_center::ButtonType::TEXT, buttons[1].type);
 }
 
-TEST_F(PlatformNotificationServiceTest, NotificationPermissionLastUsage) {
-  // Both page and persistent notifications should update the last usage
-  // time of the notification permission for the origin.
-  GURL origin("https://chrome.com/");
-  base::Time begin_time;
-
-  CreateSimplePageNotification();
-
-  base::Time after_page_notification =
-      HostContentSettingsMapFactory::GetForProfile(profile())->GetLastUsage(
-          origin, origin, CONTENT_SETTINGS_TYPE_NOTIFICATIONS);
-  EXPECT_GT(after_page_notification, begin_time);
-
-  // Ensure that there is at least some time between the two calls.
-  base::PlatformThread::Sleep(base::TimeDelta::FromMilliseconds(1));
-
-  service()->DisplayPersistentNotification(
-      profile(), kNotificationId, GURL() /* service_worker_scope */, origin,
-      PlatformNotificationData(), NotificationResources());
-
-  base::Time after_persistent_notification =
-      HostContentSettingsMapFactory::GetForProfile(profile())->GetLastUsage(
-          origin, origin, CONTENT_SETTINGS_TYPE_NOTIFICATIONS);
-  EXPECT_GT(after_persistent_notification, after_page_notification);
-}
-
 #if BUILDFLAG(ENABLE_EXTENSIONS)
 
 TEST_F(PlatformNotificationServiceTest, DisplayNameForContextMessage) {
diff --git a/chrome/browser/password_manager/password_manager_util_win.cc b/chrome/browser/password_manager/password_manager_util_win.cc
index 43ceb84e..9a114fa 100644
--- a/chrome/browser/password_manager/password_manager_util_win.cc
+++ b/chrome/browser/password_manager/password_manager_util_win.cc
@@ -241,12 +241,6 @@
   bool use_principalname = false;
   DWORD logon_result = 0;
 
-  // Disable password manager reauthentication before Windows 7.
-  // This is because of an interaction between LogonUser() and the sandbox.
-  // http://crbug.com/345916
-  if (base::win::GetVersion() < base::win::VERSION_WIN7)
-    return true;
-
   // On a domain, we obtain the User Principal Name
   // for domain authentication.
   if (GetUserNameEx(NameUserPrincipal, username, &username_length)) {
diff --git a/chrome/browser/permissions/permission_context_base.cc b/chrome/browser/permissions/permission_context_base.cc
index 4db37b31..c8b3596 100644
--- a/chrome/browser/permissions/permission_context_base.cc
+++ b/chrome/browser/permissions/permission_context_base.cc
@@ -115,10 +115,6 @@
   // decision.
   PermissionResult result =
       GetPermissionStatus(requesting_origin, embedding_origin);
-  if (result.content_setting == CONTENT_SETTING_ALLOW) {
-    HostContentSettingsMapFactory::GetForProfile(profile_)->UpdateLastUsage(
-        requesting_origin, embedding_origin, content_settings_storage_type());
-  }
 
   if (result.content_setting == CONTENT_SETTING_ALLOW ||
       result.content_setting == CONTENT_SETTING_BLOCK) {
diff --git a/chrome/browser/permissions/permission_manager.cc b/chrome/browser/permissions/permission_manager.cc
index e890aea..145868d 100644
--- a/chrome/browser/permissions/permission_manager.cc
+++ b/chrome/browser/permissions/permission_manager.cc
@@ -425,21 +425,6 @@
                              requesting_origin, embedding_origin);
 }
 
-void PermissionManager::RegisterPermissionUsage(PermissionType permission,
-                                                const GURL& requesting_origin,
-                                                const GURL& embedding_origin) {
-  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-  // This is required because constant permissions don't have a
-  // ContentSettingsType.
-  if (IsConstantPermission(permission))
-    return;
-
-  HostContentSettingsMapFactory::GetForProfile(profile_)->UpdateLastUsage(
-      requesting_origin,
-      embedding_origin,
-      PermissionTypeToContentSetting(permission));
-}
-
 int PermissionManager::SubscribePermissionStatusChange(
     PermissionType permission,
     const GURL& requesting_origin,
diff --git a/chrome/browser/permissions/permission_manager.h b/chrome/browser/permissions/permission_manager.h
index ed7a264..31e1a22 100644
--- a/chrome/browser/permissions/permission_manager.h
+++ b/chrome/browser/permissions/permission_manager.h
@@ -72,9 +72,6 @@
       content::PermissionType permission,
       const GURL& requesting_origin,
       const GURL& embedding_origin) override;
-  void RegisterPermissionUsage(content::PermissionType permission,
-                               const GURL& requesting_origin,
-                               const GURL& embedding_origin) override;
   int SubscribePermissionStatusChange(
       content::PermissionType permission,
       const GURL& requesting_origin,
diff --git a/chrome/browser/policy/policy_browsertest.cc b/chrome/browser/policy/policy_browsertest.cc
index fda3b28..bade3cf 100644
--- a/chrome/browser/policy/policy_browsertest.cc
+++ b/chrome/browser/policy/policy_browsertest.cc
@@ -31,7 +31,6 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/test/scoped_feature_list.h"
 #include "base/test/test_file_util.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/time/time.h"
@@ -84,7 +83,6 @@
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/location_bar/location_bar.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/common/chrome_features.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension_constants.h"
@@ -4366,9 +4364,6 @@
 };
 
 IN_PROC_BROWSER_TEST_F(ChromeOSPolicyTest, SystemTimezoneAutomaticDetection) {
-  base::test::ScopedFeatureList disable_md_settings;
-  disable_md_settings.InitAndDisableFeature(features::kMaterialDesignSettings);
-
   ui_test_utils::NavigateToURL(browser(), GURL("chrome://settings"));
   chromeos::system::TimeZoneResolverManager* manager =
       g_browser_process->platform_part()->GetTimezoneResolverManager();
diff --git a/chrome/browser/resources/settings/people_page/compiled_resources2.gyp b/chrome/browser/resources/settings/people_page/compiled_resources2.gyp
index 1c3a3b6..9c9d3243 100644
--- a/chrome/browser/resources/settings/people_page/compiled_resources2.gyp
+++ b/chrome/browser/resources/settings/people_page/compiled_resources2.gyp
@@ -69,6 +69,13 @@
       'includes': ['../../../../../third_party/closure_compiler/compile_js2.gypi'],
     },
     {
+      'target_name': 'fingerprint_progress_arc',
+      'dependencies': [
+        '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:cr',
+      ],
+      'includes': ['../../../../../third_party/closure_compiler/compile_js2.gypi'],
+    },
+    {
       'target_name': 'import_data_browser_proxy',
       'dependencies': [
         '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:cr',
@@ -156,6 +163,17 @@
       'includes': ['../../../../../third_party/closure_compiler/compile_js2.gypi'],
     },
     {
+      'target_name': 'setup_fingerprint_dialog',
+      'dependencies': [
+        '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:i18n_behavior',
+        '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:web_ui_listener_behavior',
+
+	'fingerprint_browser_proxy',
+	'fingerprint_progress_arc',
+      ],
+      'includes': ['../../../../../third_party/closure_compiler/compile_js2.gypi'],
+    },
+    {
       'target_name': 'setup_pin_dialog',
       'dependencies': [
         '../compiled_resources2.gyp:route',
diff --git a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.html b/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.html
index ba4553ad4..cb18a85 100644
--- a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.html
+++ b/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.html
@@ -2,7 +2,22 @@
 
 <dom-module id="settings-fingerprint-progress-arc">
   <template>
-    <canvas id="canvas"></canvas>
+    <style>
+      #canvas {
+        height: 100%;
+        vertical-align: bottom;
+        width: 100%;
+      }
+
+      #canvasDiv {
+        height: var(--canvas-height);
+        width: var(--canvas-width);
+      }
+    </style>
+
+    <div id="canvasDiv">
+      <canvas id="canvas"></canvas>
+    </div>
   </template>
   <script src="fingerprint_progress_arc.js"></script>
 </dom-module>
diff --git a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.js b/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.js
index 4e66ebe..0bbf430 100644
--- a/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.js
+++ b/chrome/browser/resources/settings/people_page/fingerprint_progress_arc.js
@@ -33,13 +33,13 @@
  * The color of the canvas circle background.
  * @const {string}
  */
-var CANVAS_CIRCLE_BACKGROUND_COLOR = 'rgba(0, 0, 0, 1.0)';
+var CANVAS_CIRCLE_BACKGROUND_COLOR = 'rgba(66, 66, 66, 1.0)';
 
 /**
  * The color of the arc/circle which indicates setup progress.
  * @const {string}
  */
-var CANVAS_CIRCLE_PROGRESS_COLOR = 'rgba(0, 0, 255, 1.0)';
+var CANVAS_CIRCLE_PROGRESS_COLOR = 'rgba(53, 103, 214, 1.0)';
 
 /**
  * The color of the canvas circle shadow.
@@ -56,11 +56,11 @@
   canvasCircleRadius_: CANVAS_CIRCLE_RADIUS,
   /** @private {number} */
   canvasCircleStrokeWidth_: CANVAS_CIRCLE_STROKE_WIDTH,
-  /** @private {number} */
+  /** @private {string} */
   canvasCircleBackgroundColor_: CANVAS_CIRCLE_BACKGROUND_COLOR,
-  /** @private {number} */
+  /** @private {string} */
   canvasCircleProgressColor_: CANVAS_CIRCLE_PROGRESS_COLOR,
-  /** @private {number} */
+  /** @private {string} */
   canvasCircleShadowColor_: CANVAS_CIRCLE_SHADOW_COLOR,
 
   /**
@@ -143,9 +143,15 @@
 
       // Clears the canvas and draws the new progress circle.
       this.clearCanvas();
+      // Drawing two arcs to form a circle gives a nicer look than drawing an
+      // arc on top of a circle. If |currentAngle| is 0, draw from |start| +
+      // |currentAngle| to 7 * Math.PI / 2 (start is 3 * Math.PI / 2) otherwise
+      // the regular draw from |start| to |currentAngle| will draw nothing which
+      // will cause a flicker for one frame.
       this.drawArc(start, start + currentAngle,
           this.canvasCircleProgressColor_);
-      this.drawArc(start + currentAngle, start,
+      this.drawArc(start + currentAngle,
+          currentAngle <= 0 ? 7 * Math.PI / 2 : start,
           this.canvasCircleBackgroundColor_);
       currentAngle += step;
     }
diff --git a/chrome/browser/resources/settings/people_page/lock_screen.js b/chrome/browser/resources/settings/people_page/lock_screen.js
index a4eab35..70365d1 100644
--- a/chrome/browser/resources/settings/people_page/lock_screen.js
+++ b/chrome/browser/resources/settings/people_page/lock_screen.js
@@ -179,10 +179,12 @@
 
   /** @private */
   getDescriptionText_: function() {
-    return this.numFingerprints_ > 0 ?
-        this.i18n('lockScreenNumberFingerprints',
-            this.numFingerprints_.toString()) :
-        this.i18n('lockScreenEditFingerprintsDescription');
+    if (this.numFingerprints_ > 0) {
+      return this.i18n('lockScreenNumberFingerprints',
+          this.numFingerprints_.toString());
+    }
+
+    return this.i18n('lockScreenEditFingerprintsDescription');
   },
 
   /**
diff --git a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html
index 46a1f42..3b41f9b 100644
--- a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html
+++ b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.html
@@ -13,25 +13,42 @@
 <dom-module id="settings-setup-fingerprint-dialog">
   <template>
     <style include="settings-shared">
+      #arc {
+        --canvas-height: 200px;
+        --canvas-width: 450px;
+      }
+
       #dialog {
         min-width: 500px;
         width: 500px;
       }
 
+      #image {
+        height: 80px;
+        left: 185px;
+        min-height: 80px;
+        min-width: 80px;
+        position: relative;
+        top: -140px;
+        width: 80px;
+      }
+
+      #image[step='3'] {
+        --iron-icon-fill-color: var(--google-blue-700);
+      }
+
+      /* Put the image in a seperate div with 0 height, otherwise the div will
+         take the height of the image, leaving us with a row of whitespace when
+         we position the #image to be inside #arc. */
+      #imageDiv {
+        height: 0;
+      }
+
       /* Use this instead of hidden so that the dialog does not resize when the
          problem appears or disappears. */
       #problemDiv[invisible] {
         visibility: hidden;
       }
-
-      #image {
-        min-height: 50px;
-        min-width: 50px;
-      }
-
-      #image[step='3'] {
-        --iron-icon-fill-color: blue;
-      }
     </style>
 
     <dialog is="cr-dialog" id="dialog" on-close="close">
@@ -45,9 +62,10 @@
         <settings-fingerprint-progress-arc id="arc" on-click="handleClick_"
             on-dblclick="handleDoubleClick_">
         </settings-fingerprint-progress-arc>
-        <iron-icon id="image" icon="settings:fingerprint"
-            step$="[[step_]]">
-        </iron-icon>
+        <div id="imageDiv">
+          <iron-icon id="image" icon="settings:fingerprint" step$="[[step_]]">
+          </iron-icon>
+        </div>
         <div id="problemDiv" class="settings-box first"
             invisible$="[[!problemMessage_]]">
           <iron-icon icon="settings:warning"></iron-icon>
@@ -55,14 +73,14 @@
         </div>
 
         <div class="button-strip">
-          <paper-button class="cancel-button" on-tap="onCancelTap_"
-              disabled$="[[enableContinue_(step_)]]">
-            $i18n{cancel}
+          <paper-button id="addAnotherButton" on-tap="onAddAnotherFingerprint_"
+              hidden$="[[hideAddAnother_(step_)]]">
+            $i18n{configureFingerprintAddAnotherButton}
           </paper-button>
 
-          <paper-button class="action-button" on-tap="onContinueTap_"
-              disabled$="[[!enableContinue_(step_)]]">
-            $i18n{configurePinContinueButton}
+          <paper-button id="closeButton"
+              class$="[[getCloseButtonClass_(step_)]]" on-tap="onClose_">
+            [[getCloseButtonText_(step_)]]
           </paper-button>
         </div>
       </div>
diff --git a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js
index 322df3dc..74efc3e 100644
--- a/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js
+++ b/chrome/browser/resources/settings/people_page/setup_fingerprint_dialog.js
@@ -23,6 +23,13 @@
  */
 var SUCCESSFUL_SCANS_TO_COMPLETE = 5;
 
+/**
+ * The amount of millseconds after a successful but not completed scan before a
+ * message shows up telling the user to scan their finger again.
+ * @const {number}
+ */
+var SHOW_TAP_SENSOR_MESSAGE_DELAY_MS = 2000;
+
 Polymer({
   is: 'settings-setup-fingerprint-dialog',
 
@@ -57,6 +64,14 @@
    */
   receivedScanCount_: 0,
 
+  /**
+   * A message shows after the user has not scanned a finger during setup. This
+   * is the set timeout id.
+   * @type {number}
+   * @private
+   */
+  tapSensorMessageTimeoutId_: 0,
+
   /** @private {?settings.FingerprintBrowserProxy}*/
   browserProxy_: null,
 
@@ -71,6 +86,7 @@
    * Opens the dialog.
    */
   open: function() {
+    this.$.arc.clearCanvas();
     this.$.arc.drawBackgroundCircle();
     this.$.arc.drawShadow(10, 0, 0);
     this.browserProxy_.startEnroll();
@@ -81,14 +97,24 @@
    * Closes the dialog.
    */
   close: function() {
-    if (this.step_ != settings.FingerprintSetupStep.READY)
-      this.browserProxy_.cancelCurrentEnroll();
-    else
+    // Note: Reset resets |step_| back to the default, so handle anything that
+    // checks |step_| before resetting.
+    if(this.step_ == settings.FingerprintSetupStep.READY)
       this.fire('add-fingerprint');
+    else
+      this.browserProxy_.cancelCurrentEnroll();
 
     this.reset_();
   },
 
+  /** private */
+  clearSensorMessageTimeout_: function() {
+    if (this.tapSensorMessageTimeoutId_ != 0) {
+      clearTimeout(this.tapSensorMessageTimeoutId_);
+      this.tapSensorMessageTimeoutId_ = 0;
+    }
+  },
+
   /**
    * Resets the dialog to its start state. Call this when the dialog gets
    * closed.
@@ -98,31 +124,14 @@
     this.step_ = settings.FingerprintSetupStep.LOCATE_SCANNER;
     this.receivedScanCount_ = 0;
     this.$.arc.clearCanvas();
-  },
-
-  /**
-   * Checks if the the fingerprint can be submitted and added.
-   * @private
-   * @return {boolean}
-   */
-  enableContinue_: function(step) {
-    return step == settings.FingerprintSetupStep.READY;
+    this.clearSensorMessageTimeout_();
   },
 
   /**
    * Closes the dialog.
    * @private
    */
-  onCancelTap_: function() {
-    if (this.$.dialog.open)
-      this.$.dialog.close();
-  },
-
-  /**
-   * Closes the dialog.
-   * @private
-   */
-  onContinueTap_: function() {
+  onClose_: function() {
     if (this.$.dialog.open)
       this.$.dialog.close();
   },
@@ -176,17 +185,19 @@
           this.problemMessage_ = '';
           this.step_ = settings.FingerprintSetupStep.READY;
           this.$.arc.animate(this.receivedScanCount_ * slice, 2 * Math.PI);
+          this.clearSensorMessageTimeout_();
           // TODO(sammiequon): Keep increasing scan counts after the scan is
           // complete, so we don't send more fake scans complete signals. Remove
           // this with the fake scan.
           this.receivedScanCount_++;
-        } else if (scan.result != settings.FingerprintResultType.SUCCESS) {
-          this.setProblem_(scan.result);
         } else {
-          this.problemMessage_ = '';
-          this.$.arc.animate(this.receivedScanCount_ * slice,
-              (this.receivedScanCount_ + 1) * slice);
-          this.receivedScanCount_++;
+          this.setProblem_(scan.result);
+          if (scan.result == settings.FingerprintResultType.SUCCESS) {
+            this.problemMessage_ = '';
+            this.$.arc.animate(this.receivedScanCount_ * slice,
+                (this.receivedScanCount_ + 1) * slice);
+            this.receivedScanCount_++;
+          }
         }
         break;
       case settings.FingerprintSetupStep.READY:
@@ -223,9 +234,13 @@
    * @private
    */
   setProblem_: function(scanResult) {
+    this.clearSensorMessageTimeout_();
     switch (scanResult) {
       case settings.FingerprintResultType.SUCCESS:
         this.problemMessage_ = '';
+        this.tapSensorMessageTimeoutId_ = setTimeout(function() {
+          this.problemMessage_ = this.i18n('configureFingerprintLiftFinger');
+        }.bind(this), SHOW_TAP_SENSOR_MESSAGE_DELAY_MS);
         break;
       case settings.FingerprintResultType.PARTIAL:
         this.problemMessage_ = this.i18n('configureFingerprintPartialData');
@@ -248,5 +263,51 @@
         break;
     }
   },
+
+  /**
+   * Displays the text of the close button based on which phase of the
+   * fingerprint setup we are on.
+   * @param {!settings.FingerprintSetupStep} step The current step the
+   *     fingerprint setup is on.
+   * @private
+   */
+  getCloseButtonText_: function(step) {
+    if (step == settings.FingerprintSetupStep.READY)
+      return this.i18n('configureFingerprintDoneButton');
+
+    return this.i18n('configureFingerprintCancelButton');
+  },
+
+  /**
+   * @param {!settings.FingerprintSetupStep} step
+   * @private
+   */
+  getCloseButtonClass_: function(step) {
+    if (step == settings.FingerprintSetupStep.READY)
+      return 'action-button';
+
+    return 'cancel-button';
+  },
+
+  /**
+   * @param {!settings.FingerprintSetupStep} step
+   * @private
+   */
+  hideAddAnother_: function(step) {
+    return step != settings.FingerprintSetupStep.READY;
+  },
+
+  /**
+   * Enrolls the finished fingerprint and sets the dialog back to step one to
+   * prepare to enroll another fingerprint.
+   * @private
+   */
+  onAddAnotherFingerprint_: function() {
+    this.fire('add-fingerprint');
+    this.reset_();
+    this.$.arc.drawBackgroundCircle();
+    this.$.arc.drawShadow(10, 0, 0);
+    this.browserProxy_.startEnroll();
+  },
 });
 })();
diff --git a/chrome/browser/supervised_user/supervised_user_pref_store.cc b/chrome/browser/supervised_user/supervised_user_pref_store.cc
index 546db70..565ee8c 100644
--- a/chrome/browser/supervised_user/supervised_user_pref_store.cc
+++ b/chrome/browser/supervised_user/supervised_user_pref_store.cc
@@ -87,6 +87,11 @@
   return prefs_->GetValue(key, value);
 }
 
+std::unique_ptr<base::DictionaryValue> SupervisedUserPrefStore::GetValues()
+    const {
+  return prefs_->AsDictionaryValue();
+}
+
 void SupervisedUserPrefStore::AddObserver(PrefStore::Observer* observer) {
   observers_.AddObserver(observer);
 }
diff --git a/chrome/browser/supervised_user/supervised_user_pref_store.h b/chrome/browser/supervised_user/supervised_user_pref_store.h
index 592d61e..5560934 100644
--- a/chrome/browser/supervised_user/supervised_user_pref_store.h
+++ b/chrome/browser/supervised_user/supervised_user_pref_store.h
@@ -35,6 +35,7 @@
   // PrefStore overrides:
   bool GetValue(const std::string& key,
                 const base::Value** value) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
   void AddObserver(PrefStore::Observer* observer) override;
   void RemoveObserver(PrefStore::Observer* observer) override;
   bool HasObservers() const override;
diff --git a/chrome/browser/ui/webui/options/browser_options_handler.cc b/chrome/browser/ui/webui/options/browser_options_handler.cc
index c2898b6..95d404d 100644
--- a/chrome/browser/ui/webui/options/browser_options_handler.cc
+++ b/chrome/browser/ui/webui/options/browser_options_handler.cc
@@ -532,6 +532,8 @@
       IDS_SETTINGS_ADD_FINGERPRINT_DIALOG_CANCEL_BUTTON},
     {"configureFingerprintDoneButton",
       IDS_SETTINGS_ADD_FINGERPRINT_DIALOG_DONE_BUTTON},
+    {"configureFingerprintAddAnotherButton",
+      IDS_SETTINGS_ADD_FINGERPRINT_DIALOG_ADD_ANOTHER_BUTTON},
     {"configurePinChoosePinTitle",
       IDS_SETTINGS_PEOPLE_CONFIGURE_PIN_CHOOSE_PIN_TITLE},
     {"configurePinConfirmPinTitle",
diff --git a/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc b/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc
index 3d1545b..c9e1308 100644
--- a/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc
+++ b/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc
@@ -35,7 +35,6 @@
 
  protected:
   void SetUpInProcessBrowserTestFixture() override {
-    options::OptionsUIBrowserTest::SetUpInProcessBrowserTestFixture();
 #if defined(OS_CHROMEOS)
     device_policy_test_helper_.MarkAsEnterpriseOwned();
 #endif
diff --git a/chrome/browser/ui/webui/options/language_dictionary_interactive_uitest.cc b/chrome/browser/ui/webui/options/language_dictionary_interactive_uitest.cc
index dbdad4f2..fb09683 100644
--- a/chrome/browser/ui/webui/options/language_dictionary_interactive_uitest.cc
+++ b/chrome/browser/ui/webui/options/language_dictionary_interactive_uitest.cc
@@ -4,13 +4,11 @@
 
 #include "base/macros.h"
 #include "base/strings/stringprintf.h"
-#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/common/chrome_features.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/interactive_test_utils.h"
@@ -27,8 +25,6 @@
 
   // Navigate to the editDictionary page.
   void SetUpOnMainThread() override {
-    disable_md_settings_.InitAndDisableFeature(
-        features::kMaterialDesignSettings);
     const GURL url = chrome::GetSettingsUrl("editDictionary");
     ui_test_utils::NavigateToURL(browser(), url);
   }
@@ -181,7 +177,6 @@
 
  private:
   std::unique_ptr<content::DOMMessageQueue> dom_message_queue_;
-  base::test::ScopedFeatureList disable_md_settings_;
 
   DISALLOW_COPY_AND_ASSIGN(LanguageDictionaryWebUITest);
 };
diff --git a/chrome/browser/ui/webui/options/language_options_interactive_uitest.cc b/chrome/browser/ui/webui/options/language_options_interactive_uitest.cc
index e9fa0e27..394e071 100644
--- a/chrome/browser/ui/webui/options/language_options_interactive_uitest.cc
+++ b/chrome/browser/ui/webui/options/language_options_interactive_uitest.cc
@@ -3,13 +3,11 @@
 // found in the LICENSE file.
 
 #include "base/macros.h"
-#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/common/chrome_features.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/in_process_browser_test.h"
@@ -32,11 +30,6 @@
  public:
   LanguageOptionsWebUITest() {}
 
-  void SetUpInProcessBrowserTestFixture() override {
-    disable_md_settings_.InitAndDisableFeature(
-        features::kMaterialDesignSettings);
-  }
-
   // This method will navigate to the language settings page and show
   // a subset of languages from the list of available languages.
   void SetUpOnMainThread() override {
@@ -91,8 +84,6 @@
   }
 
  private:
-  base::test::ScopedFeatureList disable_md_settings_;
-
   DISALLOW_COPY_AND_ASSIGN(LanguageOptionsWebUITest);
 };
 
diff --git a/chrome/browser/ui/webui/options/options_ui_browsertest.cc b/chrome/browser/ui/webui/options/options_ui_browsertest.cc
index b375226..255cc61f 100644
--- a/chrome/browser/ui/webui/options/options_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/options/options_ui_browsertest.cc
@@ -16,7 +16,6 @@
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/webui/options/options_ui.h"
 #include "chrome/browser/ui/webui/uber/uber_ui.h"
-#include "chrome/common/chrome_features.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/test/base/ui_test_utils.h"
@@ -108,11 +107,6 @@
 OptionsUIBrowserTest::OptionsUIBrowserTest() {
 }
 
-void OptionsUIBrowserTest::SetUpInProcessBrowserTestFixture() {
-  InProcessBrowserTest::SetUpInProcessBrowserTestFixture();
-  disable_md_settings_.InitAndDisableFeature(features::kMaterialDesignSettings);
-}
-
 void OptionsUIBrowserTest::NavigateToSettings() {
   NavigateToSettingsSubpage("");
 }
diff --git a/chrome/browser/ui/webui/options/options_ui_browsertest.h b/chrome/browser/ui/webui/options/options_ui_browsertest.h
index 35b49b2..aa75e2b 100644
--- a/chrome/browser/ui/webui/options/options_ui_browsertest.h
+++ b/chrome/browser/ui/webui/options/options_ui_browsertest.h
@@ -8,7 +8,6 @@
 #include <string>
 
 #include "base/macros.h"
-#include "base/test/scoped_feature_list.h"
 #include "chrome/test/base/in_process_browser_test.h"
 
 namespace content {
@@ -21,8 +20,6 @@
  public:
   OptionsUIBrowserTest();
 
-  void SetUpInProcessBrowserTestFixture() override;
-
   // Navigate to the Uber/Settings page and block until it has loaded.
   void NavigateToSettings();
 
@@ -47,8 +44,6 @@
   content::RenderFrameHost* GetSettingsFrame();
 
  private:
-  base::test::ScopedFeatureList disable_md_settings_;
-
   DISALLOW_COPY_AND_ASSIGN(OptionsUIBrowserTest);
 };
 
diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 9253f9e..6d4c6f7 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
@@ -1131,6 +1131,8 @@
      IDS_SETTINGS_ADD_FINGERPRINT_DIALOG_CANCEL_BUTTON},
     {"configureFingerprintDoneButton",
      IDS_SETTINGS_ADD_FINGERPRINT_DIALOG_DONE_BUTTON},
+    {"configureFingerprintAddAnotherButton",
+     IDS_SETTINGS_ADD_FINGERPRINT_DIALOG_ADD_ANOTHER_BUTTON},
     {"configurePinChoosePinTitle",
      IDS_SETTINGS_PEOPLE_CONFIGURE_PIN_CHOOSE_PIN_TITLE},
     {"configurePinConfirmPinTitle",
diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
index 62e7eb1b..1bb024a 100644
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
@@ -163,7 +163,7 @@
 // Enables or disables the Material Design version of chrome://settings.
 // Also affects chrome://help.
 const base::Feature kMaterialDesignSettings{"MaterialDesignSettings",
-                                            base::FEATURE_ENABLED_BY_DEFAULT};
+                                            base::FEATURE_DISABLED_BY_DEFAULT};
 
 #if !defined(OS_ANDROID) && !defined(OS_IOS)
 // Enables media content bitstream remoting, an optimization that can activate
@@ -215,6 +215,10 @@
                                            base::FEATURE_DISABLED_BY_DEFAULT};
 #endif
 
+// Enables the pref service. See https://crbug.com/654988.
+const base::Feature kPrefService{"PrefService",
+                                 base::FEATURE_DISABLED_BY_DEFAULT};
+
 #if defined(OS_CHROMEOS)
 // The lock screen will be preloaded so it is instantly available when the user
 // locks the Chromebook device.
diff --git a/chrome/common/chrome_features.h b/chrome/common/chrome_features.h
index 6477e1fc..2285cab8 100644
--- a/chrome/common/chrome_features.h
+++ b/chrome/common/chrome_features.h
@@ -123,6 +123,8 @@
 extern const base::Feature kPreferHtmlOverPlugins;
 #endif
 
+extern const base::Feature kPrefService;
+
 #if defined(OS_CHROMEOS)
 extern const base::Feature kPreloadLockScreen;
 #endif
diff --git a/chrome/test/data/banners/cancel_test_page.html b/chrome/test/data/banners/cancel_test_page.html
index 5f9d9af4..fb1c77a1c 100644
--- a/chrome/test/data/banners/cancel_test_page.html
+++ b/chrome/test/data/banners/cancel_test_page.html
@@ -1,9 +1,13 @@
 <html>
   <head>
     <title>Web app banner test page</title>
-    <link rel="manifest" href="manifest.json" />
     <script src="main.js"></script>
     <script>
+      // If a "manifest=/path/to/manifest.json" query argument is provided to
+      // the URL accessing this page, that path is injected as the manifest tag.
+      // Otherwise, "manifest.json" is used as the manifest tag.
+      addManifestLinkTag();
+
       window.addEventListener('beforeinstallprompt', function(e) {
         console.log('Preventing banner from appearing');
         e.preventDefault();
diff --git a/chrome/test/data/banners/manifest_different_start_url.json b/chrome/test/data/banners/manifest_different_start_url.json
new file mode 100644
index 0000000..ec78957d
--- /dev/null
+++ b/chrome/test/data/banners/manifest_different_start_url.json
@@ -0,0 +1,39 @@
+{
+  "name": "Manifest test app",
+  "icons": [
+    {
+      "src": "launcher-icon-1x.png",
+      "sizes": "48x48",
+      "type": "image/png"
+    },
+    {
+      "src": "launcher-icon-1-5x.png",
+      "sizes": "72x72",
+      "type": "image/png"
+    },
+    {
+      "src": "launcher-icon-2x.png",
+      "sizes": "96x96",
+      "type": "image/png",
+      "purpose": "any badge"
+    },
+    {
+      "src": "launcher-icon-3x.png",
+      "sizes": "144x144",
+      "type": "image/png"
+    },
+    {
+      "src": "launcher-icon-4x.png",
+      "sizes": "192x192",
+      "type": "image/png"
+    },
+    {
+      "src": "image-512px.png",
+      "sizes": "512x512",
+      "type": "image/png"
+    }
+  ],
+  "start_url": "manifest_different_start_url_test_page.html",
+  "display": "standalone",
+  "orientation": "landscape"
+}
diff --git a/chrome/test/data/webui/settings/fingerprint_browsertest_chromeos.js b/chrome/test/data/webui/settings/fingerprint_browsertest_chromeos.js
index 1d6ef89d..01b7e4b 100644
--- a/chrome/test/data/webui/settings/fingerprint_browsertest_chromeos.js
+++ b/chrome/test/data/webui/settings/fingerprint_browsertest_chromeos.js
@@ -94,6 +94,8 @@
 
   /** @type {?SettingsSetupFingerprintDialogElement} */
   var dialog = null;
+  /** @type {?HTMLButtonElement} */
+  var addAnotherButton= null;
   /** @type {?settings.TestFingerprintBrowserProxy} */
   var browserProxy = null;
 
@@ -105,6 +107,13 @@
     return {model: {index: index, item: opt_label || ''}};
   }
 
+  /**
+   * @param {!Element} element
+   */
+  function isVisible(element) {
+    return element.offsetWidth > 0 && element.offsetHeight > 0;
+  }
+
   setup(function() {
     browserProxy = new TestFingerprintBrowserProxy();
     settings.FingerprintBrowserProxyImpl.instance_ = browserProxy;
@@ -113,6 +122,7 @@
     fingerprintList = document.createElement('settings-fingerprint-list');
     document.body.appendChild(fingerprintList);
     dialog = fingerprintList.$.setupFingerprint;
+    addAnotherButton = dialog.$.addAnotherButton;
     Polymer.dom.flush();
     return browserProxy.whenCalled('getFingerprintsList').then(function() {
       assertEquals(0, fingerprintList.fingerprints_.length);
@@ -147,8 +157,7 @@
 
       // Verify that by tapping the continue button we should exit the dialog
       // and the fingerprint list should have one fingerprint registered.
-      assertFalse(dialog.$$('.action-button').disabled);
-      MockInteractions.tap(dialog.$$('.action-button'));
+      MockInteractions.tap(dialog.$.closeButton);
       return browserProxy.whenCalled('getFingerprintsList').then(
           function() {
             assertEquals(1, fingerprintList.fingerprints_.length);
@@ -156,6 +165,57 @@
     });
   });
 
+  // Verify enrolling a fingerprint, then enrolling another without closing the
+  // dialog works as intended.
+  test('EnrollingAnotherFingerprint', function() {
+    assertFalse(dialog.$.dialog.open);
+    MockInteractions.tap(fingerprintList.$$('.action-button'));
+    return browserProxy.whenCalled('startEnroll').then(function() {
+      assertTrue(dialog.$.dialog.open);
+      assertEquals(0, dialog.receivedScanCount_);
+      assertFalse(isVisible(addAnotherButton));
+      browserProxy.scanReceived(settings.FingerprintResultType.SUCCESS, true);
+      assertEquals(settings.FingerprintSetupStep.READY, dialog.step_);
+
+      // Once the first fingerprint is enrolled, verify that enrolling the
+      // second fingerprint without closing the dialog works as expected.
+      return browserProxy.whenCalled('getFingerprintsList');
+    }).then(function() {
+      assertEquals(1, fingerprintList.fingerprints_.length);
+      assertTrue(dialog.$.dialog.open);
+      assertTrue(isVisible(addAnotherButton));
+      MockInteractions.tap(addAnotherButton);
+      return browserProxy.whenCalled('startEnroll');
+    }).then(function() {
+      assertTrue(dialog.$.dialog.open);
+      assertFalse(isVisible(addAnotherButton));
+      browserProxy.scanReceived(settings.FingerprintResultType.SUCCESS, true);
+      return browserProxy.whenCalled('getFingerprintsList');
+    }).then(function() {
+       assertEquals(2, fingerprintList.fingerprints_.length);
+    });
+  });
+
+  test('CancelEnrollingFingerprint', function() {
+    assertFalse(dialog.$.dialog.open);
+    MockInteractions.tap(fingerprintList.$$('.action-button'));
+    return browserProxy.whenCalled('startEnroll').then(function() {
+      assertTrue(dialog.$.dialog.open);
+      assertEquals(0, dialog.receivedScanCount_);
+      assertEquals(settings.FingerprintSetupStep.LOCATE_SCANNER, dialog.step_);
+      browserProxy.scanReceived(settings.FingerprintResultType.SUCCESS, false);
+      assertEquals(1, dialog.receivedScanCount_);
+      assertEquals(settings.FingerprintSetupStep.MOVE_FINGER, dialog.step_);
+
+      // Verify that by tapping the exit button we should exit the dialog
+      // and the fingerprint list should have zero fingerprints registered.
+      MockInteractions.tap(dialog.$.closeButton);
+      return browserProxy.whenCalled('cancelCurrentEnroll');
+    }).then(function() {
+      assertEquals(0, fingerprintList.fingerprints_.length);
+    });
+  });
+
   test('RemoveFingerprint', function() {
     browserProxy.setFingerprints(['Label 1', 'Label 2']);
     fingerprintList.updateFingerprintsList_();
diff --git a/chromecast/browser/cast_permission_manager.cc b/chromecast/browser/cast_permission_manager.cc
index a126718..8cc7932 100644
--- a/chromecast/browser/cast_permission_manager.cc
+++ b/chromecast/browser/cast_permission_manager.cc
@@ -58,12 +58,6 @@
   return blink::mojom::PermissionStatus::GRANTED;
 }
 
-void CastPermissionManager::RegisterPermissionUsage(
-    content::PermissionType permission,
-    const GURL& requesting_origin,
-    const GURL& embedding_origin) {
-}
-
 int CastPermissionManager::SubscribePermissionStatusChange(
     content::PermissionType permission,
     const GURL& requesting_origin,
diff --git a/chromecast/browser/cast_permission_manager.h b/chromecast/browser/cast_permission_manager.h
index 00848e2..6f7dd46 100644
--- a/chromecast/browser/cast_permission_manager.h
+++ b/chromecast/browser/cast_permission_manager.h
@@ -41,9 +41,6 @@
       content::PermissionType permission,
       const GURL& requesting_origin,
       const GURL& embedding_origin) override;
-  void RegisterPermissionUsage(content::PermissionType permission,
-                               const GURL& requesting_origin,
-                               const GURL& embedding_origin) override;
   int SubscribePermissionStatusChange(
       content::PermissionType permission,
       const GURL& requesting_origin,
diff --git a/components/content_settings/core/browser/content_settings_pref.cc b/components/content_settings/core/browser/content_settings_pref.cc
index 0306c58..df76df06 100644
--- a/components/content_settings/core/browser/content_settings_pref.cc
+++ b/components/content_settings/core/browser/content_settings_pref.cc
@@ -10,7 +10,6 @@
 #include "base/bind.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_split.h"
-#include "base/time/clock.h"
 #include "components/content_settings/core/browser/content_settings_info.h"
 #include "components/content_settings/core/browser/content_settings_registry.h"
 #include "components/content_settings/core/browser/content_settings_rule.h"
@@ -26,7 +25,6 @@
 
 const char kSettingPath[] = "setting";
 const char kPerResourceIdentifierPrefName[] = "per_resource";
-const char kLastUsed[] = "last_used";
 
 // If the given content type supports resource identifiers in user preferences,
 // returns true and sets |pref_key| to the key in the content settings
@@ -178,66 +176,6 @@
                        ResourceIdentifier());
 }
 
-void ContentSettingsPref::UpdateLastUsage(
-    const ContentSettingsPattern& primary_pattern,
-    const ContentSettingsPattern& secondary_pattern,
-    base::Clock* clock) {
-  // Don't write if in incognito.
-  if (is_incognito_) {
-    return;
-  }
-
-  // Ensure that |lock_| is not held by this thread, since this function will
-  // send out notifications (by |~DictionaryPrefUpdate|).
-  AssertLockNotHeld();
-
-  base::AutoReset<bool> auto_reset(&updating_preferences_, true);
-  {
-    DictionaryPrefUpdate update(prefs_, pref_name_);
-    base::DictionaryValue* pattern_pairs_settings = update.Get();
-
-    std::string pattern_str(
-        CreatePatternString(primary_pattern, secondary_pattern));
-    base::DictionaryValue* settings_dictionary = NULL;
-    bool found = pattern_pairs_settings->GetDictionaryWithoutPathExpansion(
-        pattern_str, &settings_dictionary);
-
-    if (!found) {
-      settings_dictionary = new base::DictionaryValue;
-      pattern_pairs_settings->SetWithoutPathExpansion(pattern_str,
-                                                      settings_dictionary);
-    }
-
-    settings_dictionary->SetWithoutPathExpansion(
-        kLastUsed, new base::FundamentalValue(clock->Now().ToDoubleT()));
-  }
-}
-
-base::Time ContentSettingsPref::GetLastUsage(
-    const ContentSettingsPattern& primary_pattern,
-    const ContentSettingsPattern& secondary_pattern) {
-  const base::DictionaryValue* pattern_pairs_settings =
-      prefs_->GetDictionary(pref_name_);
-  std::string pattern_str(
-      CreatePatternString(primary_pattern, secondary_pattern));
-
-  const base::DictionaryValue* settings_dictionary = NULL;
-  bool found = pattern_pairs_settings->GetDictionaryWithoutPathExpansion(
-      pattern_str, &settings_dictionary);
-
-  if (!found)
-    return base::Time();
-
-  double last_used_time;
-  found = settings_dictionary->GetDoubleWithoutPathExpansion(
-      kLastUsed, &last_used_time);
-
-  if (!found)
-    return base::Time();
-
-  return base::Time::FromDoubleT(last_used_time);
-}
-
 size_t ContentSettingsPref::GetNumExceptions() {
   return value_map_.size();
 }
@@ -436,7 +374,6 @@
         // Update settings dictionary.
         if (value == NULL) {
           settings_dictionary->RemoveWithoutPathExpansion(kSettingPath, NULL);
-          settings_dictionary->RemoveWithoutPathExpansion(kLastUsed, NULL);
         } else {
           settings_dictionary->SetWithoutPathExpansion(
               kSettingPath, value->DeepCopy());
diff --git a/components/content_settings/core/browser/content_settings_pref.h b/components/content_settings/core/browser/content_settings_pref.h
index d06fe01e..77c6d03 100644
--- a/components/content_settings/core/browser/content_settings_pref.h
+++ b/components/content_settings/core/browser/content_settings_pref.h
@@ -23,7 +23,6 @@
 class PrefChangeRegistrar;
 
 namespace base {
-class Clock;
 class DictionaryValue;
 }
 
@@ -61,13 +60,6 @@
 
   void ClearAllContentSettingsRules();
 
-  void UpdateLastUsage(const ContentSettingsPattern& primary_pattern,
-                       const ContentSettingsPattern& secondary_pattern,
-                       base::Clock* clock);
-
-  base::Time GetLastUsage(const ContentSettingsPattern& primary_pattern,
-                          const ContentSettingsPattern& secondary_pattern);
-
   size_t GetNumExceptions();
 
   // Tries to lock |lock_|. If successful, returns true and releases the lock.
diff --git a/components/content_settings/core/browser/content_settings_pref_provider.cc b/components/content_settings/core/browser/content_settings_pref_provider.cc
index e544e4f..3bd173e 100644
--- a/components/content_settings/core/browser/content_settings_pref_provider.cc
+++ b/components/content_settings/core/browser/content_settings_pref_provider.cc
@@ -15,8 +15,6 @@
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
-#include "base/time/clock.h"
-#include "base/time/default_clock.h"
 #include "components/content_settings/core/browser/content_settings_pref.h"
 #include "components/content_settings/core/browser/content_settings_rule.h"
 #include "components/content_settings/core/browser/content_settings_utils.h"
@@ -44,6 +42,7 @@
     "profile.content_settings.exceptions.mouselock";
 #endif  // !defined(OS_ANDROID)
 #endif  // !defined(OS_IOS)
+const char kObsoleteLastUsed[] = "last_used";
 
 }  // namespace
 
@@ -83,7 +82,6 @@
 
 PrefProvider::PrefProvider(PrefService* prefs, bool incognito)
     : prefs_(prefs),
-      clock_(new base::DefaultClock()),
       is_incognito_(incognito) {
   DCHECK(prefs_);
   // Verify preferences version.
@@ -181,32 +179,12 @@
     pref.second->ClearPref();
 }
 
-void PrefProvider::UpdateLastUsage(
-    const ContentSettingsPattern& primary_pattern,
-    const ContentSettingsPattern& secondary_pattern,
-    ContentSettingsType content_type) {
-  GetPref(content_type)
-      ->UpdateLastUsage(primary_pattern, secondary_pattern, clock_.get());
-}
-
-base::Time PrefProvider::GetLastUsage(
-    const ContentSettingsPattern& primary_pattern,
-    const ContentSettingsPattern& secondary_pattern,
-    ContentSettingsType content_type) {
-  return GetPref(content_type)
-      ->GetLastUsage(primary_pattern, secondary_pattern);
-}
-
 ContentSettingsPref* PrefProvider::GetPref(ContentSettingsType type) const {
   auto it = content_settings_prefs_.find(type);
   DCHECK(it != content_settings_prefs_.end());
   return it->second.get();
 }
 
-void PrefProvider::SetClockForTesting(std::unique_ptr<base::Clock> clock) {
-  clock_ = std::move(clock);
-}
-
 void PrefProvider::Notify(
     const ContentSettingsPattern& primary_pattern,
     const ContentSettingsPattern& secondary_pattern,
@@ -250,6 +228,34 @@
     prefs_->Set(permission_autoblocker_data_pref, *old_dict);
   prefs_->ClearPref(prompt_no_decision_count_pref);
 #endif  // !defined(OS_IOS)
+
+  // TODO(timloh): See crbug.com/691893. This removal code was added in M58,
+  // so is probably fine to remove in M60 or later.
+  for (const WebsiteSettingsInfo* info :
+       *WebsiteSettingsRegistry::GetInstance()) {
+    if (!prefs_->GetDictionary(info->pref_name()))
+      continue;
+
+    DictionaryPrefUpdate update(prefs_, info->pref_name());
+    base::DictionaryValue* all_settings = update.Get();
+    std::vector<std::string> values_to_clean;
+    for (base::DictionaryValue::Iterator i(*all_settings); !i.IsAtEnd();
+         i.Advance()) {
+      const base::DictionaryValue* pattern_settings = nullptr;
+      bool is_dictionary = i.value().GetAsDictionary(&pattern_settings);
+      DCHECK(is_dictionary);
+      if (pattern_settings->GetWithoutPathExpansion(kObsoleteLastUsed, nullptr))
+        values_to_clean.push_back(i.key());
+    }
+
+    for (const std::string& key : values_to_clean) {
+      base::DictionaryValue* pattern_settings = nullptr;
+      all_settings->GetDictionaryWithoutPathExpansion(key, &pattern_settings);
+      pattern_settings->RemoveWithoutPathExpansion(kObsoleteLastUsed, nullptr);
+      if (pattern_settings->empty())
+        all_settings->RemoveWithoutPathExpansion(key, nullptr);
+    }
+  }
 }
 
 }  // namespace content_settings
diff --git a/components/content_settings/core/browser/content_settings_pref_provider.h b/components/content_settings/core/browser/content_settings_pref_provider.h
index 0c08dfc..9f33e158 100644
--- a/components/content_settings/core/browser/content_settings_pref_provider.h
+++ b/components/content_settings/core/browser/content_settings_pref_provider.h
@@ -18,10 +18,6 @@
 
 class PrefService;
 
-namespace base {
-class Clock;
-}
-
 namespace user_prefs {
 class PrefRegistrySyncable;
 }
@@ -57,20 +53,8 @@
 
   void ClearPrefs();
 
-  // Records the last time the given pattern has used a certain content setting.
-  void UpdateLastUsage(const ContentSettingsPattern& primary_pattern,
-                       const ContentSettingsPattern& secondary_pattern,
-                       ContentSettingsType content_type);
-
-  base::Time GetLastUsage(const ContentSettingsPattern& primary_pattern,
-                          const ContentSettingsPattern& secondary_pattern,
-                          ContentSettingsType content_type);
-
   ContentSettingsPref* GetPref(ContentSettingsType type) const;
 
-  // Gains ownership of |clock|.
-  void SetClockForTesting(std::unique_ptr<base::Clock> clock);
-
  private:
   friend class DeadlockCheckerObserver;  // For testing.
 
@@ -85,9 +69,6 @@
   // Weak; owned by the Profile and reset in ShutdownOnUIThread.
   PrefService* prefs_;
 
-  // Can be set for testing.
-  std::unique_ptr<base::Clock> clock_;
-
   const bool is_incognito_;
 
   PrefChangeRegistrar pref_change_registrar_;
diff --git a/components/content_settings/core/browser/host_content_settings_map.cc b/components/content_settings/core/browser/host_content_settings_map.cc
index 4ebb241f..4f263c02 100644
--- a/components/content_settings/core/browser/host_content_settings_map.cc
+++ b/components/content_settings/core/browser/host_content_settings_map.cc
@@ -464,11 +464,6 @@
     ContentSetting setting) {
   DCHECK(content_settings::ContentSettingsRegistry::GetInstance()->Get(
       content_type));
-  if (setting == CONTENT_SETTING_ALLOW &&
-      (content_type == CONTENT_SETTINGS_TYPE_GEOLOCATION ||
-       content_type == CONTENT_SETTINGS_TYPE_NOTIFICATIONS)) {
-    UpdateLastUsageByPattern(primary_pattern, secondary_pattern, content_type);
-  }
 
   std::unique_ptr<base::Value> value;
   // A value of CONTENT_SETTING_DEFAULT implies deleting the content setting.
@@ -640,63 +635,6 @@
   }
 }
 
-ContentSetting HostContentSettingsMap::GetContentSettingAndMaybeUpdateLastUsage(
-    const GURL& primary_url,
-    const GURL& secondary_url,
-    ContentSettingsType content_type,
-    const std::string& resource_identifier) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  ContentSetting setting = GetContentSetting(
-      primary_url, secondary_url, content_type, resource_identifier);
-  if (setting == CONTENT_SETTING_ALLOW) {
-    UpdateLastUsageByPattern(
-        ContentSettingsPattern::FromURLNoWildcard(primary_url),
-        ContentSettingsPattern::FromURLNoWildcard(secondary_url),
-        content_type);
-  }
-  return setting;
-}
-
-void HostContentSettingsMap::UpdateLastUsage(const GURL& primary_url,
-                                             const GURL& secondary_url,
-                                             ContentSettingsType content_type) {
-  UpdateLastUsageByPattern(
-      ContentSettingsPattern::FromURLNoWildcard(primary_url),
-      ContentSettingsPattern::FromURLNoWildcard(secondary_url),
-      content_type);
-}
-
-void HostContentSettingsMap::UpdateLastUsageByPattern(
-    const ContentSettingsPattern& primary_pattern,
-    const ContentSettingsPattern& secondary_pattern,
-    ContentSettingsType content_type) {
-  UsedContentSettingsProviders();
-
-  pref_provider_->UpdateLastUsage(
-      primary_pattern, secondary_pattern, content_type);
-}
-
-base::Time HostContentSettingsMap::GetLastUsage(
-    const GURL& primary_url,
-    const GURL& secondary_url,
-    ContentSettingsType content_type) {
-  return GetLastUsageByPattern(
-      ContentSettingsPattern::FromURLNoWildcard(primary_url),
-      ContentSettingsPattern::FromURLNoWildcard(secondary_url),
-      content_type);
-}
-
-base::Time HostContentSettingsMap::GetLastUsageByPattern(
-    const ContentSettingsPattern& primary_pattern,
-    const ContentSettingsPattern& secondary_pattern,
-    ContentSettingsType content_type) {
-  UsedContentSettingsProviders();
-
-  return pref_provider_->GetLastUsage(
-      primary_pattern, secondary_pattern, content_type);
-}
-
 void HostContentSettingsMap::AddObserver(content_settings::Observer* observer) {
   observers_.AddObserver(observer);
 }
@@ -710,13 +648,6 @@
   prefs_->SchedulePendingLossyWrites();
 }
 
-void HostContentSettingsMap::SetPrefClockForTesting(
-    std::unique_ptr<base::Clock> clock) {
-  UsedContentSettingsProviders();
-
-  pref_provider_->SetClockForTesting(std::move(clock));
-}
-
 void HostContentSettingsMap::ClearSettingsForOneType(
     ContentSettingsType content_type) {
   UsedContentSettingsProviders();
diff --git a/components/content_settings/core/browser/host_content_settings_map.h b/components/content_settings/core/browser/host_content_settings_map.h
index b74865a..eadf365 100644
--- a/components/content_settings/core/browser/host_content_settings_map.h
+++ b/components/content_settings/core/browser/host_content_settings_map.h
@@ -30,7 +30,6 @@
 class PrefService;
 
 namespace base {
-class Clock;
 class Value;
 }
 
@@ -248,42 +247,6 @@
     return is_incognito_;
   }
 
-  // Returns a single |ContentSetting| which applies to the given URLs, just as
-  // |GetContentSetting| does. If the setting is allowed, it also records the
-  // last usage to preferences.
-  //
-  // This should only be called on the UI thread, unlike |GetContentSetting|.
-  ContentSetting GetContentSettingAndMaybeUpdateLastUsage(
-      const GURL& primary_url,
-      const GURL& secondary_url,
-      ContentSettingsType content_type,
-      const std::string& resource_identifier);
-
-  // Sets the last time that a given content type has been used for the pattern
-  // which matches the URLs to the current time.
-  void UpdateLastUsage(const GURL& primary_url,
-                       const GURL& secondary_url,
-                       ContentSettingsType content_type);
-
-  // Sets the last time that a given content type has been used for a pattern
-  // pair to the current time.
-  void UpdateLastUsageByPattern(const ContentSettingsPattern& primary_pattern,
-                                const ContentSettingsPattern& secondary_pattern,
-                                ContentSettingsType content_type);
-
-  // Returns the last time the pattern that matches the URL has requested
-  // permission for the |content_type| setting.
-  base::Time GetLastUsage(const GURL& primary_url,
-                          const GURL& secondary_url,
-                          ContentSettingsType content_type);
-
-  // Returns the last time the pattern has requested permission for the
-  // |content_type| setting.
-  base::Time GetLastUsageByPattern(
-      const ContentSettingsPattern& primary_pattern,
-      const ContentSettingsPattern& secondary_pattern,
-      ContentSettingsType content_type);
-
   // Adds/removes an observer for content settings changes.
   void AddObserver(content_settings::Observer* observer);
   void RemoveObserver(content_settings::Observer* observer);
@@ -291,9 +254,6 @@
   // Schedules any pending lossy website settings to be written to disk.
   void FlushLossyWebsiteSettings();
 
-  // Passes ownership of |clock|.
-  void SetPrefClockForTesting(std::unique_ptr<base::Clock> clock);
-
   // Migrate old domain scoped ALLOW settings to be origin scoped for
   // ContentSettingsTypes which are domain scoped. Only narrow down ALLOW
   // domain settings to origins so that this will not cause privacy/security
diff --git a/components/policy/core/browser/configuration_policy_pref_store.cc b/components/policy/core/browser/configuration_policy_pref_store.cc
index 17ca01b..7d1a706 100644
--- a/components/policy/core/browser/configuration_policy_pref_store.cc
+++ b/components/policy/core/browser/configuration_policy_pref_store.cc
@@ -10,6 +10,7 @@
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
+#include "base/memory/ptr_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
@@ -79,6 +80,13 @@
   return true;
 }
 
+std::unique_ptr<base::DictionaryValue> ConfigurationPolicyPrefStore::GetValues()
+    const {
+  if (!prefs_)
+    return base::MakeUnique<base::DictionaryValue>();
+  return prefs_->AsDictionaryValue();
+}
+
 void ConfigurationPolicyPrefStore::OnPolicyUpdated(
     const PolicyNamespace& ns,
     const PolicyMap& previous,
diff --git a/components/policy/core/browser/configuration_policy_pref_store.h b/components/policy/core/browser/configuration_policy_pref_store.h
index 3d1ef9a..87e1992 100644
--- a/components/policy/core/browser/configuration_policy_pref_store.h
+++ b/components/policy/core/browser/configuration_policy_pref_store.h
@@ -44,6 +44,7 @@
   bool IsInitializationComplete() const override;
   bool GetValue(const std::string& key,
                 const base::Value** result) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
 
   // PolicyService::Observer methods:
   void OnPolicyUpdated(const PolicyNamespace& ns,
diff --git a/components/prefs/default_pref_store.cc b/components/prefs/default_pref_store.cc
index 468c11c..0e9c87c 100644
--- a/components/prefs/default_pref_store.cc
+++ b/components/prefs/default_pref_store.cc
@@ -17,6 +17,10 @@
   return prefs_.GetValue(key, result);
 }
 
+std::unique_ptr<base::DictionaryValue> DefaultPrefStore::GetValues() const {
+  return prefs_.AsDictionaryValue();
+}
+
 void DefaultPrefStore::AddObserver(PrefStore::Observer* observer) {
   observers_.AddObserver(observer);
 }
diff --git a/components/prefs/default_pref_store.h b/components/prefs/default_pref_store.h
index 3481713f..c06cd6c1 100644
--- a/components/prefs/default_pref_store.h
+++ b/components/prefs/default_pref_store.h
@@ -5,6 +5,7 @@
 #ifndef COMPONENTS_PREFS_DEFAULT_PREF_STORE_H_
 #define COMPONENTS_PREFS_DEFAULT_PREF_STORE_H_
 
+#include <memory>
 #include <string>
 
 #include "base/macros.h"
@@ -24,6 +25,7 @@
   // PrefStore implementation:
   bool GetValue(const std::string& key,
                 const base::Value** result) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
   void AddObserver(PrefStore::Observer* observer) override;
   void RemoveObserver(PrefStore::Observer* observer) override;
   bool HasObservers() const override;
diff --git a/components/prefs/in_memory_pref_store.cc b/components/prefs/in_memory_pref_store.cc
index d0d35582..a0a9c35 100644
--- a/components/prefs/in_memory_pref_store.cc
+++ b/components/prefs/in_memory_pref_store.cc
@@ -18,6 +18,10 @@
   return prefs_.GetValue(key, value);
 }
 
+std::unique_ptr<base::DictionaryValue> InMemoryPrefStore::GetValues() const {
+  return prefs_.AsDictionaryValue();
+}
+
 bool InMemoryPrefStore::GetMutableValue(const std::string& key,
                                         base::Value** value) {
   return prefs_.GetValue(key, value);
diff --git a/components/prefs/in_memory_pref_store.h b/components/prefs/in_memory_pref_store.h
index 042137c..5529622 100644
--- a/components/prefs/in_memory_pref_store.h
+++ b/components/prefs/in_memory_pref_store.h
@@ -26,6 +26,7 @@
   // PrefStore implementation.
   bool GetValue(const std::string& key,
                 const base::Value** result) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
   void AddObserver(PrefStore::Observer* observer) override;
   void RemoveObserver(PrefStore::Observer* observer) override;
   bool HasObservers() const override;
diff --git a/components/prefs/json_pref_store.cc b/components/prefs/json_pref_store.cc
index 026606a7..a9a3922 100644
--- a/components/prefs/json_pref_store.cc
+++ b/components/prefs/json_pref_store.cc
@@ -190,6 +190,10 @@
   return true;
 }
 
+std::unique_ptr<base::DictionaryValue> JsonPrefStore::GetValues() const {
+  return prefs_->CreateDeepCopy();
+}
+
 void JsonPrefStore::AddObserver(PrefStore::Observer* observer) {
   DCHECK(CalledOnValidThread());
 
diff --git a/components/prefs/json_pref_store.h b/components/prefs/json_pref_store.h
index 170ccb11..8c1164c 100644
--- a/components/prefs/json_pref_store.h
+++ b/components/prefs/json_pref_store.h
@@ -84,6 +84,7 @@
   // PrefStore overrides:
   bool GetValue(const std::string& key,
                 const base::Value** result) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
   void AddObserver(PrefStore::Observer* observer) override;
   void RemoveObserver(PrefStore::Observer* observer) override;
   bool HasObservers() const override;
diff --git a/components/prefs/overlay_user_pref_store.cc b/components/prefs/overlay_user_pref_store.cc
index 2b2208ed..ddc47c8 100644
--- a/components/prefs/overlay_user_pref_store.cc
+++ b/components/prefs/overlay_user_pref_store.cc
@@ -47,6 +47,24 @@
   return underlay_->GetValue(GetUnderlayKey(key), result);
 }
 
+std::unique_ptr<base::DictionaryValue> OverlayUserPrefStore::GetValues() const {
+  auto values = underlay_->GetValues();
+  auto overlay_values = overlay_.AsDictionaryValue();
+  for (const auto& overlay_mapping : overlay_to_underlay_names_map_) {
+    const std::string& overlay_key = overlay_mapping.first;
+    const std::string& underlay_key = overlay_mapping.second;
+    std::unique_ptr<base::Value> out_value;
+    if (overlay_key != underlay_key) {
+      values->Remove(underlay_key, &out_value);
+    }
+    overlay_values->Remove(overlay_key, &out_value);
+    if (out_value) {
+      values->Set(overlay_key, std::move(out_value));
+    }
+  }
+  return values;
+}
+
 bool OverlayUserPrefStore::GetMutableValue(const std::string& key,
                                            base::Value** result) {
   if (!ShallBeStoredInOverlay(key))
diff --git a/components/prefs/overlay_user_pref_store.h b/components/prefs/overlay_user_pref_store.h
index e3ad88e..7d9eb307 100644
--- a/components/prefs/overlay_user_pref_store.h
+++ b/components/prefs/overlay_user_pref_store.h
@@ -38,6 +38,7 @@
   bool IsInitializationComplete() const override;
   bool GetValue(const std::string& key,
                 const base::Value** result) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
 
   // Methods of PersistentPrefStore.
   bool GetMutableValue(const std::string& key, base::Value** result) override;
diff --git a/components/prefs/overlay_user_pref_store_unittest.cc b/components/prefs/overlay_user_pref_store_unittest.cc
index d722aea..20cdb17 100644
--- a/components/prefs/overlay_user_pref_store_unittest.cc
+++ b/components/prefs/overlay_user_pref_store_unittest.cc
@@ -19,9 +19,11 @@
 
 const char kBrowserWindowPlacement[] = "browser.window_placement";
 const char kShowBookmarkBar[] = "bookmark_bar.show_on_all_tabs";
+const char kSharedKey[] = "sync_promo.show_on_first_run_allowed";
 
 const char* const overlay_key = kBrowserWindowPlacement;
 const char* const regular_key = kShowBookmarkBar;
+const char* const shared_key = kSharedKey;
 // With the removal of the kWebKitGlobalXXX prefs, we'll no longer have real
 // prefs using the overlay pref store, so make up keys here.
 const char mapped_overlay_key[] = "test.per_tab.javascript_enabled";
@@ -35,6 +37,7 @@
       : underlay_(new TestingPrefStore()),
         overlay_(new OverlayUserPrefStore(underlay_.get())) {
     overlay_->RegisterOverlayPref(overlay_key);
+    overlay_->RegisterOverlayPref(shared_key);
     overlay_->RegisterOverlayPref(mapped_overlay_key, mapped_underlay_key);
   }
 
@@ -309,4 +312,42 @@
   EXPECT_TRUE(base::FundamentalValue(42).Equals(value));
 }
 
+TEST_F(OverlayUserPrefStoreTest, GetValues) {
+  // To check merge behavior, create underlay and overlay so each has a key the
+  // other doesn't have and they have one key in common.
+  underlay_->SetValue(regular_key, base::WrapUnique(new FundamentalValue(42)),
+                      WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  overlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(43)),
+                     WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  underlay_->SetValue(shared_key, base::WrapUnique(new FundamentalValue(42)),
+                      WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  overlay_->SetValue(shared_key, base::WrapUnique(new FundamentalValue(43)),
+                     WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  underlay_->SetValue(mapped_underlay_key,
+                      base::WrapUnique(new FundamentalValue(42)),
+                      WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  overlay_->SetValue(mapped_overlay_key,
+                     base::WrapUnique(new FundamentalValue(43)),
+                     WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+
+  auto values = overlay_->GetValues();
+  const Value* value = nullptr;
+  // Check that an overlay preference is returned.
+  ASSERT_TRUE(values->Get(overlay_key, &value));
+  EXPECT_TRUE(base::FundamentalValue(43).Equals(value));
+
+  // Check that an underlay preference is returned.
+  ASSERT_TRUE(values->Get(regular_key, &value));
+  EXPECT_TRUE(base::FundamentalValue(42).Equals(value));
+
+  // Check that the overlay is preferred.
+  ASSERT_TRUE(values->Get(shared_key, &value));
+  EXPECT_TRUE(base::FundamentalValue(43).Equals(value));
+
+  // Check that mapping works.
+  ASSERT_TRUE(values->Get(mapped_overlay_key, &value));
+  EXPECT_TRUE(base::FundamentalValue(43).Equals(value));
+  EXPECT_FALSE(values->Get(mapped_underlay_key, &value));
+}
+
 }  // namespace base
diff --git a/components/prefs/pref_store.h b/components/prefs/pref_store.h
index ef2bc49..7964f1f0 100644
--- a/components/prefs/pref_store.h
+++ b/components/prefs/pref_store.h
@@ -5,6 +5,7 @@
 #ifndef COMPONENTS_PREFS_PREF_STORE_H_
 #define COMPONENTS_PREFS_PREF_STORE_H_
 
+#include <memory>
 #include <string>
 
 #include "base/macros.h"
@@ -12,6 +13,7 @@
 #include "components/prefs/base_prefs_export.h"
 
 namespace base {
+class DictionaryValue;
 class Value;
 }
 
@@ -52,6 +54,9 @@
   virtual bool GetValue(const std::string& key,
                         const base::Value** result) const = 0;
 
+  // Get all the values. Never returns a null pointer.
+  virtual std::unique_ptr<base::DictionaryValue> GetValues() const = 0;
+
  protected:
   friend class base::RefCounted<PrefStore>;
   virtual ~PrefStore() {}
diff --git a/components/prefs/pref_value_map.cc b/components/prefs/pref_value_map.cc
index f0392d25..ecacf4c7 100644
--- a/components/prefs/pref_value_map.cc
+++ b/components/prefs/pref_value_map.cc
@@ -157,3 +157,11 @@
   for ( ; other_pref != other_prefs.end(); ++other_pref)
       differing_keys->push_back(other_pref->first);
 }
+
+std::unique_ptr<base::DictionaryValue> PrefValueMap::AsDictionaryValue() const {
+  auto dictionary = base::MakeUnique<base::DictionaryValue>();
+  for (const auto& value : prefs_) {
+    dictionary->Set(value.first, value.second->CreateDeepCopy());
+  }
+  return dictionary;
+}
diff --git a/components/prefs/pref_value_map.h b/components/prefs/pref_value_map.h
index b0ffbd1..bad10cf 100644
--- a/components/prefs/pref_value_map.h
+++ b/components/prefs/pref_value_map.h
@@ -14,6 +14,7 @@
 #include "components/prefs/base_prefs_export.h"
 
 namespace base {
+class DictionaryValue;
 class Value;
 }
 
@@ -83,6 +84,9 @@
   void GetDifferingKeys(const PrefValueMap* other,
                         std::vector<std::string>* differing_keys) const;
 
+  // Copies the map into a dictionary value.
+  std::unique_ptr<base::DictionaryValue> AsDictionaryValue() const;
+
  private:
   Map prefs_;
 
diff --git a/components/prefs/testing_pref_store.cc b/components/prefs/testing_pref_store.cc
index 1e77582..d084c4a 100644
--- a/components/prefs/testing_pref_store.cc
+++ b/components/prefs/testing_pref_store.cc
@@ -24,6 +24,10 @@
   return prefs_.GetValue(key, value);
 }
 
+std::unique_ptr<base::DictionaryValue> TestingPrefStore::GetValues() const {
+  return prefs_.AsDictionaryValue();
+}
+
 bool TestingPrefStore::GetMutableValue(const std::string& key,
                                        base::Value** value) {
   return prefs_.GetValue(key, value);
diff --git a/components/prefs/testing_pref_store.h b/components/prefs/testing_pref_store.h
index 2bf2c8f..2e685e4 100644
--- a/components/prefs/testing_pref_store.h
+++ b/components/prefs/testing_pref_store.h
@@ -25,6 +25,7 @@
   // Overriden from PrefStore.
   bool GetValue(const std::string& key,
                 const base::Value** result) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
   void AddObserver(PrefStore::Observer* observer) override;
   void RemoveObserver(PrefStore::Observer* observer) override;
   bool HasObservers() const override;
diff --git a/components/prefs/value_map_pref_store.cc b/components/prefs/value_map_pref_store.cc
index 8b828b1..c31d7c7 100644
--- a/components/prefs/value_map_pref_store.cc
+++ b/components/prefs/value_map_pref_store.cc
@@ -17,6 +17,10 @@
   return prefs_.GetValue(key, value);
 }
 
+std::unique_ptr<base::DictionaryValue> ValueMapPrefStore::GetValues() const {
+  return prefs_.AsDictionaryValue();
+}
+
 void ValueMapPrefStore::AddObserver(PrefStore::Observer* observer) {
   observers_.AddObserver(observer);
 }
diff --git a/components/prefs/value_map_pref_store.h b/components/prefs/value_map_pref_store.h
index 8310a9b..34d1095 100644
--- a/components/prefs/value_map_pref_store.h
+++ b/components/prefs/value_map_pref_store.h
@@ -25,6 +25,7 @@
   // PrefStore overrides:
   bool GetValue(const std::string& key,
                 const base::Value** value) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
   void AddObserver(PrefStore::Observer* observer) override;
   void RemoveObserver(PrefStore::Observer* observer) override;
   bool HasObservers() const override;
diff --git a/components/user_prefs/tracked/segregated_pref_store.cc b/components/user_prefs/tracked/segregated_pref_store.cc
index edb1f20..297e2a7e 100644
--- a/components/user_prefs/tracked/segregated_pref_store.cc
+++ b/components/user_prefs/tracked/segregated_pref_store.cc
@@ -83,6 +83,20 @@
   return StoreForKey(key)->GetValue(key, result);
 }
 
+std::unique_ptr<base::DictionaryValue> SegregatedPrefStore::GetValues() const {
+  auto values = default_pref_store_->GetValues();
+  auto selected_pref_store_values = selected_pref_store_->GetValues();
+  for (const auto& key : selected_preference_names_) {
+    const base::Value* value = nullptr;
+    if (selected_pref_store_values->Get(key, &value)) {
+      values->Set(key, value->CreateDeepCopy());
+    } else {
+      values->Remove(key, nullptr);
+    }
+  }
+  return values;
+}
+
 void SegregatedPrefStore::SetValue(const std::string& key,
                                    std::unique_ptr<base::Value> value,
                                    uint32_t flags) {
diff --git a/components/user_prefs/tracked/segregated_pref_store.h b/components/user_prefs/tracked/segregated_pref_store.h
index 016cca6..4062976 100644
--- a/components/user_prefs/tracked/segregated_pref_store.h
+++ b/components/user_prefs/tracked/segregated_pref_store.h
@@ -52,6 +52,7 @@
   bool IsInitializationComplete() const override;
   bool GetValue(const std::string& key,
                 const base::Value** result) const override;
+  std::unique_ptr<base::DictionaryValue> GetValues() const override;
 
   // WriteablePrefStore implementation
   void SetValue(const std::string& key,
diff --git a/components/user_prefs/tracked/segregated_pref_store_unittest.cc b/components/user_prefs/tracked/segregated_pref_store_unittest.cc
index 5d32d02..4c685cc 100644
--- a/components/user_prefs/tracked/segregated_pref_store_unittest.cc
+++ b/components/user_prefs/tracked/segregated_pref_store_unittest.cc
@@ -24,6 +24,7 @@
 
 const char kSelectedPref[] = "selected_pref";
 const char kUnselectedPref[] = "unselected_pref";
+const char kSharedPref[] = "shared_pref";
 
 const char kValue1[] = "value1";
 const char kValue2[] = "value2";
@@ -70,6 +71,7 @@
 
     std::set<std::string> selected_pref_names;
     selected_pref_names.insert(kSelectedPref);
+    selected_pref_names.insert(kSharedPref);
 
     segregated_store_ = new SegregatedPrefStore(default_store_, selected_store_,
                                                 selected_pref_names);
@@ -274,3 +276,31 @@
   default_store_->SetBlockAsyncRead(false);
   EXPECT_TRUE(segregated_store_->IsInitializationComplete());
 }
+
+TEST_F(SegregatedPrefStoreTest, GetValues) {
+  // To check merge behavior, create selected and default stores so each has a
+  // key the other doesn't have and they have one key in common.
+  selected_store_->SetValue(kSelectedPref,
+                            base::MakeUnique<base::StringValue>(kValue1),
+                            WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  default_store_->SetValue(kUnselectedPref,
+                           base::MakeUnique<base::StringValue>(kValue2),
+                           WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  selected_store_->SetValue(kSharedPref,
+                            base::MakeUnique<base::StringValue>(kValue1),
+                            WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+
+  auto values = segregated_store_->GetValues();
+  const base::Value* value = nullptr;
+  // Check that a selected preference is returned.
+  ASSERT_TRUE(values->Get(kSelectedPref, &value));
+  EXPECT_TRUE(base::FundamentalValue(kValue1).Equals(value));
+
+  // Check that a a default preference is returned.
+  ASSERT_TRUE(values->Get(kUnselectedPref, &value));
+  EXPECT_TRUE(base::FundamentalValue(kValue2).Equals(value));
+
+  // Check that the selected preference is preferred.
+  ASSERT_TRUE(values->Get(kSharedPref, &value));
+  EXPECT_TRUE(base::FundamentalValue(kValue1).Equals(value));
+}
diff --git a/content/browser/accessibility/accessibility_win_browsertest.cc b/content/browser/accessibility/accessibility_win_browsertest.cc
index 21e96d8..729b2e8f 100644
--- a/content/browser/accessibility/accessibility_win_browsertest.cc
+++ b/content/browser/accessibility/accessibility_win_browsertest.cc
@@ -1162,6 +1162,123 @@
   EXPECT_EQ(0, caret_offset);
 }
 
+IN_PROC_BROWSER_TEST_F(AccessibilityWinBrowserTest, TestSetSelection) {
+  base::win::ScopedComPtr<IAccessibleText> input_text;
+  SetUpInputField(&input_text);
+
+  LONG start_offset, end_offset;
+  EXPECT_HRESULT_FAILED(
+      input_text->get_selection(1, &start_offset, &end_offset));
+  HRESULT hr = input_text->get_selection(0, &start_offset, &end_offset);
+  // There is no selection, just a caret.
+  EXPECT_EQ(E_INVALIDARG, hr);
+
+  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
+                                         ACCESSIBILITY_MODE_COMPLETE,
+                                         ui::AX_EVENT_TEXT_SELECTION_CHANGED);
+  start_offset = 0;
+  end_offset = CONTENTS_LENGTH;
+  EXPECT_HRESULT_FAILED(input_text->setSelection(1, start_offset, end_offset));
+  EXPECT_HRESULT_SUCCEEDED(
+      input_text->setSelection(0, start_offset, end_offset));
+  waiter.WaitForNotification();
+
+  hr = input_text->get_selection(0, &start_offset, &end_offset);
+  EXPECT_EQ(S_OK, hr);
+  EXPECT_EQ(0, start_offset);
+  EXPECT_EQ(CONTENTS_LENGTH, end_offset);
+
+  start_offset = CONTENTS_LENGTH;
+  end_offset = 1;
+  EXPECT_HRESULT_SUCCEEDED(
+      input_text->setSelection(0, start_offset, end_offset));
+  waiter.WaitForNotification();
+
+  hr = input_text->get_selection(0, &start_offset, &end_offset);
+  EXPECT_EQ(S_OK, hr);
+  // Start and end offsets are always swapped to be in ascending order.
+  EXPECT_EQ(1, start_offset);
+  EXPECT_EQ(CONTENTS_LENGTH, end_offset);
+}
+
+IN_PROC_BROWSER_TEST_F(AccessibilityWinBrowserTest, TestMultiLineSetSelection) {
+  base::win::ScopedComPtr<IAccessibleText> textarea_text;
+  SetUpTextareaField(&textarea_text);
+
+  LONG start_offset, end_offset;
+  EXPECT_HRESULT_FAILED(
+      textarea_text->get_selection(1, &start_offset, &end_offset));
+  HRESULT hr = textarea_text->get_selection(0, &start_offset, &end_offset);
+  // There is no selection, just a caret.
+  EXPECT_EQ(E_INVALIDARG, hr);
+
+  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
+                                         ACCESSIBILITY_MODE_COMPLETE,
+                                         ui::AX_EVENT_TEXT_SELECTION_CHANGED);
+  start_offset = 0;
+  end_offset = CONTENTS_LENGTH;
+  EXPECT_HRESULT_FAILED(
+      textarea_text->setSelection(1, start_offset, end_offset));
+  EXPECT_HRESULT_SUCCEEDED(
+      textarea_text->setSelection(0, start_offset, end_offset));
+  waiter.WaitForNotification();
+
+  hr = textarea_text->get_selection(0, &start_offset, &end_offset);
+  EXPECT_EQ(S_OK, hr);
+  EXPECT_EQ(0, start_offset);
+  EXPECT_EQ(CONTENTS_LENGTH, end_offset);
+
+  start_offset = CONTENTS_LENGTH - 1;
+  end_offset = 0;
+  EXPECT_HRESULT_SUCCEEDED(
+      textarea_text->setSelection(0, start_offset, end_offset));
+  waiter.WaitForNotification();
+
+  hr = textarea_text->get_selection(0, &start_offset, &end_offset);
+  EXPECT_EQ(S_OK, hr);
+  // Start and end offsets are always swapped to be in ascending order.
+  EXPECT_EQ(0, start_offset);
+  EXPECT_EQ(CONTENTS_LENGTH - 1, end_offset);
+}
+
+IN_PROC_BROWSER_TEST_F(AccessibilityWinBrowserTest,
+                       TestStaticTextSetSelection) {
+  base::win::ScopedComPtr<IAccessibleText> paragraph_text;
+  SetUpSampleParagraph(&paragraph_text);
+
+  LONG n_characters;
+  ASSERT_HRESULT_SUCCEEDED(paragraph_text->get_nCharacters(&n_characters));
+  ASSERT_LT(0, n_characters);
+
+  AccessibilityNotificationWaiter waiter(
+      shell()->web_contents(), ACCESSIBILITY_MODE_COMPLETE,
+      ui::AX_EVENT_DOCUMENT_SELECTION_CHANGED);
+  LONG start_offset = 0;
+  LONG end_offset = n_characters;
+  EXPECT_HRESULT_FAILED(
+      paragraph_text->setSelection(1, start_offset, end_offset));
+  EXPECT_HRESULT_SUCCEEDED(
+      paragraph_text->setSelection(0, start_offset, end_offset));
+  waiter.WaitForNotification();
+
+  HRESULT hr = paragraph_text->get_selection(0, &start_offset, &end_offset);
+  EXPECT_EQ(S_OK, hr);
+  EXPECT_EQ(0, start_offset);
+  EXPECT_EQ(n_characters, end_offset);
+
+  start_offset = n_characters - 1;
+  end_offset = 0;
+  EXPECT_HRESULT_SUCCEEDED(
+      paragraph_text->setSelection(0, start_offset, end_offset));
+  waiter.WaitForNotification();
+
+  hr = paragraph_text->get_selection(0, &start_offset, &end_offset);
+  EXPECT_EQ(S_OK, hr);
+  // Start and end offsets are always swapped to be in ascending order.
+  EXPECT_EQ(0, start_offset);
+  EXPECT_EQ(n_characters - 1, end_offset);
+}
+
 IN_PROC_BROWSER_TEST_F(AccessibilityWinBrowserTest,
                        TestTextAtOffsetWithInvalidArguments) {
   base::win::ScopedComPtr<IAccessibleText> input_text;
diff --git a/content/browser/accessibility/ax_platform_position.cc b/content/browser/accessibility/ax_platform_position.cc
index f475f67..9b90de31 100644
--- a/content/browser/accessibility/ax_platform_position.cc
+++ b/content/browser/accessibility/ax_platform_position.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/accessibility/ax_platform_position.h"
 
+#include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "ui/accessibility/ax_enums.h"
 
diff --git a/content/browser/accessibility/ax_platform_position.h b/content/browser/accessibility/ax_platform_position.h
index 83f18b6..d244f41e 100644
--- a/content/browser/accessibility/ax_platform_position.h
+++ b/content/browser/accessibility/ax_platform_position.h
@@ -11,11 +11,12 @@
 
 #include "base/strings/string16.h"
 #include "content/browser/accessibility/ax_tree_id_registry.h"
-#include "content/browser/accessibility/browser_accessibility.h"
 #include "ui/accessibility/ax_position.h"
 
 namespace content {
 
+class BrowserAccessibility;
+
 using AXTreeID = content::AXTreeIDRegistry::AXTreeID;
 
 class AXPlatformPosition
diff --git a/content/browser/accessibility/browser_accessibility.cc b/content/browser/accessibility/browser_accessibility.cc
index ca778a4..22518632 100644
--- a/content/browser/accessibility/browser_accessibility.cc
+++ b/content/browser/accessibility/browser_accessibility.cc
@@ -1141,6 +1141,13 @@
   return node()->GetOrComputeLineStartOffsets();
 }
 
+BrowserAccessibility::AXPlatformPositionInstance
+BrowserAccessibility::CreatePositionAt(int offset) const {
+  DCHECK(manager_);
+  return AXPlatformPosition::CreateTextPosition(
+      manager_->ax_tree_id(), GetId(), offset, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+}
+
 base::string16 BrowserAccessibility::GetInnerText() const {
   if (IsTextOnlyObject())
     return GetString16Attribute(ui::AX_ATTR_NAME);
diff --git a/content/browser/accessibility/browser_accessibility.h b/content/browser/accessibility/browser_accessibility.h
index 4a785e5..e9f2e3a2 100644
--- a/content/browser/accessibility/browser_accessibility.h
+++ b/content/browser/accessibility/browser_accessibility.h
@@ -15,10 +15,12 @@
 #include "base/strings/string16.h"
 #include "base/strings/string_split.h"
 #include "build/build_config.h"
+#include "content/browser/accessibility/ax_platform_position.h"
 #include "content/common/content_export.h"
 #include "third_party/WebKit/public/web/WebAXEnums.h"
 #include "ui/accessibility/ax_node.h"
 #include "ui/accessibility/ax_node_data.h"
+#include "ui/accessibility/ax_range.h"
 #include "ui/accessibility/ax_text_utils.h"
 
 // Set PLATFORM_HAS_NATIVE_ACCESSIBILITY_IMPL if this platform has
@@ -353,10 +355,19 @@
   // to compute a name from its descendants.
   std::string ComputeAccessibleNameFromDescendants();
 
+  // Creates a position rooted at this object.
+  // This is a text position on all platforms except IA2 and ATK, where tree
+  // positions are created for non-text objects representing hypertext offsets.
+  virtual AXPlatformPosition::AXPositionInstance CreatePositionAt(
+      int offset) const;
+
   // Gets the text offsets where new lines start.
   std::vector<int> GetLineStartOffsets() const;
 
  protected:
+  using AXPlatformPositionInstance = AXPlatformPosition::AXPositionInstance;
+  using AXPlatformRange = ui::AXRange<AXPlatformPositionInstance::element_type>;
+
   BrowserAccessibility();
 
   // The manager of this tree of accessibility objects.
diff --git a/content/browser/accessibility/browser_accessibility_cocoa.mm b/content/browser/accessibility/browser_accessibility_cocoa.mm
index 9e76be17..930502b 100644
--- a/content/browser/accessibility/browser_accessibility_cocoa.mm
+++ b/content/browser/accessibility/browser_accessibility_cocoa.mm
@@ -959,8 +959,7 @@
   if (!root)
     return nil;
 
-  AXPlatformPositionInstance position =
-      CreateTextPosition(*root, 0, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+  AXPlatformPositionInstance position = root->CreatePositionAt(0);
   return CreateTextMarker(position->CreatePositionAtEndOfAnchor());
 }
 
@@ -1726,8 +1725,7 @@
   if (!root)
     return nil;
 
-  AXPlatformPositionInstance position =
-      CreateTextPosition(*root, 0, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+  AXPlatformPositionInstance position = root->CreatePositionAt(0);
   return CreateTextMarker(position->CreatePositionAtStartOfAnchor());
 }
 
@@ -2135,8 +2133,8 @@
   }
 
   if ([attribute isEqualToString:@"AXTextMarkerRangeForUIElement"]) {
-    AXPlatformPositionInstance startPosition = CreateTextPosition(
-        *browserAccessibility_, 0, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+    AXPlatformPositionInstance startPosition =
+        browserAccessibility_->CreatePositionAt(0);
     AXPlatformPositionInstance endPosition =
         startPosition->CreatePositionAtEndOfAnchor();
     AXPlatformRange range =
@@ -2834,8 +2832,9 @@
   if ([attribute isEqualToString:NSAccessibilitySelectedTextRangeAttribute]) {
     NSRange range = [(NSValue*)value rangeValue];
     BrowserAccessibilityManager* manager = browserAccessibility_->manager();
-    manager->SetTextSelection(
-        *browserAccessibility_, range.location, range.location + range.length);
+    manager->SetSelection(AXPlatformRange(
+        browserAccessibility_->CreatePositionAt(range.location),
+        browserAccessibility_->CreatePositionAt(NSMaxRange(range))));
   }
 }
 
diff --git a/content/browser/accessibility/browser_accessibility_manager.cc b/content/browser/accessibility/browser_accessibility_manager.cc
index 15e4bd22..ad4e430 100644
--- a/content/browser/accessibility/browser_accessibility_manager.cc
+++ b/content/browser/accessibility/browser_accessibility_manager.cc
@@ -688,18 +688,15 @@
   delegate_->AccessibilityPerformAction(action_data);
 }
 
-void BrowserAccessibilityManager::SetTextSelection(
-    const BrowserAccessibility& node,
-    int start_offset,
-    int end_offset) {
-  if (!delegate_)
+void BrowserAccessibilityManager::SetSelection(AXPlatformRange range) {
+  if (!delegate_ || range.IsNull())
     return;
 
   ui::AXActionData action_data;
-  action_data.anchor_node_id = node.GetId();
-  action_data.anchor_offset = start_offset;
-  action_data.focus_node_id = node.GetId();
-  action_data.focus_offset = end_offset;
+  action_data.anchor_node_id = range.anchor()->anchor_id();
+  action_data.anchor_offset = range.anchor()->text_offset();
+  action_data.focus_node_id = range.focus()->anchor_id();
+  action_data.focus_offset = range.focus()->text_offset();
   action_data.action = ui::AX_ACTION_SET_SELECTION;
   delegate_->AccessibilityPerformAction(action_data);
 }
diff --git a/content/browser/accessibility/browser_accessibility_manager.h b/content/browser/accessibility/browser_accessibility_manager.h
index 84bb687..1eae5fa 100644
--- a/content/browser/accessibility/browser_accessibility_manager.h
+++ b/content/browser/accessibility/browser_accessibility_manager.h
@@ -14,6 +14,7 @@
 #include "base/containers/hash_tables.h"
 #include "base/macros.h"
 #include "build/build_config.h"
+#include "content/browser/accessibility/ax_platform_position.h"
 #include "content/browser/accessibility/ax_tree_id_registry.h"
 #include "content/browser/accessibility/browser_accessibility_event.h"
 #include "content/common/content_export.h"
@@ -21,6 +22,7 @@
 #include "third_party/WebKit/public/web/WebAXEnums.h"
 #include "ui/accessibility/ax_action_data.h"
 #include "ui/accessibility/ax_node_data.h"
+#include "ui/accessibility/ax_range.h"
 #include "ui/accessibility/ax_serializable_tree.h"
 #include "ui/accessibility/ax_tree_update.h"
 #include "ui/gfx/native_widget_types.h"
@@ -198,8 +200,8 @@
   void SetScrollOffset(const BrowserAccessibility& node, gfx::Point offset);
   void SetValue(
       const BrowserAccessibility& node, const base::string16& value);
-  void SetTextSelection(
-      const BrowserAccessibility& node, int start_offset, int end_offset);
+  void SetSelection(
+      ui::AXRange<AXPlatformPosition::AXPositionInstance::element_type> range);
   void SetAccessibilityFocus(const BrowserAccessibility& node);
   void ShowContextMenu(const BrowserAccessibility& node);
 
@@ -372,6 +374,9 @@
   void CacheHitTestResult(BrowserAccessibility* hit_test_result);
 
  protected:
+  using AXPlatformPositionInstance = AXPlatformPosition::AXPositionInstance;
+  using AXPlatformRange = ui::AXRange<AXPlatformPositionInstance::element_type>;
+
   BrowserAccessibilityManager(
       BrowserAccessibilityDelegate* delegate,
       BrowserAccessibilityFactory* factory);
diff --git a/content/browser/accessibility/browser_accessibility_manager_android.cc b/content/browser/accessibility/browser_accessibility_manager_android.cc
index 3f7121b5..1c405791 100644
--- a/content/browser/accessibility/browser_accessibility_manager_android.cc
+++ b/content/browser/accessibility/browser_accessibility_manager_android.cc
@@ -654,8 +654,10 @@
     jint start,
     jint end) {
   BrowserAccessibilityAndroid* node = GetFromUniqueID(id);
-  if (node)
-    node->manager()->SetTextSelection(*node, start, end);
+  if (node) {
+    node->manager()->SetSelection(AXPlatformRange(node->CreatePositionAt(start),
+                                                  node->CreatePositionAt(end)));
+  }
 }
 
 jboolean BrowserAccessibilityManagerAndroid::AdjustSlider(
diff --git a/content/browser/accessibility/browser_accessibility_win.cc b/content/browser/accessibility/browser_accessibility_win.cc
index 322f0e2..5ccbc393 100644
--- a/content/browser/accessibility/browser_accessibility_win.cc
+++ b/content/browser/accessibility/browser_accessibility_win.cc
@@ -433,7 +433,7 @@
   if (!target->HasIntAttribute(ui::AX_ATTR_ACTION))
     return DISP_E_MEMBERNOTFOUND;
 
-  manager()->DoDefaultAction(*target);
+  manager_->DoDefaultAction(*target);
   return S_OK;
 }
 
@@ -454,7 +454,7 @@
     return S_FALSE;
   }
 
-  BrowserAccessibility* result = manager()->CachingAsyncHitTest(point);
+  BrowserAccessibility* result = manager_->CachingAsyncHitTest(point);
   if (result == this) {
     // Point is within this object.
     child->vt = VT_I4;
@@ -620,8 +620,8 @@
   if (!focus_child)
     return E_INVALIDARG;
 
-  BrowserAccessibilityWin* focus = static_cast<BrowserAccessibilityWin*>(
-      manager()->GetFocus());
+  BrowserAccessibilityWin* focus =
+      static_cast<BrowserAccessibilityWin*>(manager_->GetFocus());
   if (focus == this) {
     focus_child->vt = VT_I4;
     focus_child->lVal = CHILDID_SELF;
@@ -711,7 +711,7 @@
     // This happens if we're the root of the tree;
     // return the IAccessible for the window.
     parent_obj =
-        manager()->ToBrowserAccessibilityManagerWin()->GetParentIAccessible();
+        manager_->ToBrowserAccessibilityManagerWin()->GetParentIAccessible();
     // |parent| can only be NULL if the manager was created before the parent
     // IAccessible was known and it wasn't subsequently set before a client
     // requested it. This has been fixed. |parent| may also be NULL during
@@ -766,7 +766,7 @@
 
   state->vt = VT_I4;
   state->lVal = target->ia_state();
-  if (manager()->GetFocus() == this)
+  if (manager_->GetFocus() == this)
     state->lVal |= STATE_SYSTEM_FOCUSED;
 
   return S_OK;
@@ -878,7 +878,7 @@
     return E_FAIL;
 
   if (flags_sel & SELFLAG_TAKEFOCUS) {
-    manager()->SetFocus(*this);
+    manager_->SetFocus(*this);
     return S_OK;
   }
 
@@ -967,7 +967,7 @@
     return E_INVALIDARG;
 
   *window_handle =
-      manager()->ToBrowserAccessibilityManagerWin()->GetParentHWND();
+      manager_->ToBrowserAccessibilityManagerWin()->GetParentHWND();
   if (!*window_handle)
     return E_FAIL;
 
@@ -1053,31 +1053,31 @@
   gfx::Rect r = GetFrameBoundsRect();
   switch(scroll_type) {
     case IA2_SCROLL_TYPE_TOP_LEFT:
-      manager()->ScrollToMakeVisible(*this, gfx::Rect(r.x(), r.y(), 0, 0));
+      manager_->ScrollToMakeVisible(*this, gfx::Rect(r.x(), r.y(), 0, 0));
       break;
     case IA2_SCROLL_TYPE_BOTTOM_RIGHT:
-      manager()->ScrollToMakeVisible(
-          *this, gfx::Rect(r.right(), r.bottom(), 0, 0));
+      manager_->ScrollToMakeVisible(*this,
+                                    gfx::Rect(r.right(), r.bottom(), 0, 0));
       break;
     case IA2_SCROLL_TYPE_TOP_EDGE:
-      manager()->ScrollToMakeVisible(
-          *this, gfx::Rect(r.x(), r.y(), r.width(), 0));
+      manager_->ScrollToMakeVisible(*this,
+                                    gfx::Rect(r.x(), r.y(), r.width(), 0));
       break;
     case IA2_SCROLL_TYPE_BOTTOM_EDGE:
-      manager()->ScrollToMakeVisible(
-          *this, gfx::Rect(r.x(), r.bottom(), r.width(), 0));
-    break;
+      manager_->ScrollToMakeVisible(*this,
+                                    gfx::Rect(r.x(), r.bottom(), r.width(), 0));
+      break;
     case IA2_SCROLL_TYPE_LEFT_EDGE:
-      manager()->ScrollToMakeVisible(
-          *this, gfx::Rect(r.x(), r.y(), 0, r.height()));
+      manager_->ScrollToMakeVisible(*this,
+                                    gfx::Rect(r.x(), r.y(), 0, r.height()));
       break;
     case IA2_SCROLL_TYPE_RIGHT_EDGE:
-      manager()->ScrollToMakeVisible(
-          *this, gfx::Rect(r.right(), r.y(), 0, r.height()));
+      manager_->ScrollToMakeVisible(*this,
+                                    gfx::Rect(r.right(), r.y(), 0, r.height()));
       break;
     case IA2_SCROLL_TYPE_ANYWHERE:
     default:
-      manager()->ScrollToMakeVisible(*this, r);
+      manager_->ScrollToMakeVisible(*this, r);
       break;
   }
 
@@ -1095,7 +1095,7 @@
   gfx::Point scroll_to(x, y);
 
   if (coordinate_type == IA2_COORDTYPE_SCREEN_RELATIVE) {
-    scroll_to -= manager()->GetViewBounds().OffsetFromOrigin();
+    scroll_to -= manager_->GetViewBounds().OffsetFromOrigin();
   } else if (coordinate_type == IA2_COORDTYPE_PARENT_RELATIVE) {
     if (GetParent())
       scroll_to += GetParent()->GetFrameBoundsRect().OffsetFromOrigin();
@@ -1103,7 +1103,7 @@
     return E_INVALIDARG;
   }
 
-  manager()->ScrollToPoint(*this, scroll_to);
+  manager_->ScrollToPoint(*this, scroll_to);
 
   return S_OK;
 }
@@ -2074,7 +2074,7 @@
   int index = 0;
   for (int i = 0; i < rows; ++i) {
     int cell_id = cell_ids[i * columns + column];
-    BrowserAccessibility* cell = manager()->GetFromID(cell_id);
+    BrowserAccessibility* cell = manager_->GetFromID(cell_id);
     if (cell && cell->GetRole() == ui::AX_ROLE_COLUMN_HEADER) {
       (*cell_accessibles)[index] = static_cast<IAccessible*>(
           ToBrowserAccessibilityWin(cell)->NewReference());
@@ -2167,7 +2167,7 @@
 
   for (int i = 0; i < columns; ++i) {
     int cell_id = cell_ids[row * columns + i];
-    BrowserAccessibility* cell = manager()->GetFromID(cell_id);
+    BrowserAccessibility* cell = manager_->GetFromID(cell_id);
     if (cell && cell->GetRole() == ui::AX_ROLE_ROW_HEADER)
       (*n_row_header_cells)++;
   }
@@ -2177,7 +2177,7 @@
   int index = 0;
   for (int i = 0; i < columns; ++i) {
     int cell_id = cell_ids[row * columns + i];
-    BrowserAccessibility* cell = manager()->GetFromID(cell_id);
+    BrowserAccessibility* cell = manager_->GetFromID(cell_id);
     if (cell && cell->GetRole() == ui::AX_ROLE_ROW_HEADER) {
       (*cell_accessibles)[index] = static_cast<IAccessible*>(
           ToBrowserAccessibilityWin(cell)->NewReference());
@@ -2345,8 +2345,7 @@
     return E_INVALIDARG;
 
   const base::string16& text_str = GetText();
-  HandleSpecialTextOffset(text_str, &offset);
-
+  HandleSpecialTextOffset(&offset);
   if (offset < 0 || offset > static_cast<LONG>(text_str.size()))
     return E_INVALIDARG;
 
@@ -2400,15 +2399,12 @@
   if (!start_offset || !end_offset || selection_index != 0)
     return E_INVALIDARG;
 
-  LONG n_selections = 0;
-  if (FAILED(get_nSelections(&n_selections)) || n_selections < 1)
-    return E_INVALIDARG;
-
   *start_offset = 0;
   *end_offset = 0;
   int selection_start, selection_end;
   GetSelectionOffsets(&selection_start, &selection_end);
-  if (selection_start >= 0 && selection_end >= 0) {
+  if (selection_start >= 0 && selection_end >= 0 &&
+      selection_start != selection_end) {
     // We should ignore the direction of the selection when exposing start and
     // end offsets. According to the IA2 Spec the end offset is always increased
     // by one past the end of the selection. This wouldn't make sense if
@@ -2418,9 +2414,10 @@
 
     *start_offset = selection_start;
     *end_offset = selection_end;
+    return S_OK;
   }
 
-  return S_OK;
+  return E_INVALIDARG;
 }
 
 STDMETHODIMP BrowserAccessibilityWin::get_text(LONG start_offset,
@@ -2435,8 +2432,8 @@
     return E_INVALIDARG;
 
   const base::string16& text_str = GetText();
-  HandleSpecialTextOffset(text_str, &start_offset);
-  HandleSpecialTextOffset(text_str, &end_offset);
+  HandleSpecialTextOffset(&start_offset);
+  HandleSpecialTextOffset(&end_offset);
 
   // The spec allows the arguments to be reversed.
   if (start_offset > end_offset) {
@@ -2480,7 +2477,7 @@
     return E_INVALIDARG;
 
   const base::string16& text_str = GetText();
-  HandleSpecialTextOffset(text_str, &offset);
+  HandleSpecialTextOffset(&offset);
   if (offset < 0)
     return E_INVALIDARG;
 
@@ -2691,11 +2688,8 @@
   if (!instance_active())
     return E_FAIL;
 
-  const base::string16& text_str = GetText();
-  HandleSpecialTextOffset(text_str, &start_offset);
-  HandleSpecialTextOffset(text_str, &end_offset);
-
-  manager()->SetTextSelection(*this, start_offset, end_offset);
+  // We only support one selection.
+  SetIA2HypertextSelection(start_offset, end_offset);
   return S_OK;
 }
 
@@ -2708,7 +2702,14 @@
   if (selection_index != 0)
     return E_INVALIDARG;
 
-  manager()->SetTextSelection(*this, 0, 0);
+  // Simply collapse the selection to the position of the caret if a caret is
+  // visible, otherwise set the selection to 0.
+  LONG caret_offset = 0;
+  int selection_start, selection_end;
+  GetSelectionOffsets(&selection_start, &selection_end);
+  if (HasCaret() && selection_end >= 0)
+    caret_offset = selection_end;
+  SetIA2HypertextSelection(caret_offset, caret_offset);
   return S_OK;
 }
 
@@ -2717,10 +2718,7 @@
   AddAccessibilityModeFlags(ACCESSIBILITY_MODE_FLAG_SCREEN_READER);
   if (!instance_active())
     return E_FAIL;
-
-  const base::string16& text_str = GetText();
-  HandleSpecialTextOffset(text_str, &offset);
-  manager()->SetTextSelection(*this, offset, offset);
+  SetIA2HypertextSelection(offset, offset);
   return S_OK;
 }
 
@@ -2731,15 +2729,9 @@
   AddAccessibilityModeFlags(ACCESSIBILITY_MODE_FLAG_SCREEN_READER);
   if (!instance_active())
     return E_FAIL;
-
   if (selection_index != 0)
     return E_INVALIDARG;
-
-  const base::string16& text_str = GetText();
-  HandleSpecialTextOffset(text_str, &start_offset);
-  HandleSpecialTextOffset(text_str, &end_offset);
-
-  manager()->SetTextSelection(*this, start_offset, end_offset);
+  SetIA2HypertextSelection(start_offset, end_offset);
   return S_OK;
 }
 
@@ -2757,8 +2749,8 @@
   if (!instance_active())
     return E_FAIL;
 
-  const base::string16& text = GetText();
-  HandleSpecialTextOffset(text, &offset);
+  const base::string16 text = GetText();
+  HandleSpecialTextOffset(&offset);
   if (offset < 0 || offset > static_cast<LONG>(text.size()))
     return E_INVALIDARG;
 
@@ -2976,7 +2968,7 @@
   if (!HasIntAttribute(ui::AX_ATTR_ACTION) || action_index != 0)
     return E_INVALIDARG;
 
-  manager()->DoDefaultAction(*this);
+  manager_->DoDefaultAction(*this);
   return S_OK;
 }
 
@@ -3138,10 +3130,10 @@
   if (!url)
     return E_INVALIDARG;
 
-  if (this != manager()->GetRoot())
+  if (this != manager_->GetRoot())
     return E_FAIL;
 
-  std::string str = manager()->GetTreeData().url;
+  std::string str = manager_->GetTreeData().url;
   if (str.empty())
     return S_FALSE;
 
@@ -3159,7 +3151,7 @@
   if (!title)
     return E_INVALIDARG;
 
-  std::string str = manager()->GetTreeData().title;
+  std::string str = manager_->GetTreeData().title;
   if (str.empty())
     return S_FALSE;
 
@@ -3177,7 +3169,7 @@
   if (!mime_type)
     return E_INVALIDARG;
 
-  std::string str = manager()->GetTreeData().mimetype;
+  std::string str = manager_->GetTreeData().mimetype;
   if (str.empty())
     return S_FALSE;
 
@@ -3195,7 +3187,7 @@
   if (!doc_type)
     return E_INVALIDARG;
 
-  std::string str = manager()->GetTreeData().doctype;
+  std::string str = manager_->GetTreeData().doctype;
   if (str.empty())
     return S_FALSE;
 
@@ -3610,8 +3602,8 @@
     return E_INVALIDARG;
   }
 
-  manager()->ScrollToMakeVisible(*this, GetPageBoundsForRange(
-      start_index, end_index - start_index));
+  manager_->ScrollToMakeVisible(
+      *this, GetPageBoundsForRange(start_index, end_index - start_index));
 
   return S_OK;
 }
@@ -3875,6 +3867,42 @@
   win_attributes_->offset_to_text_attributes.swap(attributes_map);
 }
 
+// |offset| could either be a text character or a child index in case of
+// non-text objects.
+BrowserAccessibilityWin::AXPlatformPositionInstance
+BrowserAccessibilityWin::CreatePositionAt(int offset) const {
+  if (!IsNativeTextControl() && !IsTextOnlyObject()) {
+    DCHECK(manager_);
+    const BrowserAccessibilityWin* child = this;
+    // TODO(nektar): Make parents of text-only objects not include the text of
+    // children in their hypertext.
+    for (size_t i = 0; i < InternalChildCount(); ++i) {
+      int new_offset = offset;
+      child = ToBrowserAccessibilityWin(InternalGetChild(i));
+      DCHECK(child);
+      if (child->IsTextOnlyObject()) {
+        new_offset -= child->GetText().length();
+      } else {
+        new_offset -= 1;
+      }
+      if (new_offset <= 0)
+        break;
+      offset = new_offset;
+    }
+    AXPlatformPositionInstance position =
+        AXPlatformPosition::CreateTextPosition(manager_->ax_tree_id(),
+                                               child->GetId(), offset,
+                                               ui::AX_TEXT_AFFINITY_DOWNSTREAM)
+            ->AsLeafTextPosition();
+    if (position->GetAnchor() &&
+        position->GetAnchor()->GetRole() == ui::AX_ROLE_INLINE_TEXT_BOX) {
+      return position->CreateParentPosition();
+    }
+    return position;
+  }
+  return BrowserAccessibility::CreatePositionAt(offset);
+}
+
 base::string16 BrowserAccessibilityWin::GetText() const {
   if (PlatformIsChildOfLeaf())
     return BrowserAccessibility::GetText();
@@ -4035,7 +4063,7 @@
   // On Windows, the value of a document should be its url.
   if (GetRole() == ui::AX_ROLE_ROOT_WEB_AREA ||
       GetRole() == ui::AX_ROLE_WEB_AREA) {
-    value = base::UTF8ToUTF16(manager()->GetTreeData().url);
+    value = base::UTF8ToUTF16(manager_->GetTreeData().url);
   }
   // If this doesn't have a value and is linked then set its value to the url
   // attribute. This allows screen readers to read an empty link's destination.
@@ -4501,6 +4529,18 @@
   base::ReplaceChars(*output, L";", L"\\;", output);
 }
 
+void BrowserAccessibilityWin::SetIA2HypertextSelection(LONG start_offset,
+                                                       LONG end_offset) {
+  HandleSpecialTextOffset(&start_offset);
+  HandleSpecialTextOffset(&end_offset);
+  AXPlatformPositionInstance start_position =
+      CreatePositionAt(static_cast<int>(start_offset));
+  AXPlatformPositionInstance end_position =
+      CreatePositionAt(static_cast<int>(end_offset));
+  manager_->SetSelection(AXPlatformRange(start_position->AsTextPosition(),
+                                         end_position->AsTextPosition()));
+}
+
 void BrowserAccessibilityWin::StringAttributeToIA2(
     ui::AXStringAttribute attribute,
     const char* ia2_attr) {
@@ -4707,22 +4747,22 @@
 }
 
 int BrowserAccessibilityWin::GetSelectionAnchor() const {
-  int32_t anchor_id = manager()->GetTreeData().sel_anchor_object_id;
+  int32_t anchor_id = manager_->GetTreeData().sel_anchor_object_id;
   const BrowserAccessibilityWin* anchor_object = GetFromID(anchor_id);
   if (!anchor_object)
     return -1;
 
-  int anchor_offset = manager()->GetTreeData().sel_anchor_offset;
+  int anchor_offset = manager_->GetTreeData().sel_anchor_offset;
   return GetHypertextOffsetFromEndpoint(*anchor_object, anchor_offset);
 }
 
 int BrowserAccessibilityWin::GetSelectionFocus() const {
-  int32_t focus_id = manager()->GetTreeData().sel_focus_object_id;
+  int32_t focus_id = manager_->GetTreeData().sel_focus_object_id;
   const BrowserAccessibilityWin* focus_object = GetFromID(focus_id);
   if (!focus_object)
     return -1;
 
-  int focus_offset = manager()->GetTreeData().sel_focus_offset;
+  int focus_offset = manager_->GetTreeData().sel_focus_offset;
   return GetHypertextOffsetFromEndpoint(*focus_object, focus_offset);
 }
 
@@ -4859,13 +4899,15 @@
   *new_len = new_text.size() - common_prefix - common_suffix;
 }
 
-void BrowserAccessibilityWin::HandleSpecialTextOffset(
-    const base::string16& text,
-    LONG* offset) {
-  if (*offset == IA2_TEXT_OFFSET_LENGTH)
-    *offset = static_cast<LONG>(text.size());
-  else if (*offset == IA2_TEXT_OFFSET_CARET)
-    get_caretOffset(offset);
+void BrowserAccessibilityWin::HandleSpecialTextOffset(LONG* offset) {
+  if (*offset == IA2_TEXT_OFFSET_LENGTH) {
+    *offset = static_cast<LONG>(GetText().length());
+  } else if (*offset == IA2_TEXT_OFFSET_CARET) {
+    // We shouldn't call |get_caretOffset| here as it affects UMA counts.
+    int selection_start, selection_end;
+    GetSelectionOffsets(&selection_start, &selection_end);
+    *offset = selection_end;
+  }
 }
 
 ui::TextBoundaryType BrowserAccessibilityWin::IA2TextBoundaryToTextBoundary(
@@ -4895,12 +4937,11 @@
     ui::TextBoundaryDirection direction) {
   // If the boundary is relative to the caret, use the selection
   // affinity, otherwise default to downstream affinity.
-  ui::AXTextAffinity affinity =
-      start_offset == IA2_TEXT_OFFSET_CARET ?
-      manager()->GetTreeData().sel_focus_affinity :
-      ui::AX_TEXT_AFFINITY_DOWNSTREAM;
+  ui::AXTextAffinity affinity = start_offset == IA2_TEXT_OFFSET_CARET
+                                    ? manager_->GetTreeData().sel_focus_affinity
+                                    : ui::AX_TEXT_AFFINITY_DOWNSTREAM;
 
-  HandleSpecialTextOffset(text, &start_offset);
+  HandleSpecialTextOffset(&start_offset);
   if (ia2_boundary == IA2_TEXT_BOUNDARY_WORD)
     return GetWordStartBoundary(static_cast<int>(start_offset), direction);
   if (ia2_boundary == IA2_TEXT_BOUNDARY_LINE) {
@@ -4945,7 +4986,7 @@
 BrowserAccessibilityWin* BrowserAccessibilityWin::GetFromID(int32_t id) const {
   if (!instance_active())
     return nullptr;
-  return ToBrowserAccessibilityWin(manager()->GetFromID(id));
+  return ToBrowserAccessibilityWin(manager_->GetFromID(id));
 }
 
 bool BrowserAccessibilityWin::IsListBoxOptionOrMenuListOption() {
diff --git a/content/browser/accessibility/browser_accessibility_win.h b/content/browser/accessibility/browser_accessibility_win.h
index d0789f1..7b454d6 100644
--- a/content/browser/accessibility/browser_accessibility_win.h
+++ b/content/browser/accessibility/browser_accessibility_win.h
@@ -719,6 +719,11 @@
   // embedded child objects.
   CONTENT_EXPORT void ComputeStylesIfNeeded();
 
+  // |offset| could either be a text character or a child index in case of
+  // non-text objects.
+  CONTENT_EXPORT AXPlatformPosition::AXPositionInstance CreatePositionAt(
+      int offset) const override;
+
   CONTENT_EXPORT base::string16 GetText() const override;
 
   // Accessors.
@@ -784,6 +789,9 @@
   FRIEND_TEST_ALL_PREFIXES(BrowserAccessibilityTest,
                            TestSanitizeStringAttributeForIA2);
 
+  // Sets the selection given a start and end offset in IA2 Hypertext.
+  void SetIA2HypertextSelection(LONG start_offset, LONG end_offset);
+
   // If the string attribute |attribute| is present, add its value as an
   // IAccessible2 attribute with the name |ia2_attr|.
   void StringAttributeToIA2(ui::AXStringAttribute attribute,
@@ -859,7 +867,7 @@
 
   // If offset is a member of IA2TextSpecialOffsets this function updates the
   // value of offset and returns, otherwise offset remains unchanged.
-  void HandleSpecialTextOffset(const base::string16& text, LONG* offset);
+  void HandleSpecialTextOffset(LONG* offset);
 
   // Convert from a IA2TextBoundaryType to a ui::TextBoundaryType.
   ui::TextBoundaryType IA2TextBoundaryToTextBoundary(IA2TextBoundaryType type);
@@ -936,7 +944,7 @@
     // Maps each style span to its start offset in hypertext.
     std::map<int, std::vector<base::string16>> offset_to_text_attributes;
 
-    // Maps the |hypertext_| embedded character offset to an index in
+    // Maps an embedded character offset in |hypertext_| to an index in
     // |hyperlinks_|.
     std::map<int32_t, int32_t> hyperlink_offset_to_index;
 
diff --git a/content/browser/accessibility/browser_accessibility_win_unittest.cc b/content/browser/accessibility/browser_accessibility_win_unittest.cc
index ee24619..dfa63aaa 100644
--- a/content/browser/accessibility/browser_accessibility_win_unittest.cc
+++ b/content/browser/accessibility/browser_accessibility_win_unittest.cc
@@ -1276,9 +1276,6 @@
   hr = combo_box_accessible->get_selection(
       0L /* selection_index */, &selection_start, &selection_end);
   EXPECT_EQ(E_INVALIDARG, hr); // No selections available.
-  // Invalid in_args should not modify out_args.
-  EXPECT_EQ(-2, selection_start);
-  EXPECT_EQ(-2, selection_end);
   hr = text_field_accessible->get_selection(
       0L /* selection_index */, &selection_start, &selection_end);
   EXPECT_EQ(S_OK, hr);
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index e6eb050..6ddcabd 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -2319,9 +2319,7 @@
     // pointer.
     GetInterfaceRegistry()->AddInterface(
         base::Bind(&device::GeolocationServiceContext::CreateService,
-                   base::Unretained(geolocation_service_context),
-                   base::Bind(&RenderFrameHostImpl::DidUseGeolocationPermission,
-                              weak_ptr_factory_.GetWeakPtr())));
+                   base::Unretained(geolocation_service_context)));
   }
 
   device::WakeLockServiceContext* wake_lock_service_context =
@@ -3171,19 +3169,6 @@
       routing_id_, common_params, start_params, request_params));
 }
 
-void RenderFrameHostImpl::DidUseGeolocationPermission() {
-  PermissionManager* permission_manager =
-      GetSiteInstance()->GetBrowserContext()->GetPermissionManager();
-  if (!permission_manager)
-    return;
-
-  permission_manager->RegisterPermissionUsage(
-      PermissionType::GEOLOCATION,
-      last_committed_url().GetOrigin(),
-      frame_tree_node()->frame_tree()->GetMainFrame()
-          ->last_committed_url().GetOrigin());
-}
-
 bool RenderFrameHostImpl::CanAccessFilesOfPageState(const PageState& state) {
   return ChildProcessSecurityPolicyImpl::GetInstance()->CanReadAllFiles(
       GetProcess()->GetID(), state.GetReferencedFiles());
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index 6c11dc61..bf5884b 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -794,9 +794,6 @@
   // part of the same site instance.
   bool IsSameSiteInstance(RenderFrameHostImpl* other_render_frame_host);
 
-  // Informs the content client that geolocation permissions were used.
-  void DidUseGeolocationPermission();
-
   // Returns whether the current RenderProcessHost has read access to all the
   // files reported in |state|.
   bool CanAccessFilesOfPageState(const PageState& state);
diff --git a/content/public/browser/permission_manager.h b/content/public/browser/permission_manager.h
index dbf197b9..54de7a2 100644
--- a/content/public/browser/permission_manager.h
+++ b/content/public/browser/permission_manager.h
@@ -77,12 +77,6 @@
                                const GURL& requesting_origin,
                                const GURL& embedding_origin) = 0;
 
-  // Registers a permission usage.
-  // TODO(mlamouri): see if we can remove this from the PermissionManager.
-  virtual void RegisterPermissionUsage(PermissionType permission,
-                                       const GURL& requesting_origin,
-                                       const GURL& embedding_origin) = 0;
-
   // Runs the given |callback| whenever the |permission| associated with the
   // pair { requesting_origin, embedding_origin } changes.
   // Returns the subscription_id to be used to unsubscribe. Can be
diff --git a/content/shell/browser/layout_test/layout_test_permission_manager.cc b/content/shell/browser/layout_test/layout_test_permission_manager.cc
index 42b772a9..c2324c0 100644
--- a/content/shell/browser/layout_test/layout_test_permission_manager.cc
+++ b/content/shell/browser/layout_test/layout_test_permission_manager.cc
@@ -135,13 +135,6 @@
   return it->second;
 }
 
-void LayoutTestPermissionManager::RegisterPermissionUsage(
-    PermissionType permission,
-    const GURL& requesting_origin,
-    const GURL& embedding_origin) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-}
-
 int LayoutTestPermissionManager::SubscribePermissionStatusChange(
     PermissionType permission,
     const GURL& requesting_origin,
diff --git a/content/shell/browser/layout_test/layout_test_permission_manager.h b/content/shell/browser/layout_test/layout_test_permission_manager.h
index b2245d7..8a135b4e 100644
--- a/content/shell/browser/layout_test/layout_test_permission_manager.h
+++ b/content/shell/browser/layout_test/layout_test_permission_manager.h
@@ -46,9 +46,6 @@
       PermissionType permission,
       const GURL& requesting_origin,
       const GURL& embedding_origin) override;
-  void RegisterPermissionUsage(PermissionType permission,
-                               const GURL& requesting_origin,
-                               const GURL& embedding_origin) override;
   int SubscribePermissionStatusChange(
       PermissionType permission,
       const GURL& requesting_origin,
diff --git a/content/shell/browser/shell_permission_manager.cc b/content/shell/browser/shell_permission_manager.cc
index fc0bacb..5311d5d 100644
--- a/content/shell/browser/shell_permission_manager.cc
+++ b/content/shell/browser/shell_permission_manager.cc
@@ -86,12 +86,6 @@
   return blink::mojom::PermissionStatus::DENIED;
 }
 
-void ShellPermissionManager::RegisterPermissionUsage(
-    PermissionType permission,
-    const GURL& requesting_origin,
-    const GURL& embedding_origin) {
-}
-
 int ShellPermissionManager::SubscribePermissionStatusChange(
     PermissionType permission,
     const GURL& requesting_origin,
diff --git a/content/shell/browser/shell_permission_manager.h b/content/shell/browser/shell_permission_manager.h
index a626cbb5..dc374aa 100644
--- a/content/shell/browser/shell_permission_manager.h
+++ b/content/shell/browser/shell_permission_manager.h
@@ -40,9 +40,6 @@
       PermissionType permission,
       const GURL& requesting_origin,
       const GURL& embedding_origin) override;
-  void RegisterPermissionUsage(PermissionType permission,
-                               const GURL& requesting_origin,
-                               const GURL& embedding_origin) override;
   int SubscribePermissionStatusChange(
       PermissionType permission,
       const GURL& requesting_origin,
diff --git a/content/test/mock_permission_manager.h b/content/test/mock_permission_manager.h
index 3f767ae..20e9444 100644
--- a/content/test/mock_permission_manager.h
+++ b/content/test/mock_permission_manager.h
@@ -46,9 +46,6 @@
   void ResetPermission(PermissionType permission,
                        const GURL& requesting_origin,
                        const GURL& embedding_origin) override {}
-  void RegisterPermissionUsage(PermissionType permission,
-                               const GURL& requesting_origin,
-                               const GURL& embedding_origin) override {}
   int SubscribePermissionStatusChange(
       PermissionType permission,
       const GURL& requesting_origin,
diff --git a/device/geolocation/geolocation_service_context.cc b/device/geolocation/geolocation_service_context.cc
index 1cb5e0d495..b1bb14bd9 100644
--- a/device/geolocation/geolocation_service_context.cc
+++ b/device/geolocation/geolocation_service_context.cc
@@ -16,10 +16,9 @@
 GeolocationServiceContext::~GeolocationServiceContext() {}
 
 void GeolocationServiceContext::CreateService(
-    const base::Closure& update_callback,
     mojo::InterfaceRequest<mojom::GeolocationService> request) {
   GeolocationServiceImpl* service =
-      new GeolocationServiceImpl(std::move(request), this, update_callback);
+      new GeolocationServiceImpl(std::move(request), this);
   services_.push_back(base::WrapUnique<GeolocationServiceImpl>(service));
   if (geoposition_override_)
     service->SetOverride(*geoposition_override_.get());
diff --git a/device/geolocation/geolocation_service_context.h b/device/geolocation/geolocation_service_context.h
index 2e900007..5b7c2f0 100644
--- a/device/geolocation/geolocation_service_context.h
+++ b/device/geolocation/geolocation_service_context.h
@@ -26,10 +26,7 @@
   virtual ~GeolocationServiceContext();
 
   // Creates a GeolocationServiceImpl that is weakly bound to |request|.
-  // |update_callback| will be called when services send
-  // location updates to their clients.
-  void CreateService(const base::Closure& update_callback,
-                     mojo::InterfaceRequest<mojom::GeolocationService> request);
+  void CreateService(mojo::InterfaceRequest<mojom::GeolocationService> request);
 
   // Called when a service has a connection error. After this call, it is no
   // longer safe to access |service|.
diff --git a/device/geolocation/geolocation_service_impl.cc b/device/geolocation/geolocation_service_impl.cc
index a56b6d8..357d9cd 100644
--- a/device/geolocation/geolocation_service_impl.cc
+++ b/device/geolocation/geolocation_service_impl.cc
@@ -60,11 +60,9 @@
 
 GeolocationServiceImpl::GeolocationServiceImpl(
     mojo::InterfaceRequest<GeolocationService> request,
-    GeolocationServiceContext* context,
-    const base::Closure& update_callback)
+    GeolocationServiceContext* context)
     : binding_(this, std::move(request)),
       context_(context),
-      update_callback_(update_callback),
       high_accuracy_(false),
       has_position_to_report_(false) {
   DCHECK(context_);
@@ -160,8 +158,6 @@
   RecordGeopositionErrorCode(position.error_code);
   DCHECK(context_);
 
-  update_callback_.Run();
-
   current_position_.valid = position.Validate();
   current_position_.latitude = position.latitude;
   current_position_.longitude = position.longitude;
diff --git a/device/geolocation/geolocation_service_impl.h b/device/geolocation/geolocation_service_impl.h
index 305920e9e..60ce117 100644
--- a/device/geolocation/geolocation_service_impl.h
+++ b/device/geolocation/geolocation_service_impl.h
@@ -25,8 +25,7 @@
   // is being used.
   GeolocationServiceImpl(
       mojo::InterfaceRequest<mojom::GeolocationService> request,
-      GeolocationServiceContext* context,
-      const base::Closure& update_callback);
+      GeolocationServiceContext* context);
   ~GeolocationServiceImpl() override;
 
   // Starts listening for updates.
@@ -57,10 +56,6 @@
   GeolocationServiceContext* context_;
   std::unique_ptr<GeolocationProvider::Subscription> geolocation_subscription_;
 
-  // Callback that allows the instantiator of this class to be notified on
-  // position updates.
-  base::Closure update_callback_;
-
   // The callback passed to QueryNextPosition.
   QueryNextPositionCallback position_callback_;
 
diff --git a/media/filters/h264_parser.cc b/media/filters/h264_parser.cc
index 9b17808..c0887fd 100644
--- a/media/filters/h264_parser.cc
+++ b/media/filters/h264_parser.cc
@@ -739,7 +739,7 @@
         DefaultScalingList4x4(i, pps->scaling_list4x4);
 
     } else {
-      if (sps.seq_scaling_matrix_present_flag) {
+      if (!sps.seq_scaling_matrix_present_flag) {
         // Table 7-2 fallback rule A in spec.
         FallbackScalingList4x4(
             i, kDefault4x4Intra, kDefault4x4Inter, pps->scaling_list4x4);
@@ -768,7 +768,7 @@
           DefaultScalingList8x8(i, pps->scaling_list8x8);
 
       } else {
-        if (sps.seq_scaling_matrix_present_flag) {
+        if (!sps.seq_scaling_matrix_present_flag) {
           // Table 7-2 fallback rule A in spec.
           FallbackScalingList8x8(
               i, kDefault8x8Intra, kDefault8x8Inter, pps->scaling_list8x8);
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 6a9ef5c6..4fd4294 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -134,7 +134,6 @@
 crbug.com/664852 virtual/gpu/fast/canvas/canvas-lose-restore-googol-size.html [ Pass Failure ]
 crbug.com/664852 virtual/gpu/fast/canvas/canvas-lost-gpu-context.html [ Pass Failure ]
 crbug.com/664852 virtual/gpu/fast/canvas/OffscreenCanvas-2d-drawImage.html [ Pass Failure ]
-crbug.com/692400 fast/css/first-letter-rtc-crash.html [ NeedsRebaseline ]
 
 # Added 2016-12-14
 crbug.com/674396 [ Win ] compositing/reflections/nested-reflection-transition.html [ Pass Failure ]
diff --git a/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd-expected.txt
deleted file mode 100644
index 5ab3c0d..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd-expected.txt
+++ /dev/null
@@ -1,140 +0,0 @@
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-CONSOLE ERROR: line 27: The given range isn't in document.
-CONSOLE ERROR: line 80: The given range isn't in document.
-This is a testharness.js-based test.
-Found 118 tests; 58 PASS, 60 FAIL, 0 TIMEOUT, 0 NOTRUN.
-PASS Range 0 [] collapseToStart() 
-PASS Range 0 [] collapseToEnd() 
-PASS Range 1 [paras[0].firstChild, 0, paras[0].firstChild, 0] collapseToStart() 
-PASS Range 1 [paras[0].firstChild, 0, paras[0].firstChild, 0] collapseToEnd() 
-PASS Range 2 [paras[0].firstChild, 0, paras[0].firstChild, 1] collapseToStart() 
-PASS Range 2 [paras[0].firstChild, 0, paras[0].firstChild, 1] collapseToEnd() 
-PASS Range 3 [paras[0].firstChild, 2, paras[0].firstChild, 8] collapseToStart() 
-PASS Range 3 [paras[0].firstChild, 2, paras[0].firstChild, 8] collapseToEnd() 
-PASS Range 4 [paras[0].firstChild, 2, paras[0].firstChild, 9] collapseToStart() 
-PASS Range 4 [paras[0].firstChild, 2, paras[0].firstChild, 9] collapseToEnd() 
-PASS Range 5 [paras[1].firstChild, 0, paras[1].firstChild, 0] collapseToStart() 
-PASS Range 5 [paras[1].firstChild, 0, paras[1].firstChild, 0] collapseToEnd() 
-PASS Range 6 [paras[1].firstChild, 0, paras[1].firstChild, 1] collapseToStart() 
-PASS Range 6 [paras[1].firstChild, 0, paras[1].firstChild, 1] collapseToEnd() 
-PASS Range 7 [paras[1].firstChild, 2, paras[1].firstChild, 8] collapseToStart() 
-PASS Range 7 [paras[1].firstChild, 2, paras[1].firstChild, 8] collapseToEnd() 
-PASS Range 8 [paras[1].firstChild, 2, paras[1].firstChild, 9] collapseToStart() 
-PASS Range 8 [paras[1].firstChild, 2, paras[1].firstChild, 9] collapseToEnd() 
-FAIL Range 9 [detachedPara1.firstChild, 0, detachedPara1.firstChild, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 9 [detachedPara1.firstChild, 0, detachedPara1.firstChild, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 10 [detachedPara1.firstChild, 0, detachedPara1.firstChild, 1] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 10 [detachedPara1.firstChild, 0, detachedPara1.firstChild, 1] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 11 [detachedPara1.firstChild, 2, detachedPara1.firstChild, 8] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 11 [detachedPara1.firstChild, 2, detachedPara1.firstChild, 8] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 12 [foreignPara1.firstChild, 0, foreignPara1.firstChild, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 12 [foreignPara1.firstChild, 0, foreignPara1.firstChild, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 13 [foreignPara1.firstChild, 0, foreignPara1.firstChild, 1] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 13 [foreignPara1.firstChild, 0, foreignPara1.firstChild, 1] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 14 [foreignPara1.firstChild, 2, foreignPara1.firstChild, 8] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 14 [foreignPara1.firstChild, 2, foreignPara1.firstChild, 8] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-PASS Range 15 [document.documentElement, 0, document.documentElement, 1] collapseToStart() 
-PASS Range 15 [document.documentElement, 0, document.documentElement, 1] collapseToEnd() 
-PASS Range 16 [document.documentElement, 0, document.documentElement, 2] collapseToStart() 
-PASS Range 16 [document.documentElement, 0, document.documentElement, 2] collapseToEnd() 
-PASS Range 17 [document.documentElement, 1, document.documentElement, 2] collapseToStart() 
-PASS Range 17 [document.documentElement, 1, document.documentElement, 2] collapseToEnd() 
-PASS Range 18 [document.head, 1, document.head, 1] collapseToStart() 
-PASS Range 18 [document.head, 1, document.head, 1] collapseToEnd() 
-PASS Range 19 [document.body, 0, document.body, 1] collapseToStart() 
-PASS Range 19 [document.body, 0, document.body, 1] collapseToEnd() 
-FAIL Range 20 [foreignDoc.documentElement, 0, foreignDoc.documentElement, 1] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 20 [foreignDoc.documentElement, 0, foreignDoc.documentElement, 1] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 21 [foreignDoc.head, 1, foreignDoc.head, 1] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 21 [foreignDoc.head, 1, foreignDoc.head, 1] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 22 [foreignDoc.body, 0, foreignDoc.body, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 22 [foreignDoc.body, 0, foreignDoc.body, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-PASS Range 23 [paras[0], 0, paras[0], 0] collapseToStart() 
-PASS Range 23 [paras[0], 0, paras[0], 0] collapseToEnd() 
-PASS Range 24 [paras[0], 0, paras[0], 1] collapseToStart() 
-PASS Range 24 [paras[0], 0, paras[0], 1] collapseToEnd() 
-FAIL Range 25 [detachedPara1, 0, detachedPara1, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 25 [detachedPara1, 0, detachedPara1, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 26 [detachedPara1, 0, detachedPara1, 1] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 26 [detachedPara1, 0, detachedPara1, 1] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-PASS Range 27 [paras[0].firstChild, 0, paras[1].firstChild, 0] collapseToStart() 
-PASS Range 27 [paras[0].firstChild, 0, paras[1].firstChild, 0] collapseToEnd() 
-PASS Range 28 [paras[0].firstChild, 0, paras[1].firstChild, 8] collapseToStart() 
-PASS Range 28 [paras[0].firstChild, 0, paras[1].firstChild, 8] collapseToEnd() 
-PASS Range 29 [paras[0].firstChild, 3, paras[3], 1] collapseToStart() 
-PASS Range 29 [paras[0].firstChild, 3, paras[3], 1] collapseToEnd() 
-PASS Range 30 [paras[0], 0, paras[0].firstChild, 7] collapseToStart() 
-PASS Range 30 [paras[0], 0, paras[0].firstChild, 7] collapseToEnd() 
-PASS Range 31 [testDiv, 2, paras[4], 1] collapseToStart() 
-PASS Range 31 [testDiv, 2, paras[4], 1] collapseToEnd() 
-PASS Range 32 [testDiv, 1, paras[2].firstChild, 5] collapseToStart() 
-PASS Range 32 [testDiv, 1, paras[2].firstChild, 5] collapseToEnd() 
-PASS Range 33 [document.documentElement, 1, document.body, 0] collapseToStart() 
-PASS Range 33 [document.documentElement, 1, document.body, 0] collapseToEnd() 
-FAIL Range 34 [foreignDoc.documentElement, 1, foreignDoc.body, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 34 [foreignDoc.documentElement, 1, foreignDoc.body, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-PASS Range 35 [document, 0, document, 1] collapseToStart() 
-PASS Range 35 [document, 0, document, 1] collapseToEnd() 
-PASS Range 36 [document, 0, document, 2] collapseToStart() 
-PASS Range 36 [document, 0, document, 2] collapseToEnd() 
-PASS Range 37 [document, 1, document, 2] collapseToStart() 
-PASS Range 37 [document, 1, document, 2] collapseToEnd() 
-PASS Range 38 [testDiv, 0, comment, 5] collapseToStart() 
-PASS Range 38 [testDiv, 0, comment, 5] collapseToEnd() 
-PASS Range 39 [paras[2].firstChild, 4, comment, 2] collapseToStart() 
-PASS Range 39 [paras[2].firstChild, 4, comment, 2] collapseToEnd() 
-PASS Range 40 [paras[3], 1, comment, 8] collapseToStart() 
-PASS Range 40 [paras[3], 1, comment, 8] collapseToEnd() 
-FAIL Range 41 [foreignDoc, 0, foreignDoc, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 41 [foreignDoc, 0, foreignDoc, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 42 [foreignDoc, 1, foreignComment, 2] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 42 [foreignDoc, 1, foreignComment, 2] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 43 [foreignDoc.body, 0, foreignTextNode, 36] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 43 [foreignDoc.body, 0, foreignTextNode, 36] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 44 [xmlDoc, 0, xmlDoc, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 44 [xmlDoc, 0, xmlDoc, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 45 [xmlDoc, 1, xmlComment, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 45 [xmlDoc, 1, xmlComment, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 46 [detachedTextNode, 0, detachedTextNode, 8] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 46 [detachedTextNode, 0, detachedTextNode, 8] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 47 [detachedForeignTextNode, 7, detachedForeignTextNode, 7] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 47 [detachedForeignTextNode, 7, detachedForeignTextNode, 7] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 48 [detachedForeignTextNode, 0, detachedForeignTextNode, 8] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 48 [detachedForeignTextNode, 0, detachedForeignTextNode, 8] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 49 [detachedXmlTextNode, 7, detachedXmlTextNode, 7] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 49 [detachedXmlTextNode, 7, detachedXmlTextNode, 7] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 50 [detachedXmlTextNode, 0, detachedXmlTextNode, 8] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 50 [detachedXmlTextNode, 0, detachedXmlTextNode, 8] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 51 [detachedComment, 3, detachedComment, 4] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 51 [detachedComment, 3, detachedComment, 4] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 52 [detachedComment, 5, detachedComment, 5] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 52 [detachedComment, 5, detachedComment, 5] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 53 [detachedForeignComment, 0, detachedForeignComment, 1] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 53 [detachedForeignComment, 0, detachedForeignComment, 1] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 54 [detachedForeignComment, 4, detachedForeignComment, 4] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 54 [detachedForeignComment, 4, detachedForeignComment, 4] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 55 [detachedXmlComment, 2, detachedXmlComment, 6] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 55 [detachedXmlComment, 2, detachedXmlComment, 6] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 56 [docfrag, 0, docfrag, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 56 [docfrag, 0, docfrag, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 57 [foreignDocfrag, 0, foreignDocfrag, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 57 [foreignDocfrag, 0, foreignDocfrag, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 58 [xmlDocfrag, 0, xmlDocfrag, 0] collapseToStart() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-FAIL Range 58 [xmlDocfrag, 0, xmlDocfrag, 0] collapseToEnd() assert_equals: Sanity check: rangeCount must equal 1 after addRange() expected 1 but got 0
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd.html b/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd.html
index 37c57fa..07c2b843b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd.html
@@ -7,19 +7,19 @@
 <script>
 "use strict";
 
-// Also test a selection with no ranges
-testRanges.unshift("[]");
+test(function() {
+   selection.removeAllRanges();
+   assert_throws("INVALID_STATE_ERR", function() {
+       selection.collapseToStart();
+   });
+}, "Must throw InvalidStateErr if the selection's range is null");
 
 for (var i = 0; i < testRanges.length; i++) {
+    var endpoints = eval(testRanges[i]);
+    if (!isSelectableNode(endpoints[0]) || !isSelectableNode(endpoints[2]))
+        continue;
     test(function() {
         selection.removeAllRanges();
-        var endpoints = eval(testRanges[i]);
-        if (!endpoints.length) {
-            assert_throws("INVALID_STATE_ERR", function() {
-                selection.collapseToStart();
-            }, "Must throw InvalidStateErr if the selection's range is null");
-            return;
-        }
 
         var addedRange = ownerDocument(endpoints[0]).createRange();
         addedRange.setStart(endpoints[0], endpoints[1]);
@@ -66,13 +66,6 @@
     // Copy-paste of above
     test(function() {
         selection.removeAllRanges();
-        var endpoints = eval(testRanges[i]);
-        if (!endpoints.length) {
-            assert_throws("INVALID_STATE_ERR", function() {
-                selection.collapseToEnd();
-            }, "Must throw InvalidStateErr if the selection's range is null");
-            return;
-        }
 
         var addedRange = ownerDocument(endpoints[0]).createRange();
         addedRange.setStart(endpoints[0], endpoints[1]);
diff --git a/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces-expected.txt
index 8d50fe5..7f1b8c1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces-expected.txt
@@ -1,4 +1,5 @@
 This is a testharness.js-based test.
+Found 59 tests; 55 PASS, 4 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Selection interface: existence and properties of interface object 
 PASS Selection interface object length 
 PASS Selection interface object name 
@@ -9,17 +10,22 @@
 PASS Selection interface: attribute focusNode 
 PASS Selection interface: attribute focusOffset 
 PASS Selection interface: attribute isCollapsed 
-FAIL Selection interface: operation collapse(Node,unsigned long) assert_equals: property has wrong .length expected 2 but got 1
-PASS Selection interface: operation collapseToStart() 
-PASS Selection interface: operation collapseToEnd() 
-FAIL Selection interface: operation extend(Node,unsigned long) assert_equals: property has wrong .length expected 2 but got 1
-PASS Selection interface: operation selectAllChildren(Node) 
-PASS Selection interface: operation deleteFromDocument() 
 PASS Selection interface: attribute rangeCount 
+PASS Selection interface: attribute type 
 PASS Selection interface: operation getRangeAt(unsigned long) 
 PASS Selection interface: operation addRange(Range) 
 FAIL Selection interface: operation removeRange(Range) assert_own_property: interface prototype object missing non-static operation expected property "removeRange" missing
 PASS Selection interface: operation removeAllRanges() 
+PASS Selection interface: operation empty() 
+PASS Selection interface: operation collapse(Node,unsigned long) 
+PASS Selection interface: operation setPosition(Node,unsigned long) 
+PASS Selection interface: operation collapseToStart() 
+PASS Selection interface: operation collapseToEnd() 
+PASS Selection interface: operation extend(Node,unsigned long) 
+PASS Selection interface: operation setBaseAndExtent(Node,unsigned long,Node,unsigned long) 
+PASS Selection interface: operation selectAllChildren(Node) 
+PASS Selection interface: operation deleteFromDocument() 
+PASS Selection interface: operation containsNode(Node,boolean) 
 PASS Selection interface: stringifier 
 PASS Selection must be primary interface of getSelection() 
 PASS Stringification of getSelection() 
@@ -28,26 +34,30 @@
 PASS Selection interface: getSelection() must inherit property "focusNode" with the proper type (2) 
 PASS Selection interface: getSelection() must inherit property "focusOffset" with the proper type (3) 
 PASS Selection interface: getSelection() must inherit property "isCollapsed" with the proper type (4) 
-PASS Selection interface: getSelection() must inherit property "collapse" with the proper type (5) 
-FAIL Selection interface: calling collapse(Node,unsigned long) on getSelection() with too few arguments must throw TypeError assert_throws: Called with 1 arguments function "function () {
-            fn.apply(obj, args);
-        }" did not throw
-PASS Selection interface: getSelection() must inherit property "collapseToStart" with the proper type (6) 
-PASS Selection interface: getSelection() must inherit property "collapseToEnd" with the proper type (7) 
-PASS Selection interface: getSelection() must inherit property "extend" with the proper type (8) 
-FAIL Selection interface: calling extend(Node,unsigned long) on getSelection() with too few arguments must throw TypeError assert_throws: Called with 1 arguments function "function () {
-            fn.apply(obj, args);
-        }" did not throw
-PASS Selection interface: getSelection() must inherit property "selectAllChildren" with the proper type (9) 
-PASS Selection interface: calling selectAllChildren(Node) on getSelection() with too few arguments must throw TypeError 
-PASS Selection interface: getSelection() must inherit property "deleteFromDocument" with the proper type (10) 
-PASS Selection interface: getSelection() must inherit property "rangeCount" with the proper type (11) 
-PASS Selection interface: getSelection() must inherit property "getRangeAt" with the proper type (12) 
+PASS Selection interface: getSelection() must inherit property "rangeCount" with the proper type (5) 
+PASS Selection interface: getSelection() must inherit property "type" with the proper type (6) 
+PASS Selection interface: getSelection() must inherit property "getRangeAt" with the proper type (7) 
 PASS Selection interface: calling getRangeAt(unsigned long) on getSelection() with too few arguments must throw TypeError 
-PASS Selection interface: getSelection() must inherit property "addRange" with the proper type (13) 
+PASS Selection interface: getSelection() must inherit property "addRange" with the proper type (8) 
 PASS Selection interface: calling addRange(Range) on getSelection() with too few arguments must throw TypeError 
-FAIL Selection interface: getSelection() must inherit property "removeRange" with the proper type (14) assert_inherits: property "removeRange" not found in prototype chain
+FAIL Selection interface: getSelection() must inherit property "removeRange" with the proper type (9) assert_inherits: property "removeRange" not found in prototype chain
 FAIL Selection interface: calling removeRange(Range) on getSelection() with too few arguments must throw TypeError assert_inherits: property "removeRange" not found in prototype chain
-PASS Selection interface: getSelection() must inherit property "removeAllRanges" with the proper type (15) 
+PASS Selection interface: getSelection() must inherit property "removeAllRanges" with the proper type (10) 
+PASS Selection interface: getSelection() must inherit property "empty" with the proper type (11) 
+PASS Selection interface: getSelection() must inherit property "collapse" with the proper type (12) 
+PASS Selection interface: calling collapse(Node,unsigned long) on getSelection() with too few arguments must throw TypeError 
+PASS Selection interface: getSelection() must inherit property "setPosition" with the proper type (13) 
+PASS Selection interface: calling setPosition(Node,unsigned long) on getSelection() with too few arguments must throw TypeError 
+PASS Selection interface: getSelection() must inherit property "collapseToStart" with the proper type (14) 
+PASS Selection interface: getSelection() must inherit property "collapseToEnd" with the proper type (15) 
+PASS Selection interface: getSelection() must inherit property "extend" with the proper type (16) 
+PASS Selection interface: calling extend(Node,unsigned long) on getSelection() with too few arguments must throw TypeError 
+PASS Selection interface: getSelection() must inherit property "setBaseAndExtent" with the proper type (17) 
+PASS Selection interface: calling setBaseAndExtent(Node,unsigned long,Node,unsigned long) on getSelection() with too few arguments must throw TypeError 
+PASS Selection interface: getSelection() must inherit property "selectAllChildren" with the proper type (18) 
+PASS Selection interface: calling selectAllChildren(Node) on getSelection() with too few arguments must throw TypeError 
+PASS Selection interface: getSelection() must inherit property "deleteFromDocument" with the proper type (19) 
+PASS Selection interface: getSelection() must inherit property "containsNode" with the proper type (20) 
+PASS Selection interface: calling containsNode(Node,boolean) on getSelection() with too few arguments must throw TypeError 
 Harness: the test ran to completion.
 
diff --git a/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces.html b/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces.html
index 7174686a..888b23fd 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/selection/interfaces.html
@@ -6,29 +6,35 @@
 <script src=/resources/WebIDLParser.js></script>
 <script src=/resources/idlharness.js></script>
 <script type=text/plain>
+// https://www.w3.org/TR/2016/WD-selection-api-20161206/
 interface Selection {
-  readonly attribute Node? anchorNode;
-  readonly attribute unsigned long anchorOffset;
-  readonly attribute Node? focusNode;
-  readonly attribute unsigned long focusOffset;
-
-  readonly attribute boolean isCollapsed;
-  void               collapse(Node node, unsigned long offset);
-  void               collapseToStart();
-  void               collapseToEnd();
-
-  void               extend(Node node, unsigned long offset);
-
-  void               selectAllChildren(Node node);
-  void               deleteFromDocument();
-
-  readonly attribute unsigned long rangeCount;
-  Range              getRangeAt(unsigned long index);
-  void               addRange(Range range);
-  void               removeRange(Range range);
-  void               removeAllRanges();
-
-  stringifier;
+    readonly attribute Node?         anchorNode;
+    readonly attribute unsigned long anchorOffset;
+    readonly attribute Node?         focusNode;
+    readonly attribute unsigned long focusOffset;
+    readonly attribute boolean       isCollapsed;
+    readonly attribute unsigned long rangeCount;
+    readonly attribute DOMString     type;
+    Range     getRangeAt(unsigned long index);
+    void      addRange(Range range);
+    void      removeRange(Range range);
+    void      removeAllRanges();
+    void      empty();
+    void      collapse(Node? node, optional unsigned long offset = 0);
+    void      setPosition(Node? node, optional unsigned long offset = 0);
+    void      collapseToStart();
+    void      collapseToEnd();
+    void      extend(Node node, optional unsigned long offset = 0);
+    void      setBaseAndExtent(Node anchorNode,
+                               unsigned long anchorOffset,
+                               Node focusNode,
+                               unsigned long focusOffset);
+    void      selectAllChildren(Node node);
+    [CEReactions]
+    void      deleteFromDocument();
+    boolean   containsNode(Node node,
+                           optional boolean allowPartialContainment = false);
+    stringifier DOMString ();
 };
 </script>
 <script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/selection/isCollapsed-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/selection/isCollapsed-expected.txt
deleted file mode 100644
index 8145bcbc7..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/selection/isCollapsed-expected.txt
+++ /dev/null
@@ -1,72 +0,0 @@
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-CONSOLE ERROR: line 22: The given range isn't in document.
-This is a testharness.js-based test.
-Found 59 tests; 43 PASS, 16 FAIL, 0 TIMEOUT, 0 NOTRUN.
-PASS Empty selection 
-PASS Range 0 [paras[0].firstChild, 0, paras[0].firstChild, 0] 
-PASS Range 1 [paras[0].firstChild, 0, paras[0].firstChild, 1] 
-PASS Range 2 [paras[0].firstChild, 2, paras[0].firstChild, 8] 
-PASS Range 3 [paras[0].firstChild, 2, paras[0].firstChild, 9] 
-PASS Range 4 [paras[1].firstChild, 0, paras[1].firstChild, 0] 
-PASS Range 5 [paras[1].firstChild, 0, paras[1].firstChild, 1] 
-PASS Range 6 [paras[1].firstChild, 2, paras[1].firstChild, 8] 
-PASS Range 7 [paras[1].firstChild, 2, paras[1].firstChild, 9] 
-PASS Range 8 [detachedPara1.firstChild, 0, detachedPara1.firstChild, 0] 
-FAIL Range 9 [detachedPara1.firstChild, 0, detachedPara1.firstChild, 1] assert_equals: Value of isCollapsed expected false but got true
-FAIL Range 10 [detachedPara1.firstChild, 2, detachedPara1.firstChild, 8] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 11 [foreignPara1.firstChild, 0, foreignPara1.firstChild, 0] 
-FAIL Range 12 [foreignPara1.firstChild, 0, foreignPara1.firstChild, 1] assert_equals: Value of isCollapsed expected false but got true
-FAIL Range 13 [foreignPara1.firstChild, 2, foreignPara1.firstChild, 8] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 14 [document.documentElement, 0, document.documentElement, 1] 
-PASS Range 15 [document.documentElement, 0, document.documentElement, 2] 
-PASS Range 16 [document.documentElement, 1, document.documentElement, 2] 
-PASS Range 17 [document.head, 1, document.head, 1] 
-PASS Range 18 [document.body, 0, document.body, 1] 
-FAIL Range 19 [foreignDoc.documentElement, 0, foreignDoc.documentElement, 1] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 20 [foreignDoc.head, 1, foreignDoc.head, 1] 
-PASS Range 21 [foreignDoc.body, 0, foreignDoc.body, 0] 
-PASS Range 22 [paras[0], 0, paras[0], 0] 
-PASS Range 23 [paras[0], 0, paras[0], 1] 
-PASS Range 24 [detachedPara1, 0, detachedPara1, 0] 
-FAIL Range 25 [detachedPara1, 0, detachedPara1, 1] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 26 [paras[0].firstChild, 0, paras[1].firstChild, 0] 
-PASS Range 27 [paras[0].firstChild, 0, paras[1].firstChild, 8] 
-PASS Range 28 [paras[0].firstChild, 3, paras[3], 1] 
-PASS Range 29 [paras[0], 0, paras[0].firstChild, 7] 
-PASS Range 30 [testDiv, 2, paras[4], 1] 
-PASS Range 31 [testDiv, 1, paras[2].firstChild, 5] 
-PASS Range 32 [document.documentElement, 1, document.body, 0] 
-FAIL Range 33 [foreignDoc.documentElement, 1, foreignDoc.body, 0] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 34 [document, 0, document, 1] 
-PASS Range 35 [document, 0, document, 2] 
-PASS Range 36 [document, 1, document, 2] 
-PASS Range 37 [testDiv, 0, comment, 5] 
-PASS Range 38 [paras[2].firstChild, 4, comment, 2] 
-PASS Range 39 [paras[3], 1, comment, 8] 
-PASS Range 40 [foreignDoc, 0, foreignDoc, 0] 
-FAIL Range 41 [foreignDoc, 1, foreignComment, 2] assert_equals: Value of isCollapsed expected false but got true
-FAIL Range 42 [foreignDoc.body, 0, foreignTextNode, 36] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 43 [xmlDoc, 0, xmlDoc, 0] 
-FAIL Range 44 [xmlDoc, 1, xmlComment, 0] assert_equals: Value of isCollapsed expected false but got true
-FAIL Range 45 [detachedTextNode, 0, detachedTextNode, 8] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 46 [detachedForeignTextNode, 7, detachedForeignTextNode, 7] 
-FAIL Range 47 [detachedForeignTextNode, 0, detachedForeignTextNode, 8] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 48 [detachedXmlTextNode, 7, detachedXmlTextNode, 7] 
-FAIL Range 49 [detachedXmlTextNode, 0, detachedXmlTextNode, 8] assert_equals: Value of isCollapsed expected false but got true
-FAIL Range 50 [detachedComment, 3, detachedComment, 4] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 51 [detachedComment, 5, detachedComment, 5] 
-FAIL Range 52 [detachedForeignComment, 0, detachedForeignComment, 1] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 53 [detachedForeignComment, 4, detachedForeignComment, 4] 
-FAIL Range 54 [detachedXmlComment, 2, detachedXmlComment, 6] assert_equals: Value of isCollapsed expected false but got true
-PASS Range 55 [docfrag, 0, docfrag, 0] 
-PASS Range 56 [foreignDocfrag, 0, foreignDocfrag, 0] 
-PASS Range 57 [xmlDocfrag, 0, xmlDocfrag, 0] 
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/selection/isCollapsed.html b/third_party/WebKit/LayoutTests/external/wpt/selection/isCollapsed.html
index 113a16d..819a3e29 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/selection/isCollapsed.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/selection/isCollapsed.html
@@ -13,9 +13,11 @@
 }, "Empty selection");
 
 for (var i = 0; i < testRanges.length; i++) {
+    var endpoints = eval(testRanges[i]);
+    if (!isSelectableNode(endpoints[0]) || !isSelectableNode(endpoints[2]))
+        continue;
     test(function() {
         selection.removeAllRanges();
-        var endpoints = eval(testRanges[i]);
         var range = ownerDocument(endpoints[0]).createRange();
         range.setStart(endpoints[0], endpoints[1]);
         range.setEnd(endpoints[2], endpoints[3]);
diff --git a/third_party/WebKit/LayoutTests/fast/css/first-letter-rtc-crash-expected.txt b/third_party/WebKit/LayoutTests/fast/css/first-letter-rtc-crash-expected.txt
deleted file mode 100644
index aef377a0..0000000
--- a/third_party/WebKit/LayoutTests/fast/css/first-letter-rtc-crash-expected.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-CONSOLE WARNING: line 21: The behavior that Selection.addRange() merges existing Range and the specified Range was removed. See https://www.chromestatus.com/features/6680566019653632 for more details.
-CONSOLE ERROR: line 56: Uncaught HierarchyRequestError: Failed to execute 'insertNode' on 'Range': The node to be inserted contains the insertion point; it may not be inserted into itself.
-text
-a
-Test passes if it does not CRASH.
diff --git a/third_party/WebKit/LayoutTests/fast/css/first-letter-rtc-crash.html b/third_party/WebKit/LayoutTests/fast/css/first-letter-rtc-crash.html
deleted file mode 100644
index ff5e575..0000000
--- a/third_party/WebKit/LayoutTests/fast/css/first-letter-rtc-crash.html
+++ /dev/null
@@ -1,84 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-textarea { visibility: hidden; }
-button:optional, textarea:optional { display: block; }
-div:first-letter { color: red; }
-form:read-only { visibility: inherit; }
-</style>
-<script>
-if (window.testRunner)
-  testRunner.dumpAsText();
-
-var aoScriptElements = document.getElementsByTagName("script");
-for(var i = 0; i < aoScriptElements.length; i++) {
-  aoScriptElements[i].parentNode.removeChild(aoScriptElements[i]);
-}
-
-function event_DOMNodeRemoved() {
-  var oSelection = window.getSelection();
-  var oRange = oSelection.getRangeAt(47 % oSelection.rangeCount);
-  oSelection.addRange(oRange.cloneRange());
-
-}
-document.addEventListener("DOMNodeRemoved", event_DOMNodeRemoved, true);
-
-var active = false;
-function event_DOMNodeInserted() {
-  var aoElements = document.getElementsByTagName("*");
-  var oSelection=window.getSelection();
-
-  if (active) return ;
-  active = true;
-
-  var oElement = event.srcElement;
-  document.execCommand('FindString', false, 'Blarg');
-  oElement.outerHTML = "";
-
-  oSelection.getRangeAt(0).insertNode(aoElements[14 % aoElements.length]);
-
-  oSelection.deleteFromDocument();
-  active = false;
-}
-document.addEventListener("DOMNodeInserted", event_DOMNodeInserted, true);
-
-window.onload = function() {
-  var oSelection = window.getSelection();
-  document.execCommand("SelectAll", false, false)
-  oSelection.collapseToStart();
-
-  oSelection.getRangeAt(0).insertNode(document.getElementById('foreignobject'));
-
-  var oElement = document.getElementById('rtc');
-  oElement.insertAdjacentHTML('beforeend', '<b></b><b></b>');
-  oElement.textContent = "text";
-
-  oSelection.getRangeAt(0).insertNode(document.getElementById('button'));
-  oSelection.getRangeAt(0).insertNode(document.createElement('b'));
-}
-</script>
-
-<form>
-  <div>a</div>
-</form>
-
-<foreignObject id='foreignobject'></foreignObject>
-<textarea></textarea>
-
-<table>
-  <caption>
-    <ruby>
-      <button id='button'>
-        <em>
-          <textarea>AxBxC</textarea>
-        </em>
-
-        <rt></rt>
-        <select></select>
-
-        <rtc id='rtc'></rtc>
-      </button>
-    </ruby>
-  </caption>
-</table>
-Test passes if it does not CRASH.
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
index bbe2494..3ba94b6 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
@@ -155,12 +155,16 @@
   return layout_box_->styleRef();
 }
 
-NGBlockNode* NGBlockNode::NextSibling() {
+NGLayoutInputNode* NGBlockNode::NextSibling() {
   if (!next_sibling_) {
     LayoutObject* next_sibling =
         layout_box_ ? layout_box_->nextSibling() : nullptr;
-    NGBlockNode* box = next_sibling ? new NGBlockNode(next_sibling) : nullptr;
-    SetNextSibling(box);
+    if (next_sibling) {
+      if (next_sibling->isInline())
+        SetNextSibling(new NGInlineNode(next_sibling, &Style()));
+      else
+        SetNextSibling(new NGBlockNode(next_sibling));
+    }
   }
   return next_sibling_;
 }
@@ -183,7 +187,7 @@
   return first_child_;
 }
 
-void NGBlockNode::SetNextSibling(NGBlockNode* sibling) {
+void NGBlockNode::SetNextSibling(NGLayoutInputNode* sibling) {
   next_sibling_ = sibling;
 }
 
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_block_node.h b/third_party/WebKit/Source/core/layout/ng/ng_block_node.h
index 6fb7ddd..c25506c 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_block_node.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_block_node.h
@@ -35,7 +35,7 @@
 
   RefPtr<NGPhysicalFragment> Layout(
       NGConstraintSpace* constraint_space) override;
-  NGBlockNode* NextSibling() override;
+  NGLayoutInputNode* NextSibling() override;
   LayoutObject* GetLayoutObject() override;
 
   // Computes the value of min-content and max-content for this box.
@@ -50,7 +50,7 @@
 
   NGLayoutInputNode* FirstChild();
 
-  void SetNextSibling(NGBlockNode*);
+  void SetNextSibling(NGLayoutInputNode*);
   void SetFirstChild(NGLayoutInputNode*);
 
   void SetFragment(NGPhysicalBoxFragment* fragment) { fragment_ = fragment; }
@@ -84,7 +84,7 @@
   // combination.
   LayoutBox* layout_box_;
   RefPtr<ComputedStyle> style_;
-  Member<NGBlockNode> next_sibling_;
+  Member<NGLayoutInputNode> next_sibling_;
   Member<NGLayoutInputNode> first_child_;
   // TODO(mstensho): An input node may produce multiple fragments, so this
   // should probably be renamed to last_fragment_ or something like that, since
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
index 119e746..4853119 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
@@ -646,10 +646,6 @@
   // Query if depth_stencil buffer is supported.
   bool isDepthStencilSupported() { return m_isDepthStencilSupported; }
 
-  // Helper to return the size in bytes of OpenGL data types
-  // like GL_FLOAT, GL_INT, etc.
-  unsigned sizeInBytes(GLenum type) const;
-
   // Check if each enabled vertex attribute is bound to a buffer.
   bool validateRenderingState(const char*);
 
diff --git a/ui/accessibility/ax_position.h b/ui/accessibility/ax_position.h
index 5186c73..8a1cf0db 100644
--- a/ui/accessibility/ax_position.h
+++ b/ui/accessibility/ax_position.h
@@ -146,19 +146,18 @@
       }
     }
 
-    if (!IsTextPosition() || text_offset() > MaxTextOffset())
+    if (!IsTextPosition() || text_offset_ > MaxTextOffset())
       return str;
 
     std::string text = base::UTF16ToUTF8(GetInnerText());
     DCHECK_GE(text_offset_, 0);
     DCHECK_LE(text_offset_, static_cast<int>(text.length()));
     std::string annotated_text;
-    if (text_offset() == MaxTextOffset()) {
+    if (text_offset_ == MaxTextOffset()) {
       annotated_text = text + "<>";
     } else {
-      annotated_text = text.substr(0, text_offset()) + "<" +
-                       text[text_offset()] + ">" +
-                       text.substr(text_offset() + 1);
+      annotated_text = text.substr(0, text_offset_) + "<" + text[text_offset_] +
+                       ">" + text.substr(text_offset_ + 1);
     }
 
     return str + " annotated_text=" + annotated_text;