BASELINE: Update Chromium to 65.0.3325.151

Change-Id: I3c71dd500483eb29491ac3eee4123714dda52da9
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

29 files changed, 472 insertions, 59 deletions

diff --git a/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc b/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
index 8730105f5ac..12127ab774e 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
+++ b/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
@@ -297,6 +297,11 @@ IN_PROC_BROWSER_TEST_F(DumpAccessibilityTreeTest, AccessibilityActions) {
   RunHtmlTest(FILE_PATH_LITERAL("actions.html"));
 }
 
+IN_PROC_BROWSER_TEST_F(DumpAccessibilityTreeTest,
+                       AccessibilityAddClickListener) {
+  RunHtmlTest(FILE_PATH_LITERAL("add-click-listener.html"));
+}
+
 IN_PROC_BROWSER_TEST_F(DumpAccessibilityTreeTest, AccessibilityAddress) {
   RunHtmlTest(FILE_PATH_LITERAL("address.html"));
 }
diff --git a/chromium/content/browser/appcache/appcache_dispatcher_host.cc b/chromium/content/browser/appcache/appcache_dispatcher_host.cc
index 91068572304..d5c6a6f1266 100644
--- a/chromium/content/browser/appcache/appcache_dispatcher_host.cc
+++ b/chromium/content/browser/appcache/appcache_dispatcher_host.cc
@@ -12,7 +12,6 @@
 #include "content/browser/bad_message.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/browser_side_navigation_policy.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 
 namespace content {
 
@@ -33,13 +32,13 @@ AppCacheDispatcherHost::~AppCacheDispatcherHost() = default;
 void AppCacheDispatcherHost::Create(ChromeAppCacheService* appcache_service,
                                     int process_id,
                                     mojom::AppCacheBackendRequest request) {
-  mojo::MakeStrongBinding(
+  appcache_service->Bind(
       std::make_unique<AppCacheDispatcherHost>(appcache_service, process_id),
       std::move(request));
 }
 
 void AppCacheDispatcherHost::RegisterHost(int32_t host_id) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     // PlzNavigate
     // The AppCacheHost could have been precreated in which case we want to
     // register it with the backend here.
@@ -58,7 +57,7 @@ void AppCacheDispatcherHost::RegisterHost(int32_t host_id) {
 }
 
 void AppCacheDispatcherHost::UnregisterHost(int32_t host_id) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (!backend_impl_.UnregisterHost(host_id)) {
       mojo::ReportBadMessage("ACDH_UNREGISTER");
     }
@@ -67,7 +66,7 @@ void AppCacheDispatcherHost::UnregisterHost(int32_t host_id) {
 
 void AppCacheDispatcherHost::SetSpawningHostId(int32_t host_id,
                                                int spawning_host_id) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (!backend_impl_.SetSpawningHostId(host_id, spawning_host_id))
       mojo::ReportBadMessage("ACDH_SET_SPAWNING");
   }
@@ -77,7 +76,7 @@ void AppCacheDispatcherHost::SelectCache(int32_t host_id,
                                          const GURL& document_url,
                                          int64_t cache_document_was_loaded_from,
                                          const GURL& opt_manifest_url) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (!backend_impl_.SelectCache(host_id, document_url,
                                    cache_document_was_loaded_from,
                                    opt_manifest_url)) {
@@ -90,7 +89,7 @@ void AppCacheDispatcherHost::SelectCache(int32_t host_id,
 
 void AppCacheDispatcherHost::SelectCacheForSharedWorker(int32_t host_id,
                                                         int64_t appcache_id) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (!backend_impl_.SelectCacheForSharedWorker(host_id, appcache_id))
       mojo::ReportBadMessage("ACDH_SELECT_CACHE_FOR_SHARED_WORKER");
   } else {
@@ -102,7 +101,7 @@ void AppCacheDispatcherHost::MarkAsForeignEntry(
     int32_t host_id,
     const GURL& document_url,
     int64_t cache_document_was_loaded_from) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (!backend_impl_.MarkAsForeignEntry(host_id, document_url,
                                           cache_document_was_loaded_from)) {
       mojo::ReportBadMessage("ACDH_MARK_AS_FOREIGN_ENTRY");
@@ -114,7 +113,7 @@ void AppCacheDispatcherHost::GetResourceList(int32_t host_id,
                                              GetResourceListCallback callback) {
   std::vector<AppCacheResourceInfo> params;
   std::vector<mojom::AppCacheResourceInfoPtr> out;
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     backend_impl_.GetResourceList(host_id, &params);
 
     // Box up params for output.
@@ -128,7 +127,7 @@ void AppCacheDispatcherHost::GetResourceList(int32_t host_id,
 
 void AppCacheDispatcherHost::GetStatus(int32_t host_id,
                                        GetStatusCallback callback) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (backend_impl_.GetStatusWithCallback(host_id, &callback)) {
       return;
     } else {
@@ -140,7 +139,7 @@ void AppCacheDispatcherHost::GetStatus(int32_t host_id,
 
 void AppCacheDispatcherHost::StartUpdate(int32_t host_id,
                                          StartUpdateCallback callback) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (backend_impl_.StartUpdateWithCallback(host_id, &callback)) {
       return;
     } else {
@@ -152,7 +151,7 @@ void AppCacheDispatcherHost::StartUpdate(int32_t host_id,
 
 void AppCacheDispatcherHost::SwapCache(int32_t host_id,
                                        SwapCacheCallback callback) {
-  if (appcache_service_.get()) {
+  if (appcache_service_) {
     if (backend_impl_.SwapCacheWithCallback(host_id, &callback)) {
       return;
     } else {
diff --git a/chromium/content/browser/appcache/appcache_dispatcher_host.h b/chromium/content/browser/appcache/appcache_dispatcher_host.h
index be83670e8db..0b9e7d5657b 100644
--- a/chromium/content/browser/appcache/appcache_dispatcher_host.h
+++ b/chromium/content/browser/appcache/appcache_dispatcher_host.h
@@ -56,7 +56,8 @@ class AppCacheDispatcherHost : public mojom::AppCacheBackend {
   void GetResourceList(int32_t host_id,
                        GetResourceListCallback callback) override;
 
-  scoped_refptr<ChromeAppCacheService> appcache_service_;
+  // This object is owned by the |ChromeAppCacheService|, so this is safe.
+  ChromeAppCacheService* appcache_service_;
   AppCacheFrontendProxy frontend_proxy_;
   AppCacheBackendImpl backend_impl_;
 
diff --git a/chromium/content/browser/appcache/chrome_appcache_service.cc b/chromium/content/browser/appcache/chrome_appcache_service.cc
index db7f04b2cc4..d639909ef0d 100644
--- a/chromium/content/browser/appcache/chrome_appcache_service.cc
+++ b/chromium/content/browser/appcache/chrome_appcache_service.cc
@@ -43,6 +43,16 @@ void ChromeAppCacheService::InitializeOnIOThread(
   set_special_storage_policy(special_storage_policy.get());
 }
 
+void ChromeAppCacheService::Bind(
+    std::unique_ptr<mojom::AppCacheBackend> backend,
+    mojom::AppCacheBackendRequest request) {
+  bindings_.AddBinding(std::move(backend), std::move(request));
+}
+
+void ChromeAppCacheService::Shutdown() {
+  bindings_.CloseAllBindings();
+}
+
 bool ChromeAppCacheService::CanLoadAppCache(const GURL& manifest_url,
                                             const GURL& first_party) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
diff --git a/chromium/content/browser/appcache/chrome_appcache_service.h b/chromium/content/browser/appcache/chrome_appcache_service.h
index d4a2430c5ee..7845936ea43 100644
--- a/chromium/content/browser/appcache/chrome_appcache_service.h
+++ b/chromium/content/browser/appcache/chrome_appcache_service.h
@@ -11,7 +11,9 @@
 #include "base/sequenced_task_runner_helpers.h"
 #include "content/browser/appcache/appcache_policy.h"
 #include "content/browser/appcache/appcache_service_impl.h"
+#include "content/common/appcache.mojom.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/strong_binding_set.h"
 #include "storage/browser/quota/special_storage_policy.h"
 
 namespace base {
@@ -53,6 +55,11 @@ class CONTENT_EXPORT ChromeAppCacheService
       net::URLRequestContextGetter* request_context_getter,
       scoped_refptr<storage::SpecialStoragePolicy> special_storage_policy);
 
+  void Bind(std::unique_ptr<mojom::AppCacheBackend> backend,
+            mojom::AppCacheBackendRequest request);
+
+  void Shutdown();
+
   // AppCachePolicy overrides
   bool CanLoadAppCache(const GURL& manifest_url,
                        const GURL& first_party) override;
@@ -72,6 +79,7 @@ class CONTENT_EXPORT ChromeAppCacheService
 
   ResourceContext* resource_context_;
   base::FilePath cache_path_;
+  mojo::StrongBindingSet<mojom::AppCacheBackend> bindings_;
 
   DISALLOW_COPY_AND_ASSIGN(ChromeAppCacheService);
 };
diff --git a/chromium/content/browser/child_process_launcher_helper_mac.cc b/chromium/content/browser/child_process_launcher_helper_mac.cc
index fe69395324b..ebd44341ef2 100644
--- a/chromium/content/browser/child_process_launcher_helper_mac.cc
+++ b/chromium/content/browser/child_process_launcher_helper_mac.cc
@@ -25,6 +25,7 @@
 #include "services/service_manager/sandbox/mac/common_v2.sb.h"
 #include "services/service_manager/sandbox/mac/gpu_v2.sb.h"
 #include "services/service_manager/sandbox/mac/nacl_loader.sb.h"
+#include "services/service_manager/sandbox/mac/pdf_compositor.sb.h"
 #include "services/service_manager/sandbox/mac/ppapi_v2.sb.h"
 #include "services/service_manager/sandbox/mac/renderer_v2.sb.h"
 #include "services/service_manager/sandbox/mac/utility.sb.h"
@@ -113,8 +114,10 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
       case service_manager::SANDBOX_TYPE_RENDERER:
         profile += service_manager::kSeatbeltPolicyString_renderer_v2;
         break;
-      case service_manager::SANDBOX_TYPE_UTILITY:
       case service_manager::SANDBOX_TYPE_PDF_COMPOSITOR:
+        profile += service_manager::kSeatbeltPolicyString_pdf_compositor;
+        break;
+      case service_manager::SANDBOX_TYPE_UTILITY:
       case service_manager::SANDBOX_TYPE_PROFILING:
         profile += service_manager::kSeatbeltPolicyString_utility;
         break;
@@ -137,10 +140,10 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
       case service_manager::SANDBOX_TYPE_NACL_LOADER:
       case service_manager::SANDBOX_TYPE_PPAPI:
       case service_manager::SANDBOX_TYPE_RENDERER:
+      case service_manager::SANDBOX_TYPE_PDF_COMPOSITOR:
         SetupCommonSandboxParameters(seatbelt_exec_client_.get());
         break;
       case service_manager::SANDBOX_TYPE_UTILITY:
-      case service_manager::SANDBOX_TYPE_PDF_COMPOSITOR:
       case service_manager::SANDBOX_TYPE_PROFILING:
         SetupUtilitySandboxParameters(seatbelt_exec_client_.get(),
                                       *command_line_.get());
@@ -151,7 +154,7 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
 
     int pipe = seatbelt_exec_client_->SendProfileAndGetFD();
     if (pipe < 0) {
-      LOG(ERROR) << "pipe for sending sandbox profile is an invalid FD";
+      LOG(ERROR) << "Sending the seatbelt profile failed.";
       return false;
     }
 
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.cc b/chromium/content/browser/frame_host/render_frame_host_impl.cc
index 1879ab63097..bbb9f413e99 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.cc
@@ -3670,26 +3670,29 @@ void RenderFrameHostImpl::FailedNavigation(
   // completing an unload handler.
   ResetWaitingState();
 
-  StoragePartitionImpl* storage_partition =
-      static_cast<StoragePartitionImpl*>(BrowserContext::GetStoragePartition(
-          GetSiteInstance()->GetBrowserContext(), GetSiteInstance()));
-
-  network::mojom::URLLoaderFactoryPtr default_factory;
-  if (g_url_loader_factory_callback_for_test.Get().is_null()) {
-    storage_partition->GetNetworkContext()->CreateURLLoaderFactory(
-        mojo::MakeRequest(&default_factory), GetProcess()->GetID());
-  } else {
-    network::mojom::URLLoaderFactoryPtr original_factory;
-    storage_partition->GetNetworkContext()->CreateURLLoaderFactory(
-        mojo::MakeRequest(&original_factory), GetProcess()->GetID());
-    g_url_loader_factory_callback_for_test.Get().Run(
-        mojo::MakeRequest(&default_factory), GetProcess()->GetID(),
-        original_factory.PassInterface());
-  }
-
   base::Optional<URLLoaderFactoryBundle> subresource_loader_factories;
-  subresource_loader_factories.emplace();
-  subresource_loader_factories->SetDefaultFactory(std::move(default_factory));
+  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    StoragePartitionImpl* storage_partition =
+        static_cast<StoragePartitionImpl*>(BrowserContext::GetStoragePartition(
+            GetSiteInstance()->GetBrowserContext(), GetSiteInstance()));
+
+    network::mojom::URLLoaderFactoryPtr default_factory;
+    if (g_url_loader_factory_callback_for_test.Get().is_null()) {
+      storage_partition->GetNetworkContext()->CreateURLLoaderFactory(
+          mojo::MakeRequest(&default_factory), GetProcess()->GetID());
+    } else {
+      network::mojom::URLLoaderFactoryPtr original_factory;
+      storage_partition->GetNetworkContext()->CreateURLLoaderFactory(
+          mojo::MakeRequest(&original_factory), GetProcess()->GetID());
+      g_url_loader_factory_callback_for_test.Get().Run(
+          mojo::MakeRequest(&default_factory), GetProcess()->GetID(),
+          original_factory.PassInterface());
+    }
+
+
+    subresource_loader_factories.emplace();
+    subresource_loader_factories->SetDefaultFactory(std::move(default_factory));
+  }
 
   GetNavigationControl()->CommitFailedNavigation(
       common_params, request_params, has_stale_copy_in_cache, error_code,
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl.cc b/chromium/content/browser/gpu/gpu_data_manager_impl.cc
index 2ca8d121957..f1fecdc1ae4 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl.cc
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl.cc
@@ -117,6 +117,12 @@ void GpuDataManagerImpl::SetGpuInfo(const gpu::GPUInfo& gpu_info) {
   private_->SetGpuInfo(gpu_info);
 }
 
+void GpuDataManagerImpl::GetDisabledWebGLExtensions(
+    std::string* disabled_webgl_extensions) const {
+  base::AutoLock auto_lock(lock_);
+  private_->GetDisabledWebGLExtensions(disabled_webgl_extensions);
+}
+
 void GpuDataManagerImpl::Initialize() {
   base::AutoLock auto_lock(lock_);
   private_->Initialize();
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl.h b/chromium/content/browser/gpu/gpu_data_manager_impl.h
index 54e4e79e917..6342bde752c 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl.h
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl.h
@@ -89,6 +89,8 @@ class CONTENT_EXPORT GpuDataManagerImpl : public GpuDataManager {
   void GetDisabledExtensions(std::string* disabled_extensions) const override;
   void SetGpuInfo(const gpu::GPUInfo& gpu_info) override;
 
+  void GetDisabledWebGLExtensions(std::string* disabled_webgl_extensions) const;
+
   bool IsGpuFeatureInfoAvailable() const;
   gpu::GpuFeatureStatus GetFeatureStatus(gpu::GpuFeatureType feature) const;
 
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc b/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
index f5f51f69042..a399375e3cd 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
@@ -861,6 +861,12 @@ void GpuDataManagerImplPrivate::GetDisabledExtensions(
   *disabled_extensions = gpu_feature_info_.disabled_extensions;
 }
 
+void GpuDataManagerImplPrivate::GetDisabledWebGLExtensions(
+    std::string* disabled_webgl_extensions) const {
+  DCHECK(disabled_webgl_extensions);
+  *disabled_webgl_extensions = gpu_feature_info_.disabled_webgl_extensions;
+}
+
 void GpuDataManagerImplPrivate::BlockDomainFrom3DAPIs(
     const GURL& url, GpuDataManagerImpl::DomainGuilt guilt) {
   BlockDomainFrom3DAPIsAtTime(url, guilt, base::Time::Now());
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl_private.h b/chromium/content/browser/gpu/gpu_data_manager_impl_private.h
index b1d1f19e0a7..bfebf68e830 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl_private.h
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl_private.h
@@ -88,6 +88,7 @@ class CONTENT_EXPORT GpuDataManagerImplPrivate {
   void HandleGpuSwitch();
 
   void GetDisabledExtensions(std::string* disabled_extensions) const;
+  void GetDisabledWebGLExtensions(std::string* disabled_webgl_extensions) const;
 
   void BlockDomainFrom3DAPIs(
       const GURL& url, GpuDataManagerImpl::DomainGuilt guilt);
diff --git a/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc b/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc
index 05c1e100eb4..160cadaf50a 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc
+++ b/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc
@@ -23,6 +23,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry1,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -49,6 +51,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry2,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -75,6 +79,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry3,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -101,6 +107,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry4,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -127,6 +135,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry5,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -153,6 +163,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry6,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -179,6 +191,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry7,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -205,6 +219,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry8,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -231,6 +247,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry9,             // features
         0,                                 // DisabledExtensions size
         nullptr,                           // DisabledExtensions
+        0,                                 // DisabledWebGLExtensions size
+        nullptr,                           // DisabledWebGLExtensions
         0,                                 // CrBugs size
         nullptr,                           // CrBugs
         {
@@ -257,6 +275,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         kFeatureListForEntry10,             // features
         0,                                  // DisabledExtensions size
         nullptr,                            // DisabledExtensions
+        0,                                  // DisabledWebGLExtensions size
+        nullptr,                            // DisabledWebGLExtensions
         0,                                  // CrBugs size
         nullptr,                            // CrBugs
         {
diff --git a/chromium/content/browser/gpu/gpu_internals_ui.cc b/chromium/content/browser/gpu/gpu_internals_ui.cc
index faa2948051f..2861a054395 100644
--- a/chromium/content/browser/gpu/gpu_internals_ui.cc
+++ b/chromium/content/browser/gpu/gpu_internals_ui.cc
@@ -182,6 +182,10 @@ std::unique_ptr<base::DictionaryValue> GpuInfoAsDictionaryValue() {
   GpuDataManagerImpl::GetInstance()->GetDisabledExtensions(
       &disabled_extensions);
 
+  std::string disabled_webgl_extensions;
+  GpuDataManagerImpl::GetInstance()->GetDisabledWebGLExtensions(
+      &disabled_webgl_extensions);
+
   basic_info->Append(
       NewDescriptionValuePair("Driver vendor", gpu_info.driver_vendor));
   basic_info->Append(NewDescriptionValuePair("Driver version",
@@ -208,6 +212,8 @@ std::unique_ptr<base::DictionaryValue> GpuInfoAsDictionaryValue() {
                                              gpu_info.gl_extensions));
   basic_info->Append(NewDescriptionValuePair("Disabled Extensions",
                                              disabled_extensions));
+  basic_info->Append(NewDescriptionValuePair("Disabled WebGL Extensions",
+                                             disabled_webgl_extensions));
   basic_info->Append(NewDescriptionValuePair("Window system binding vendor",
                                              gpu_info.gl_ws_vendor));
   basic_info->Append(NewDescriptionValuePair("Window system binding version",
diff --git a/chromium/content/browser/quota_dispatcher_host.h b/chromium/content/browser/quota_dispatcher_host.h
index e850077aecd..681409e56ad 100644
--- a/chromium/content/browser/quota_dispatcher_host.h
+++ b/chromium/content/browser/quota_dispatcher_host.h
@@ -77,7 +77,7 @@ class QuotaDispatcherHost : public blink::mojom::QuotaDispatcherHost {
   // The ID of this process.
   int process_id_;
 
-  storage::QuotaManager* quota_manager_;
+  scoped_refptr<storage::QuotaManager> quota_manager_;
   scoped_refptr<QuotaPermissionContext> permission_context_;
 
   base::WeakPtrFactory<QuotaDispatcherHost> weak_factory_;
diff --git a/chromium/content/browser/renderer_host/render_message_filter.cc b/chromium/content/browser/renderer_host/render_message_filter.cc
index a9dc1297bb4..216d3799fb8 100644
--- a/chromium/content/browser/renderer_host/render_message_filter.cc
+++ b/chromium/content/browser/renderer_host/render_message_filter.cc
@@ -67,7 +67,7 @@
 #include "url/origin.h"
 
 #if defined(OS_WIN)
-#include "content/common/font_cache_dispatcher_win.h"
+#include "content/public/common/font_cache_dispatcher_win.h"
 #endif
 
 #if defined(OS_POSIX)
diff --git a/chromium/content/browser/renderer_host/render_process_host_browsertest.cc b/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
index 9a53e0170c6..d845ca2e1ec 100644
--- a/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
@@ -148,6 +148,11 @@ class RenderProcessHostWithKeepAliveOptionEnabledTest
     RenderProcessHostTest::SetUp();
   }
 
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitch(
+        switches::kEnableExperimentalWebPlatformFeatures);
+  }
+
  private:
   base::test::ScopedFeatureList feature_list_;
 };
diff --git a/chromium/content/browser/renderer_host/render_view_host_impl.cc b/chromium/content/browser/renderer_host/render_view_host_impl.cc
index 6d465203cbc..2666aecad29 100644
--- a/chromium/content/browser/renderer_host/render_view_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_impl.cc
@@ -813,8 +813,7 @@ void RenderViewHostImpl::OnRenderProcessGone(int status, int exit_code) {
 }
 
 void RenderViewHostImpl::OnUpdateTargetURL(const GURL& url) {
-  if (is_active_)
-    delegate_->UpdateTargetURL(this, url);
+  delegate_->UpdateTargetURL(this, url);
 
   // Send a notification back to the renderer that we are ready to
   // receive more target urls.
diff --git a/chromium/content/browser/renderer_host/render_widget_host_impl.cc b/chromium/content/browser/renderer_host/render_widget_host_impl.cc
index 2ee0858b2df..71e87977be5 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_impl.cc
@@ -14,6 +14,7 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/i18n/rtl.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
@@ -2709,13 +2710,24 @@ void RenderWidgetHostImpl::SubmitCompositorFrame(
   if (local_surface_id == last_local_surface_id_ &&
       SurfacePropertiesMismatch(new_surface_properties,
                                 last_surface_properties_)) {
+    std::string error = base::StringPrintf(
+        "[OOPIF? %d] %s\n", view_ && view_->IsRenderWidgetHostViewChildFrame(),
+        new_surface_properties.ToDiffString(last_surface_properties_).c_str());
+    LOG(ERROR) << "Surface invariants violation: " << error;
+
     static auto* crash_key = base::debug::AllocateCrashKeyString(
         "surface-invariants-violation", base::debug::CrashKeySize::Size256);
-    base::debug::ScopedCrashKeyString key_value(
-        crash_key,
-        new_surface_properties.ToDiffString(last_surface_properties_));
-    bad_message::ReceivedBadMessage(
-        GetProcess(), bad_message::RWH_SURFACE_INVARIANTS_VIOLATION);
+    base::debug::ScopedCrashKeyString key_value(crash_key, error);
+    base::debug::DumpWithoutCrashing();
+
+    if (view_) {
+      frame.metadata.begin_frame_ack.has_damage = false;
+      view_->OnDidNotProduceFrame(frame.metadata.begin_frame_ack);
+    }
+    std::vector<viz::ReturnedResource> resources =
+        viz::TransferableResource::ReturnResources(frame.resource_list);
+    renderer_compositor_frame_sink_->DidReceiveCompositorFrameAck(resources);
+
     return;
   }
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
index 2c81b9db02b..06517661144 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
@@ -7,11 +7,13 @@
 #include "base/run_loop.h"
 #include "base/test/scoped_task_environment.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
+#include "content/browser/renderer_host/render_widget_targeter.h"
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/mock_render_widget_host_delegate.h"
 #include "content/test/mock_widget_impl.h"
 #include "content/test/test_render_view_host.h"
+#include "services/viz/public/interfaces/hit_test/input_target_client.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -56,13 +58,17 @@ class MockRootRenderWidgetHostView : public MockRenderWidgetHostView {
   MockRootRenderWidgetHostView(
       RenderWidgetHost* rwh,
       std::map<MockRenderWidgetHostView*, viz::FrameSinkId>& frame_sink_id_map)
-      : MockRenderWidgetHostView(rwh), frame_sink_id_map_(frame_sink_id_map) {}
+      : MockRenderWidgetHostView(rwh),
+        frame_sink_id_map_(frame_sink_id_map),
+        force_query_renderer_on_hit_test_(false) {}
   ~MockRootRenderWidgetHostView() override {}
 
   viz::FrameSinkId FrameSinkIdAtPoint(viz::SurfaceHittestDelegate*,
                                       const gfx::PointF&,
                                       gfx::PointF*,
-                                      bool*) override {
+                                      bool* query_renderer) override {
+    if (force_query_renderer_on_hit_test_)
+      *query_renderer = true;
     return frame_sink_id_map_[current_hittest_result_];
   }
 
@@ -77,9 +83,14 @@ class MockRootRenderWidgetHostView : public MockRenderWidgetHostView {
     current_hittest_result_ = view;
   }
 
+  void set_force_query_renderer_on_hit_test(bool force) {
+    force_query_renderer_on_hit_test_ = force;
+  }
+
  private:
   std::map<MockRenderWidgetHostView*, viz::FrameSinkId>& frame_sink_id_map_;
   MockRenderWidgetHostView* current_hittest_result_;
+  bool force_query_renderer_on_hit_test_;
 };
 
 }  // namespace
@@ -288,4 +299,132 @@ TEST_F(RenderWidgetHostInputEventRouterTest, EnsureDroppedTouchEventsAreAcked) {
   EXPECT_EQ(view_root_->last_id_for_touch_ack(), 2lu);
 }
 
+TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceTouchEvents) {
+  RenderWidgetTargeter* targeter = rwhier_.GetRenderWidgetTargeterForTests();
+  view_root_->SetHittestResult(view_root_.get());
+  view_root_->set_force_query_renderer_on_hit_test(true);
+
+  // We need to set up a comm pipe, or else the targeter will crash when it
+  // tries to query the renderer. It doesn't matter that the pipe isn't
+  // connected on the other end, as we really don't want it to respond anyways.
+  std::unique_ptr<service_manager::InterfaceProvider> remote_interfaces =
+      std::make_unique<service_manager::InterfaceProvider>();
+  viz::mojom::InputTargetClientPtr input_target_client;
+  remote_interfaces->GetInterface(&input_target_client);
+  widget_host1_->SetInputTargetClient(std::move(input_target_client));
+
+  // Send TouchStart, TouchMove, TouchMove, TouchMove, TouchEnd and make sure
+  // the targeter doesn't attempt to coalesce.
+  blink::WebTouchEvent touch_event(blink::WebInputEvent::kTouchStart,
+                                   blink::WebInputEvent::kNoModifiers,
+                                   blink::WebInputEvent::kTimeStampForTesting);
+  touch_event.touches_length = 1;
+  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.unique_touch_event_id = 1;
+
+  EXPECT_EQ(0u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_FALSE(targeter->is_request_in_flight_for_testing());
+  rwhier_.RouteTouchEvent(view_root_.get(), &touch_event,
+                          ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(0u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  touch_event.SetType(blink::WebInputEvent::kTouchMove);
+  touch_event.touches[0].state = blink::WebTouchPoint::kStateMoved;
+  touch_event.unique_touch_event_id += 1;
+  rwhier_.RouteTouchEvent(view_root_.get(), &touch_event,
+                          ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(1u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  touch_event.unique_touch_event_id += 1;
+  rwhier_.RouteTouchEvent(view_root_.get(), &touch_event,
+                          ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(2u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  touch_event.SetType(blink::WebInputEvent::kTouchEnd);
+  touch_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+  touch_event.unique_touch_event_id += 1;
+  rwhier_.RouteTouchEvent(view_root_.get(), &touch_event,
+                          ui::LatencyInfo(ui::SourceEventType::TOUCH));
+
+  EXPECT_EQ(3u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+}
+
+TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceGestureEvents) {
+  RenderWidgetTargeter* targeter = rwhier_.GetRenderWidgetTargeterForTests();
+  view_root_->SetHittestResult(view_root_.get());
+  view_root_->set_force_query_renderer_on_hit_test(true);
+
+  // We need to set up a comm pipe, or else the targeter will crash when it
+  // tries to query the renderer. It doesn't matter that the pipe isn't
+  // connected on the other end, as we really don't want it to respond anyways.
+  std::unique_ptr<service_manager::InterfaceProvider> remote_interfaces =
+      std::make_unique<service_manager::InterfaceProvider>();
+  viz::mojom::InputTargetClientPtr input_target_client;
+  remote_interfaces->GetInterface(&input_target_client);
+  widget_host1_->SetInputTargetClient(std::move(input_target_client));
+
+  // Send TouchStart, GestureTapDown, TouchEnd, GestureScrollBegin,
+  // GestureScrollUpdate (x2), GestureScrollEnd and make sure
+  // the targeter doesn't attempt to coalesce.
+  blink::WebTouchEvent touch_event(blink::WebInputEvent::kTouchStart,
+                                   blink::WebInputEvent::kNoModifiers,
+                                   blink::WebInputEvent::kTimeStampForTesting);
+  touch_event.touches_length = 1;
+  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.unique_touch_event_id = 1;
+
+  EXPECT_EQ(0u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_FALSE(targeter->is_request_in_flight_for_testing());
+  rwhier_.RouteTouchEvent(view_root_.get(), &touch_event,
+                          ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(0u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  blink::WebGestureEvent gesture_event(
+      blink::WebInputEvent::kGestureTapDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::kTimeStampForTesting);
+  gesture_event.source_device = blink::kWebGestureDeviceTouchscreen;
+  gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
+  rwhier_.RouteGestureEvent(view_root_.get(), &gesture_event,
+                            ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(1u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  touch_event.SetType(blink::WebInputEvent::kTouchEnd);
+  touch_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+  touch_event.unique_touch_event_id += 1;
+  rwhier_.RouteTouchEvent(view_root_.get(), &touch_event,
+                          ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(2u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  gesture_event.SetType(blink::WebInputEvent::kGestureScrollBegin);
+  rwhier_.RouteGestureEvent(view_root_.get(), &gesture_event,
+                            ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(3u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  gesture_event.SetType(blink::WebInputEvent::kGestureScrollUpdate);
+  rwhier_.RouteGestureEvent(view_root_.get(), &gesture_event,
+                            ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(4u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  gesture_event.SetType(blink::WebInputEvent::kGestureScrollUpdate);
+  rwhier_.RouteGestureEvent(view_root_.get(), &gesture_event,
+                            ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(5u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+
+  gesture_event.SetType(blink::WebInputEvent::kGestureScrollEnd);
+  rwhier_.RouteGestureEvent(view_root_.get(), &gesture_event,
+                            ui::LatencyInfo(ui::SourceEventType::TOUCH));
+  EXPECT_EQ(6u, targeter->num_requests_in_queue_for_testing());
+  EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_targeter.cc b/chromium/content/browser/renderer_host/render_widget_targeter.cc
index db94eea33af..40549b7e067 100644
--- a/chromium/content/browser/renderer_host/render_widget_targeter.cc
+++ b/chromium/content/browser/renderer_host/render_widget_targeter.cc
@@ -17,7 +17,9 @@ namespace {
 
 bool MergeEventIfPossible(const blink::WebInputEvent& event,
                           ui::WebScopedInputEvent* blink_event) {
-  if (ui::CanCoalesce(event, **blink_event)) {
+  if (!blink::WebInputEvent::IsTouchEventType(event.GetType()) &&
+      !blink::WebInputEvent::IsGestureEventType(event.GetType()) &&
+      ui::CanCoalesce(event, **blink_event)) {
     ui::Coalesce(event, blink_event->get());
     return true;
   }
@@ -258,7 +260,9 @@ void RenderWidgetTargeter::FoundTarget(
     const blink::WebInputEvent& event,
     const ui::LatencyInfo& latency,
     const base::Optional<gfx::PointF>& target_location) {
-  if (!root_view)
+  // RenderWidgetHostViewMac can be deleted asynchronously, in which case the
+  // View will be valid but there will no longer be a RenderWidgetHostImpl.
+  if (!root_view || !root_view->GetRenderWidgetHost())
     return;
   // TODO: Unify position conversion for all event types.
   if (blink::WebInputEvent::IsMouseEventType(event.GetType())) {
diff --git a/chromium/content/browser/renderer_host/render_widget_targeter.h b/chromium/content/browser/renderer_host/render_widget_targeter.h
index a3a4f648b5f..7aac783ab05 100644
--- a/chromium/content/browser/renderer_host/render_widget_targeter.h
+++ b/chromium/content/browser/renderer_host/render_widget_targeter.h
@@ -86,6 +86,9 @@ class RenderWidgetTargeter {
     async_hit_test_timeout_delay_ = delay;
   }
 
+  unsigned num_requests_in_queue_for_testing() { return requests_.size(); }
+  bool is_request_in_flight_for_testing() { return request_in_flight_; }
+
  private:
   // Attempts to target and dispatch all events in the queue. It stops if it has
   // to query a client, or if the queue becomes empty.
diff --git a/chromium/content/browser/service_manager/common_browser_interfaces.cc b/chromium/content/browser/service_manager/common_browser_interfaces.cc
index caa62521975..25170497efa 100644
--- a/chromium/content/browser/service_manager/common_browser_interfaces.cc
+++ b/chromium/content/browser/service_manager/common_browser_interfaces.cc
@@ -24,7 +24,7 @@
 
 #if defined(OS_WIN)
 #include "content/browser/renderer_host/dwrite_font_proxy_message_filter_win.h"
-#include "content/common/font_cache_dispatcher_win.h"
+#include "content/public/common/font_cache_dispatcher_win.h"
 #endif
 
 namespace content {
diff --git a/chromium/content/browser/service_worker/service_worker_browsertest.cc b/chromium/content/browser/service_worker/service_worker_browsertest.cc
index 5ac5504ff07..76cdd7e5081 100644
--- a/chromium/content/browser/service_worker/service_worker_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_browsertest.cc
@@ -16,6 +16,7 @@
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
+#include "base/metrics/statistics_recorder.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string16.h"
@@ -969,6 +970,38 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest, StartAndStop) {
   stop_run_loop.Run();
 }
 
+IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest,
+                       DropCountsOnBlinkUseCounter) {
+  StartServerAndNavigateToSetup();
+  RunOnIOThread(base::Bind(&self::SetUpRegistrationOnIOThread,
+                           base::Unretained(this),
+                           "/service_worker/worker.js"));
+  // Start a worker.
+  ServiceWorkerStatusCode status = SERVICE_WORKER_ERROR_FAILED;
+  base::RunLoop start_run_loop;
+  BrowserThread::PostTask(
+      BrowserThread::IO, FROM_HERE,
+      base::BindOnce(&self::StartOnIOThread, base::Unretained(this),
+                     start_run_loop.QuitClosure(), &status));
+  start_run_loop.Run();
+  ASSERT_EQ(SERVICE_WORKER_OK, status);
+
+  // Expect no PageVisits count.
+  EXPECT_EQ(nullptr, base::StatisticsRecorder::FindHistogram(
+                         "Blink.UseCounter.Features"));
+
+  // Stop the worker.
+  base::RunLoop stop_run_loop;
+  BrowserThread::PostTask(
+      BrowserThread::IO, FROM_HERE,
+      base::BindOnce(&self::StopOnIOThread, base::Unretained(this),
+                     stop_run_loop.QuitClosure()));
+  stop_run_loop.Run();
+  // Expect no PageVisits count.
+  EXPECT_EQ(nullptr, base::StatisticsRecorder::FindHistogram(
+                         "Blink.UseCounter.Features"));
+}
+
 IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest, StartNotFound) {
   StartServerAndNavigateToSetup();
   RunOnIOThread(base::Bind(&self::SetUpRegistrationOnIOThread,
diff --git a/chromium/content/browser/site_per_process_browsertest.cc b/chromium/content/browser/site_per_process_browsertest.cc
index 0565e9ddfa0..645960a3262 100644
--- a/chromium/content/browser/site_per_process_browsertest.cc
+++ b/chromium/content/browser/site_per_process_browsertest.cc
@@ -1983,6 +1983,77 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   }
 }
 
+// Ensure that the scrollability of a local subframe in an OOPIF is considered
+// when acknowledging GestureScrollBegin events sent to OOPIFs.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollLocalSubframeInOOPIF) {
+  ui::GestureConfiguration::GetInstance()->set_scroll_debounce_interval_in_ms(
+      0);
+
+  // This must be tall enough such that the outer iframe is not scrollable.
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/frame_tree/page_with_tall_positioned_frame.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  // It is safe to obtain the root frame tree node here, as it doesn't change.
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  ASSERT_EQ(1U, root->child_count());
+
+  FrameTreeNode* parent_iframe_node = root->child_at(0);
+  GURL outer_frame_url(embedded_test_server()->GetURL(
+      "baz.com", "/frame_tree/page_with_positioned_frame.html"));
+  NavigateFrameToURL(parent_iframe_node, outer_frame_url);
+
+  // This must be tall enough such that the inner iframe is scrollable.
+  FrameTreeNode* nested_iframe_node = parent_iframe_node->child_at(0);
+  GURL inner_frame_url(
+      embedded_test_server()->GetURL("baz.com", "/tall_page.html"));
+  NavigateFrameToURL(nested_iframe_node, inner_frame_url);
+
+  ASSERT_EQ(
+      " Site A ------------ proxies for B\n"
+      "   +--Site B ------- proxies for A\n"
+      "        +--Site B -- proxies for A\n"
+      "Where A = http://a.com/\n"
+      "      B = http://baz.com/",
+      DepictFrameTree(root));
+
+  RenderWidgetHostViewBase* rwhv_child = static_cast<RenderWidgetHostViewBase*>(
+      nested_iframe_node->current_frame_host()
+          ->GetRenderWidgetHost()
+          ->GetView());
+
+  WaitForChildFrameSurfaceReady(parent_iframe_node->current_frame_host());
+
+  // When we scroll the inner frame, we should have the GSB be consumed.
+  // The outer iframe not being scrollable should not cause the GSB to go
+  // unconsumed.
+  InputEventAckWaiter ack_observer(
+      parent_iframe_node->current_frame_host()->GetRenderWidgetHost(),
+      base::BindRepeating([](content::InputEventAckSource,
+                             content::InputEventAckState state,
+                             const blink::WebInputEvent& event) {
+        return event.GetType() == blink::WebGestureEvent::kGestureScrollBegin &&
+               state == content::INPUT_EVENT_ACK_STATE_CONSUMED;
+      }));
+
+  // Wait until renderer's compositor thread is synced. Otherwise the non fast
+  // scrollable regions won't be set when the event arrives.
+  MainThreadFrameObserver observer(rwhv_child->GetRenderWidgetHost());
+  observer.Wait();
+
+  // Now scroll the inner frame downward,
+  blink::WebMouseWheelEvent scroll_event(
+      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::kTimeStampForTesting);
+  scroll_event.SetPositionInWidget(90, 110);
+  scroll_event.delta_x = 0.0f;
+  scroll_event.delta_y = -50.0f;
+  scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
+  scroll_event.has_precise_scrolling_deltas = true;
+  rwhv_child->ProcessMouseWheelEvent(scroll_event, ui::LatencyInfo());
+  ack_observer.Wait();
+}
+
 // This test verifies that scrolling an element to view works across OOPIFs.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollElementIntoView) {
   GURL url_domain_a(
diff --git a/chromium/content/browser/storage_partition_impl.cc b/chromium/content/browser/storage_partition_impl.cc
index 375eccf87f2..f9a87e8a264 100644
--- a/chromium/content/browser/storage_partition_impl.cc
+++ b/chromium/content/browser/storage_partition_impl.cc
@@ -487,6 +487,12 @@ StoragePartitionImpl::~StoragePartitionImpl() {
   if (GetPaymentAppContext())
     GetPaymentAppContext()->Shutdown();
 
+  if (GetAppCacheService()) {
+    BrowserThread::PostTask(
+        BrowserThread::IO, FROM_HERE,
+        base::BindOnce(&ChromeAppCacheService::Shutdown, appcache_service_));
+  }
+
   BrowserThread::DeleteSoon(BrowserThread::IO, FROM_HERE,
                             std::move(network_context_owner_));
 }
diff --git a/chromium/content/browser/web_contents/web_contents_impl.cc b/chromium/content/browser/web_contents/web_contents_impl.cc
index 3484edd8578..829401d6438 100644
--- a/chromium/content/browser/web_contents/web_contents_impl.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl.cc
@@ -3777,7 +3777,7 @@ void WebContentsImpl::DidNavigateMainFramePostCommit(
     // clicking on a link); see bugs 1184641 and 980803. We don't want to
     // clear the bubble when a user navigates to a named anchor in the same
     // page.
-    UpdateTargetURL(render_frame_host->GetRenderViewHost(), GURL());
+    ClearTargetURL();
 
     RenderWidgetHostViewBase* rwhvb =
         static_cast<RenderWidgetHostViewBase*>(GetRenderWidgetHostView());
@@ -4939,16 +4939,29 @@ void WebContentsImpl::RenderViewDeleted(RenderViewHost* rvh) {
 void WebContentsImpl::UpdateTargetURL(RenderViewHost* render_view_host,
                                       const GURL& url) {
   if (fullscreen_widget_routing_id_ != MSG_ROUTING_NONE) {
-    // If we're fullscreen only update the url if it's from the fullscreen
-    // renderer.
+    // If we're in flash fullscreen (i.e. Pepper plugin fullscreen) only update
+    // the url if it's from the fullscreen renderer.
     RenderWidgetHostView* fs = GetFullscreenRenderWidgetHostView();
     if (fs && fs->GetRenderWidgetHost() != render_view_host->GetWidget())
       return;
   }
+
+  // In case of racey updates from multiple RenderViewHosts, the last URL should
+  // be shown - see also some discussion in https://crbug.com/807776.
+  if (!url.is_valid() && render_view_host != view_that_set_last_target_url_)
+    return;
+  view_that_set_last_target_url_ = url.is_valid() ? render_view_host : nullptr;
+
   if (delegate_)
     delegate_->UpdateTargetURL(this, url);
 }
 
+void WebContentsImpl::ClearTargetURL() {
+  view_that_set_last_target_url_ = nullptr;
+  if (delegate_)
+    delegate_->UpdateTargetURL(this, GURL());
+}
+
 void WebContentsImpl::Close(RenderViewHost* rvh) {
 #if defined(OS_MACOSX)
   // The UI may be in an event-tracking loop, such as between the
diff --git a/chromium/content/browser/web_contents/web_contents_impl.h b/chromium/content/browser/web_contents/web_contents_impl.h
index 18f4c9f12ad..3d24182d36a 100644
--- a/chromium/content/browser/web_contents/web_contents_impl.h
+++ b/chromium/content/browser/web_contents/web_contents_impl.h
@@ -1326,6 +1326,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // Reattaches this inner WebContents to its outer WebContents.
   void ReattachToOuterWebContentsFrame();
 
+  // A helper for clearing the link status bubble after navigating away.
+  // See also UpdateTargetURL.
+  void ClearTargetURL();
+
   // Data for core operation ---------------------------------------------------
 
   // Delegate for notifying our owner about stuff. Not owned by us.
@@ -1664,6 +1668,9 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
 
   bool was_ever_audible_ = false;
 
+  // Helper variable for resolving races in UpdateTargetURL / ClearTargetURL.
+  RenderViewHost* view_that_set_last_target_url_ = nullptr;
+
   base::WeakPtrFactory<WebContentsImpl> loading_weak_factory_;
   base::WeakPtrFactory<WebContentsImpl> weak_factory_;
 
diff --git a/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc b/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
index 3463fdb35fb..92ceacb36b4 100644
--- a/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
@@ -5,11 +5,14 @@
 #include <utility>
 
 #include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/optional.h"
 #include "base/run_loop.h"
 #include "base/strings/pattern.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "build/build_config.h"
+#include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
@@ -25,6 +28,8 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/resource_dispatcher_host.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/url_constants.h"
@@ -39,6 +44,7 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "url/gurl.h"
 
 namespace content {
 
@@ -1599,4 +1605,56 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   ASSERT_EQ(title, base::ASCIIToUTF16("done"));
 }
 
+class UpdateTargetURLWaiter : public WebContentsDelegate {
+ public:
+  UpdateTargetURLWaiter(WebContents* web_contents) {
+    web_contents->SetDelegate(this);
+  }
+
+  const GURL& WaitForUpdatedTargetURL() {
+    if (updated_target_url_.has_value())
+      return updated_target_url_.value();
+
+    runner_ = new MessageLoopRunner();
+    runner_->Run();
+    return updated_target_url_.value();
+  }
+
+ private:
+  void UpdateTargetURL(WebContents* source, const GURL& url) override {
+    updated_target_url_ = url;
+    if (runner_.get())
+      runner_->QuitClosure().Run();
+  }
+
+  base::Optional<GURL> updated_target_url_;
+  scoped_refptr<MessageLoopRunner> runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(UpdateTargetURLWaiter);
+};
+
+// Verifies that focusing a link in a cross-site frame will correctly tell
+// WebContentsDelegate to show a link status bubble.  This is a regression test
+// for https://crbug.com/807776.
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, UpdateTargetURL) {
+  // Navigate to a test page.
+  ASSERT_TRUE(embedded_test_server()->Start());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  GURL url = embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)");
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  FrameTreeNode* subframe = web_contents->GetFrameTree()->root()->child_at(0);
+  GURL subframe_url =
+      embedded_test_server()->GetURL("b.com", "/simple_links.html");
+  NavigateFrameToURL(subframe, subframe_url);
+
+  // Focusing the link should fire the UpdateTargetURL notification.
+  UpdateTargetURLWaiter target_url_waiter(web_contents);
+  EXPECT_TRUE(ExecuteScript(
+      subframe, "document.getElementById('cross_site_link').focus();"));
+  EXPECT_EQ(GURL("http://foo.com/title2.html"),
+            target_url_waiter.WaitForUpdatedTargetURL());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc b/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
index be18d3ce17e..6b4f0a6dc3c 100644
--- a/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
@@ -796,13 +796,6 @@ IN_PROC_BROWSER_TEST_F(WebRtcGetUserMediaBrowserTest,
   ExecuteJavascriptAndWaitForOk("concurrentGetUserMediaStop()");
 }
 
-IN_PROC_BROWSER_TEST_F(WebRtcGetUserMediaBrowserTest, DisabledTrackVideoSize) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL("/media/getusermedia.html"));
-  NavigateToURL(shell(), url);
-  ExecuteJavascriptAndWaitForOk("disabledTrackVideoSize()");
-}
-
 IN_PROC_BROWSER_TEST_F(WebRtcGetUserMediaBrowserTest,
                        GetUserMediaAfterStopElementCapture) {
   ASSERT_TRUE(embedded_test_server()->Start());