BASELINE: Update Chromium to 86.0.4240.124

Change-Id: Ide0ff151e94cd665ae6521a446995d34a9d1d644
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

85 files changed, 690 insertions, 1356 deletions

diff --git a/chromium/content/common/BUILD.gn b/chromium/content/common/BUILD.gn
index 64f33a3027b..262eeee4a39 100644
--- a/chromium/content/common/BUILD.gn
+++ b/chromium/content/common/BUILD.gn
@@ -56,11 +56,6 @@ source_set("common") {
     "android/use_zoom_for_dsf_policy_android.cc",
     "appcache_interfaces.cc",
     "appcache_interfaces.h",
-    "ax_content_node_data.cc",
-    "ax_content_node_data.h",
-    "ax_content_tree_data.cc",
-    "ax_content_tree_data.h",
-    "ax_content_tree_update.h",
     "ax_serialization_utils.cc",
     "ax_serialization_utils.h",
     "background_fetch/background_fetch_types.cc",
@@ -126,7 +121,6 @@ source_set("common") {
     "input/gesture_event_stream_validator.cc",
     "input/gesture_event_stream_validator.h",
     "input/input_event_ack_state.cc",
-    "input/input_event_dispatch_type.h",
     "input/input_event_stream_validator.cc",
     "input/input_event_stream_validator.h",
     "input/synthetic_gesture_params.cc",
@@ -189,9 +183,9 @@ source_set("common") {
     "skia_utils.cc",
     "skia_utils.h",
     "state_transitions.h",
-    "text_input_client_messages.h",
     "thread_pool_util.cc",
     "thread_pool_util.h",
+    "trace_utils.h",
     "unfreezable_frame_messages.h",
     "unique_name_helper.cc",
     "unique_name_helper.h",
@@ -199,8 +193,6 @@ source_set("common") {
     "url_schemes.h",
     "user_agent.cc",
     "view_messages.h",
-    "visual_properties.cc",
-    "visual_properties.h",
     "web_package/signed_exchange_utils.cc",
     "web_package/signed_exchange_utils.h",
     "widget_messages.h",
@@ -218,15 +210,17 @@ source_set("common") {
     "//cc/ipc",
     "//gpu/command_buffer/common",
     "//ipc",
+    "//sandbox/policy",
     "//services/network:network_service",
     "//services/service_manager/public/cpp",
-    "//services/service_manager/sandbox",
     "//third_party/blink/public:blink_headers",
     "//third_party/blink/public/common",
     "//ui/accessibility",
     "//ui/accessibility/mojom",
     "//ui/base/cursor:cursor_base",
     "//ui/base/cursor/mojom:cursor_type",
+    "//ui/base/dragdrop/mojom:mojom_headers",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/events/ipc",
   ]
   deps = [
@@ -234,6 +228,7 @@ source_set("common") {
     "//base",
     "//base/third_party/dynamic_annotations",
     "//build:branding_buildflags",
+    "//build:lacros_buildflags",
     "//build/util:webkit_version",
     "//components/discardable_memory/common",
     "//components/services/filesystem/public/mojom",
@@ -313,8 +308,8 @@ source_set("common") {
   if (is_android && use_seccomp_bpf) {
     set_sources_assignment_filter([])
     sources += [
-      "//services/service_manager/sandbox/linux/bpf_base_policy_linux.cc",
-      "//services/service_manager/sandbox/linux/bpf_base_policy_linux.h",
+      "//sandbox/policy/linux/bpf_base_policy_linux.cc",
+      "//sandbox/policy/linux/bpf_base_policy_linux.h",
     ]
     set_sources_assignment_filter(sources_assignment_filter)
   }
@@ -352,7 +347,7 @@ source_set("common") {
     sources -= [ "cursors/webcursor_aura.cc" ]
   }
 
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     sources += [
       "zygote/sandbox_support_linux.cc",
       "zygote/send_zygote_child_ping_linux.cc",
@@ -436,10 +431,8 @@ mojom("mojo_bindings") {
   disable_variants = true
 
   sources = [
+    "agent_scheduling_group.mojom",
     "associated_interfaces.mojom",
-    "ax_content_node_data.mojom",
-    "ax_content_tree_data.mojom",
-    "ax_content_tree_update.mojom",
     "child_process.mojom",
     "document_scoped_interface_bundle.mojom",
     "dom_automation_controller.mojom",
@@ -452,8 +445,6 @@ mojom("mojo_bindings") {
     "histogram_fetcher.mojom",
     "input/input_injector.mojom",
     "media/media_log_records.mojom",
-    "media/renderer_audio_input_stream_factory.mojom",
-    "media/renderer_audio_output_stream_factory.mojom",
     "native_types.mojom",
     "navigation_client.mojom",
     "navigation_params.mojom",
@@ -465,6 +456,7 @@ mojom("mojo_bindings") {
     "renderer.mojom",
     "renderer_host.mojom",
     "renderer_variations_configuration.mojom",
+    "web_ui.mojom",
   ]
 
   enabled_features = []
@@ -482,57 +474,6 @@ mojom("mojo_bindings") {
     {
       types = [
         {
-          mojom = "ax.mojom.AXContentNodeData"
-          cpp = "::content::AXContentNodeData"
-        },
-      ]
-      traits_headers =
-          [ "//content/common/ax_content_node_data_mojom_traits.h" ]
-      traits_sources =
-          [ "//content/common/ax_content_node_data_mojom_traits.cc" ]
-      traits_public_deps = [
-        ":mojo_bindings_shared",
-        "//ui/accessibility",
-      ]
-      traits_deps = [ "//ui/accessibility/mojom" ]
-    },
-    {
-      types = [
-        {
-          mojom = "ax.mojom.AXContentTreeData"
-          cpp = "::content::AXContentTreeData"
-        },
-      ]
-      traits_headers =
-          [ "//content/common/ax_content_tree_data_mojom_traits.h" ]
-      traits_sources =
-          [ "//content/common/ax_content_tree_data_mojom_traits.cc" ]
-      traits_public_deps = [
-        ":mojo_bindings_shared",
-        "//ui/accessibility",
-      ]
-      traits_deps = [ "//ui/accessibility/mojom" ]
-    },
-    {
-      types = [
-        {
-          mojom = "ax.mojom.AXContentTreeUpdate"
-          cpp = "::content::AXContentTreeUpdate"
-        },
-      ]
-      traits_headers =
-          [ "//content/common/ax_content_tree_update_mojom_traits.h" ]
-      traits_sources =
-          [ "//content/common/ax_content_tree_update_mojom_traits.cc" ]
-      traits_public_deps = [
-        ":mojo_bindings_shared",
-        "//ui/accessibility",
-      ]
-      traits_deps = [ "//ui/accessibility/mojom" ]
-    },
-    {
-      types = [
-        {
           mojom = "content.mojom.DidCommitProvisionalLoadParams"
           cpp = "::std::unique_ptr<::FrameHostMsg_DidCommitProvisionalLoad_Params>"
           move_only = true
@@ -598,7 +539,7 @@ mojom("mojo_bindings") {
         },
         {
           mojom = "content.mojom.VisualProperties"
-          cpp = "::content::VisualProperties"
+          cpp = "::blink::VisualProperties"
         },
         {
           mojom = "content.mojom.WebCursor"
@@ -619,7 +560,7 @@ mojom("mojo_bindings") {
         "//content/common/input/synthetic_smooth_drag_gesture_params.h",
         "//content/common/input/synthetic_smooth_scroll_gesture_params.h",
         "//content/common/input/synthetic_tap_gesture_params.h",
-        "//content/common/visual_properties.h",
+        "//third_party/blink/public/common/widget/visual_properties.h",
         "//content/public/common/web_preferences.h",
         "//net/base/network_change_notifier.h",
         "//third_party/blink/public/common/input/web_coalesced_input_event_mojom_traits.h",
diff --git a/chromium/content/common/DEPS b/chromium/content/common/DEPS
index 8154671148c..9bbfb476a06 100644
--- a/chromium/content/common/DEPS
+++ b/chromium/content/common/DEPS
@@ -6,11 +6,11 @@ include_rules = [
   "+components/payments",
   "+device/base/synchronization",
   "+services/media_session/public/cpp",
+  "+services/device/public/mojom",
   "+services/network/public/cpp",
   "+services/network/public/mojom",
   "+services/resource_coordinator/public/mojom",
   "+services/service_manager/public/cpp",
-  "+services/service_manager/sandbox",
   "+services/video_capture/public/mojom",
   "+services/viz/public/cpp",
   "+services/viz/public/mojom",
@@ -30,7 +30,7 @@ include_rules = [
   "+third_party/blink/public/platform/web_http_body.h",
   "+third_party/blink/public/platform/web_history_scroll_restoration_type.h",
   "+third_party/blink/public/platform/web_mixed_content_context_type.h",
-  "+third_party/blink/public/platform/web_screen_info.h",
+  "+third_party/blink/public/common/widget/screen_info.h",
   "+third_party/blink/public/platform/web_storage_area.h",
   "+third_party/blink/public/platform/web_text_autosizer_page_info.h",
   "+third_party/blink/public/platform/linux/web_fallback_font.h",
@@ -39,7 +39,7 @@ include_rules = [
   "+third_party/blink/public/platform/modules/remoteplayback/web_remote_playback_availability.h",
   "+third_party/blink/public/platform/modules/service_worker/web_service_worker_error.h",
   "+third_party/blink/public/web/web_ax_enums.h",
-  "+third_party/blink/public/web/web_device_emulation_params.h",
+  "+third_party/blink/public/common/widget/device_emulation_params.h",
   "+third_party/blink/public/web/web_drag_status.h",
   "+third_party/blink/public/web/web_frame_owner_properties.h",
   "+third_party/blink/public/web/win/web_font_rendering.h",
diff --git a/chromium/content/common/agent_scheduling_group.mojom b/chromium/content/common/agent_scheduling_group.mojom
new file mode 100644
index 00000000000..df10b27c630
--- /dev/null
+++ b/chromium/content/common/agent_scheduling_group.mojom
@@ -0,0 +1,15 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+// Interface for general communication between AgentSchedulingGroup and
+// AgentSchedulingGroupHost.
+interface AgentSchedulingGroupHost {
+};
+
+// Interface for general communication between AgentSchedulingGroupHost and
+// AgentSchedulingGroup.
+interface AgentSchedulingGroup {
+};
diff --git a/chromium/content/common/android/cpu_time_metrics.cc b/chromium/content/common/android/cpu_time_metrics.cc
index 9c5490d76a0..476107eac61 100644
--- a/chromium/content/common/android/cpu_time_metrics.cc
+++ b/chromium/content/common/android/cpu_time_metrics.cc
@@ -8,18 +8,21 @@
 
 #include <atomic>
 #include <memory>
+#include <utility>
 
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/containers/flat_map.h"
+#include "base/cpu.h"
 #include "base/lazy_instance.h"
-#include "base/message_loop/message_loop_current.h"
+#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
 #include "base/process/process_metrics.h"
 #include "base/sequence_checker.h"
 #include "base/strings/pattern.h"
 #include "base/strings/string_util.h"
+#include "base/task/current_thread.h"
 #include "base/task/post_task.h"
 #include "base/task/task_observer.h"
 #include "base/threading/platform_thread.h"
@@ -89,6 +92,60 @@ const char* GetPerThreadHistogramNameForProcessType(ProcessTypeForUma type) {
   }
 }
 
+std::string GetPerCoreCpuTimeHistogramName(ProcessTypeForUma process_type,
+                                           base::CPU::CoreType core_type,
+                                           bool is_approximate) {
+  std::string process_suffix;
+  switch (process_type) {
+    case ProcessTypeForUma::kBrowser:
+      process_suffix = "Browser";
+      break;
+    case ProcessTypeForUma::kRenderer:
+      process_suffix = "Renderer";
+      break;
+    case ProcessTypeForUma::kGpu:
+      process_suffix = "GPU";
+      break;
+    default:
+      process_suffix = "Other";
+      break;
+  }
+
+  std::string cpu_suffix;
+  switch (core_type) {
+    case base::CPU::CoreType::kUnknown:
+      cpu_suffix = "Unknown";
+      break;
+    case base::CPU::CoreType::kOther:
+      cpu_suffix = "Other";
+      break;
+    case base::CPU::CoreType::kSymmetric:
+      cpu_suffix = "Symmetric";
+      break;
+    case base::CPU::CoreType::kBigLittle_Little:
+      cpu_suffix = "BigLittle.Little";
+      break;
+    case base::CPU::CoreType::kBigLittle_Big:
+      cpu_suffix = "BigLittle.Big";
+      break;
+    case base::CPU::CoreType::kBigLittleBigger_Little:
+      cpu_suffix = "BigLittleBigger.Little";
+      break;
+    case base::CPU::CoreType::kBigLittleBigger_Big:
+      cpu_suffix = "BigLittleBigger.Big";
+      break;
+    case base::CPU::CoreType::kBigLittleBigger_Bigger:
+      cpu_suffix = "BigLittleBigger.Bigger";
+      break;
+  }
+
+  std::string prefix = std::string("Power.") +
+                       (is_approximate ? "Approx" : "") +
+                       "CpuTimeSecondsPerCoreTypeAndFrequency";
+
+  return base::JoinString({prefix, cpu_suffix, process_suffix}, ".");
+}
+
 // Keep in sync with CpuTimeMetricsThreadType in
 // //tools/metrics/histograms/enums.xml.
 enum class CpuTimeMetricsThreadType {
@@ -192,6 +249,35 @@ CpuTimeMetricsThreadType GetThreadTypeFromName(const char* const thread_name) {
   return CpuTimeMetricsThreadType::kOtherThread;
 }
 
+class TimeInStateReporter {
+ public:
+  TimeInStateReporter(ProcessTypeForUma process_type,
+                      base::CPU::CoreType core_type,
+                      bool is_approximate)
+      : histogram_(GetPerCoreCpuTimeHistogramName(process_type,
+                                                  core_type,
+                                                  is_approximate),
+                   1,
+                   // ScaledLinearHistogram requires buckets of size 1. Each
+                   // bucket here represents a range of frequency values.
+                   kNumBuckets,
+                   kNumBuckets + 1,
+                   base::Time::kMicrosecondsPerSecond,
+                   base::HistogramBase::kUmaTargetedHistogramFlag) {}
+
+  void AddMicroseconds(int frequency_mhz, int cpu_time_us) {
+    int frequency_bucket = frequency_mhz / kBucketSizeMhz;
+    histogram_.AddScaledCount(frequency_bucket, cpu_time_us);
+  }
+
+ private:
+  static constexpr int32_t kMaxFrequencyMhz = 10 * 1000;  // 10 GHz.
+  static constexpr int32_t kBucketSizeMhz = 50;  // one bucket for every 50 MHz.
+  static constexpr int32_t kNumBuckets = kMaxFrequencyMhz / kBucketSizeMhz;
+
+  base::ScaledLinearHistogram histogram_;
+};
+
 // Samples the process's CPU time after a specific number of task were executed
 // on the current thread (process main). The number of tasks is a crude proxy
 // for CPU activity within this process. We sample more frequently when the
@@ -261,16 +347,70 @@ class ProcessCpuTimeTaskObserver : public base::TaskObserver {
     // GetCumulativeCPUUsage() may return a negative value if sampling failed.
     base::TimeDelta cumulative_cpu_time =
         process_metrics_->GetCumulativeCPUUsage();
-    base::TimeDelta cpu_time_delta = cumulative_cpu_time - reported_cpu_time_;
-    if (cpu_time_delta > base::TimeDelta()) {
-      UMA_HISTOGRAM_SCALED_ENUMERATION(
-          "Power.CpuTimeSecondsPerProcessType", process_type_,
-          cpu_time_delta.InMicroseconds(), base::Time::kMicrosecondsPerSecond);
+    base::TimeDelta process_cpu_time_delta =
+        cumulative_cpu_time - reported_cpu_time_;
+    if (process_cpu_time_delta > base::TimeDelta()) {
+      UMA_HISTOGRAM_SCALED_ENUMERATION("Power.CpuTimeSecondsPerProcessType",
+                                       process_type_,
+                                       process_cpu_time_delta.InMicroseconds(),
+                                       base::Time::kMicrosecondsPerSecond);
       reported_cpu_time_ = cumulative_cpu_time;
     }
 
+    // Approximate breakdown by CPU core type & frequency. The per-pid
+    // time_in_state used by the per-thread breakdown isn't supported by many
+    // kernels. This breakdown approximates Chrome's total per
+    // core-type/frequency usage by splitting the process's CPU time across
+    // cores/frequencies according to global per-core time_in_state values.
+    if (base::CPU::GetTimeInState(time_in_state_)) {
+      // Compute the total CPU time delta since the last cycle across all
+      // clusters and frequencies, so that we can compute proportional deltas in
+      // the second loop below.
+      base::TimeDelta total_cumulative;
+      for (const base::CPU::TimeInStateEntry& entry : time_in_state_) {
+        total_cumulative += entry.cumulative_cpu_time;
+      }
+
+      base::TimeDelta total_delta =
+          total_cumulative - total_reported_time_in_state_;
+      total_reported_time_in_state_ = total_cumulative;
+
+      if (process_cpu_time_delta > base::TimeDelta() &&
+          total_delta > base::TimeDelta()) {
+        for (const base::CPU::TimeInStateEntry& entry : time_in_state_) {
+          DCHECK_GT(approximate_time_in_state_reporters_.size(),
+                    static_cast<size_t>(entry.core_type));
+          std::unique_ptr<TimeInStateReporter>& reporter =
+              approximate_time_in_state_reporters_[static_cast<size_t>(
+                  entry.core_type)];
+          if (!reporter) {
+            reporter = std::make_unique<TimeInStateReporter>(
+                process_type_, entry.core_type, /*is_approximate=*/true);
+          }
+
+          // Compute delta since last cycle per entry.
+          uint32_t frequency_mhz = entry.core_frequency_khz / 1000;
+          base::TimeDelta& reported_time =
+              reported_time_in_state_[std::make_tuple(
+                  entry.core_type, entry.cluster_core_index, frequency_mhz)];
+          base::TimeDelta time_delta =
+              entry.cumulative_cpu_time - reported_time;
+          reported_time = entry.cumulative_cpu_time;
+
+          if (time_delta > base::TimeDelta()) {
+            // Scale the process's cpu time by each cluster/frequency pair's
+            // relative proportion of execution time.
+            uint64_t delta_us = (process_cpu_time_delta.InMicroseconds() *
+                                 time_delta.InMicroseconds()) /
+                                total_delta.InMicroseconds();
+            reporter->AddMicroseconds(frequency_mhz, delta_us);
+          }
+        }
+      }
+    }
+
     // Also report a breakdown by thread type.
-    base::TimeDelta unattributed_delta = cpu_time_delta;
+    base::TimeDelta unattributed_delta = process_cpu_time_delta;
     if (process_metrics_->GetCumulativeCPUUsagePerThread(
             cumulative_thread_times_)) {
       for (const auto& entry : cumulative_thread_times_) {
@@ -306,6 +446,44 @@ class ProcessCpuTimeTaskObserver : public base::TaskObserver {
         thread_details->reported_cpu_time = cumulative_time;
       }
 
+      // Breakdown by CPU core type & frequency.
+      if (process_metrics_->GetPerThreadCumulativeCPUTimeInState(
+              time_in_state_per_thread_)) {
+        auto thread_it = thread_details_.end();
+        for (const base::ProcessMetrics::ThreadTimeInState& entry :
+             time_in_state_per_thread_) {
+          DCHECK_GT(time_in_state_reporters_.size(),
+                    static_cast<size_t>(entry.core_type));
+          std::unique_ptr<TimeInStateReporter>& reporter =
+              time_in_state_reporters_[static_cast<size_t>(entry.core_type)];
+          if (!reporter) {
+            reporter = std::make_unique<TimeInStateReporter>(
+                process_type_, entry.core_type,
+                /*is_approximate=*/false);
+          }
+
+          if (thread_it == thread_details_.end() ||
+              thread_it->first != entry.thread_id) {
+            thread_it = thread_details_.find(entry.thread_id);
+            if (thread_it == thread_details_.end()) {
+              // New thread that we didn't pick up above. We'll report it in the
+              // next cycle instead.
+              continue;
+            }
+          }
+
+          uint32_t frequency_mhz = entry.core_frequency_khz / 1000;
+          base::TimeDelta& reported_time =
+              thread_it->second.reported_time_in_state[std::make_tuple(
+                  entry.core_type, entry.cluster_core_index, frequency_mhz)];
+          base::TimeDelta time_delta =
+              entry.cumulative_cpu_time - reported_time;
+          reported_time = entry.cumulative_cpu_time;
+
+          reporter->AddMicroseconds(frequency_mhz, time_delta.InMicroseconds());
+        }
+      }
+
       // Erase tracking for threads that have disappeared, as their
       // PlatformThreadId may be reused later.
       for (auto it = thread_details_.begin(); it != thread_details_.end();) {
@@ -328,10 +506,16 @@ class ProcessCpuTimeTaskObserver : public base::TaskObserver {
   }
 
  private:
+  using ClusterFrequency = std::tuple<base::CPU::CoreType,
+                                      uint32_t /*cluster_core_index*/,
+                                      uint32_t /*frequency_mhz*/>;
+
   struct ThreadDetails {
     base::TimeDelta reported_cpu_time;
     uint32_t last_updated_cycle = 0;
     CpuTimeMetricsThreadType type = CpuTimeMetricsThreadType::kOtherThread;
+    base::flat_map<ClusterFrequency, base::TimeDelta /*time_in_state*/>
+        reported_time_in_state;
   };
 
   void ReportThreadCpuTimeDelta(CpuTimeMetricsThreadType type,
@@ -372,9 +556,20 @@ class ProcessCpuTimeTaskObserver : public base::TaskObserver {
   ProcessTypeForUma process_type_;
   base::PlatformThreadId main_thread_id_;
   base::TimeDelta reported_cpu_time_;
-  // Stored as instance variable to avoid allocation churn.
-  base::ProcessMetrics::CPUUsagePerThread cumulative_thread_times_;
   base::flat_map<base::PlatformThreadId, ThreadDetails> thread_details_;
+  std::array<std::unique_ptr<TimeInStateReporter>,
+             static_cast<size_t>(base::CPU::CoreType::kMaxValue) + 1u>
+      time_in_state_reporters_ = {};
+  std::array<std::unique_ptr<TimeInStateReporter>,
+             static_cast<size_t>(base::CPU::CoreType::kMaxValue) + 1u>
+      approximate_time_in_state_reporters_ = {};
+  base::flat_map<ClusterFrequency, base::TimeDelta /*time_in_state*/>
+      reported_time_in_state_;
+  base::TimeDelta total_reported_time_in_state_;
+  // Stored as instance variables to avoid allocation churn.
+  base::ProcessMetrics::CPUUsagePerThread cumulative_thread_times_;
+  base::ProcessMetrics::TimeInStatePerThread time_in_state_per_thread_;
+  base::CPU::TimeInState time_in_state_;
 
   // Accessed on both sequences.
   std::atomic<bool> collection_in_progress_;
@@ -387,7 +582,7 @@ void SetupCpuTimeMetrics() {
   static bool did_setup = false;
   if (did_setup)
     return;
-  base::MessageLoopCurrent::Get()->AddTaskObserver(
+  base::CurrentThread::Get()->AddTaskObserver(
       ProcessCpuTimeTaskObserver::GetInstance());
   did_setup = true;
 }
diff --git a/chromium/content/common/ax_content_node_data.cc b/chromium/content/common/ax_content_node_data.cc
deleted file mode 100644
index d40a068fabe..00000000000
--- a/chromium/content/common/ax_content_node_data.cc
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/ax_content_node_data.h"
-
-#include <algorithm>
-
-#include "base/strings/string_number_conversions.h"
-#include "content/common/ax_content_node_data.mojom.h"
-
-using base::NumberToString;
-
-namespace content {
-
-AXContentNodeData& AXContentNodeData::operator=(const AXNodeData& other) {
-  *static_cast<AXNodeData*>(this) = other;
-  return *this;
-}
-
-std::string AXContentNodeData::ToString() const {
-  std::string result = AXNodeData::ToString();
-  if (child_routing_id != MSG_ROUTING_NONE)
-    result += " child_routing_id=" + NumberToString(child_routing_id);
-  return result;
-}
-
-}  // namespace ui
diff --git a/chromium/content/common/ax_content_node_data.h b/chromium/content/common/ax_content_node_data.h
deleted file mode 100644
index af23817eb94..00000000000
--- a/chromium/content/common/ax_content_node_data.h
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_AX_CONTENT_NODE_DATA_H_
-#define CONTENT_COMMON_AX_CONTENT_NODE_DATA_H_
-
-#include <stdint.h>
-
-#include "content/common/content_export.h"
-#include "ipc/ipc_message.h"
-#include "ui/accessibility/ax_node_data.h"
-
-namespace content {
-
-// A subclass of AXNodeData that contains extra fields for
-// content-layer-specific AX attributes.
-struct CONTENT_EXPORT AXContentNodeData : public ui::AXNodeData {
-  AXContentNodeData() = default;
-  AXContentNodeData(const AXContentNodeData& other) = default;
-  ~AXContentNodeData() override = default;
-  AXContentNodeData& operator=(const AXNodeData& other);
-
-  // Return a string representation of this data, for debugging.
-  std::string ToString() const override;
-
-  // The routing ID of this node's child tree.
-  int32_t child_routing_id = MSG_ROUTING_NONE;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_AX_CONTENT_NODE_DATA_H_
diff --git a/chromium/content/common/ax_content_node_data.mojom b/chromium/content/common/ax_content_node_data.mojom
deleted file mode 100644
index ffc5d33437b..00000000000
--- a/chromium/content/common/ax_content_node_data.mojom
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module ax.mojom;
-
-import "ui/accessibility/mojom/ax_node_data.mojom";
-
-// See content::AXContentNodeData for comments / explanations of these fields.
-struct AXContentNodeData {
-  ax.mojom.AXNodeData node_data;
-  int32 child_routing_id;
-};
diff --git a/chromium/content/common/ax_content_node_data_mojom_traits.cc b/chromium/content/common/ax_content_node_data_mojom_traits.cc
deleted file mode 100644
index 197060a6850..00000000000
--- a/chromium/content/common/ax_content_node_data_mojom_traits.cc
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/ax_content_node_data_mojom_traits.h"
-#include "ui/accessibility/ax_node_data.h"
-#include "ui/accessibility/mojom/ax_node_data_mojom_traits.h"
-
-namespace mojo {
-
-// static
-bool StructTraits<
-    ax::mojom::AXContentNodeDataDataView,
-    content::AXContentNodeData>::Read(ax::mojom::AXContentNodeDataDataView data,
-                                      content::AXContentNodeData* out) {
-  if (!data.ReadNodeData(static_cast<ui::AXNodeData*>(out)))
-    return false;
-
-  out->child_routing_id = data.child_routing_id();
-
-  return true;
-}
-
-}  // namespace mojo
diff --git a/chromium/content/common/ax_content_node_data_mojom_traits.h b/chromium/content/common/ax_content_node_data_mojom_traits.h
deleted file mode 100644
index 6b5800f93f6..00000000000
--- a/chromium/content/common/ax_content_node_data_mojom_traits.h
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_AX_CONTENT_NODE_DATA_MOJOM_TRAITS_H_
-#define CONTENT_COMMON_AX_CONTENT_NODE_DATA_MOJOM_TRAITS_H_
-
-#include "content/common/ax_content_node_data.h"
-#include "content/common/ax_content_node_data.mojom-shared.h"
-#include "ui/accessibility/ax_node_data.h"
-
-namespace mojo {
-
-template <>
-struct StructTraits<ax::mojom::AXContentNodeDataDataView,
-                    content::AXContentNodeData> {
-  static const ui::AXNodeData& node_data(const content::AXContentNodeData& p) {
-    return p;
-  }
-  static int32_t child_routing_id(const content::AXContentNodeData& p) {
-    return p.child_routing_id;
-  }
-
-  static bool Read(ax::mojom::AXContentNodeDataDataView data,
-                   content::AXContentNodeData* out);
-};
-
-}  // namespace mojo
-
-#endif  // CONTENT_COMMON_AX_CONTENT_NODE_DATA_MOJOM_TRAITS_H_
diff --git a/chromium/content/common/ax_content_tree_data.cc b/chromium/content/common/ax_content_tree_data.cc
deleted file mode 100644
index a9c6fc86484..00000000000
--- a/chromium/content/common/ax_content_tree_data.cc
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/ax_content_tree_data.h"
-
-#include "base/strings/string_number_conversions.h"
-
-using base::NumberToString;
-
-namespace content {
-
-std::string AXContentTreeData::ToString() const {
-  std::string result = AXTreeData::ToString();
-
-  if (routing_id != MSG_ROUTING_NONE)
-    result += " routing_id=" + NumberToString(routing_id);
-  if (parent_routing_id != MSG_ROUTING_NONE)
-    result += " parent_routing_id=" + NumberToString(parent_routing_id);
-
-  return result;
-}
-
-}  // namespace content
diff --git a/chromium/content/common/ax_content_tree_data.h b/chromium/content/common/ax_content_tree_data.h
deleted file mode 100644
index 31c849cb8d9..00000000000
--- a/chromium/content/common/ax_content_tree_data.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_AX_CONTENT_TREE_DATA_H_
-#define CONTENT_COMMON_AX_CONTENT_TREE_DATA_H_
-
-#include <stdint.h>
-
-#include "content/common/content_export.h"
-#include "ipc/ipc_message.h"
-#include "ui/accessibility/ax_tree_data.h"
-
-namespace content {
-
-// A subclass of AXTreeData that contains extra fields for
-// content-layer-specific AX attributes.
-struct CONTENT_EXPORT AXContentTreeData : public ui::AXTreeData {
-  AXContentTreeData() = default;
-  ~AXContentTreeData() override = default;
-
-  // Return a string representation of this data, for debugging.
-  std::string ToString() const override;
-
-  // The routing ID of this frame.
-  int routing_id = MSG_ROUTING_NONE;
-
-  // The routing ID of the parent frame.
-  int parent_routing_id = MSG_ROUTING_NONE;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_AX_CONTENT_TREE_DATA_H_
diff --git a/chromium/content/common/ax_content_tree_data.mojom b/chromium/content/common/ax_content_tree_data.mojom
deleted file mode 100644
index 154ea56d5b9..00000000000
--- a/chromium/content/common/ax_content_tree_data.mojom
+++ /dev/null
@@ -1,14 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module ax.mojom;
-
-import "ui/accessibility/mojom/ax_tree_data.mojom";
-
-// See content::AXContentTreeData for comments / explanations of these fields.
-struct AXContentTreeData {
-  ax.mojom.AXTreeData tree_data;
-  int32 routing_id;
-  int32 parent_routing_id;
-};
diff --git a/chromium/content/common/ax_content_tree_data_mojom_traits.cc b/chromium/content/common/ax_content_tree_data_mojom_traits.cc
deleted file mode 100644
index af214e24667..00000000000
--- a/chromium/content/common/ax_content_tree_data_mojom_traits.cc
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/ax_content_tree_data_mojom_traits.h"
-#include "ui/accessibility/ax_tree_data.h"
-#include "ui/accessibility/mojom/ax_tree_data_mojom_traits.h"
-
-namespace mojo {
-
-// static
-bool StructTraits<
-    ax::mojom::AXContentTreeDataDataView,
-    content::AXContentTreeData>::Read(ax::mojom::AXContentTreeDataDataView data,
-                                      content::AXContentTreeData* out) {
-  if (!data.ReadTreeData(static_cast<ui::AXTreeData*>(out)))
-    return false;
-
-  out->routing_id = data.routing_id();
-  out->parent_routing_id = data.parent_routing_id();
-
-  return true;
-}
-
-}  // namespace mojo
diff --git a/chromium/content/common/ax_content_tree_data_mojom_traits.h b/chromium/content/common/ax_content_tree_data_mojom_traits.h
deleted file mode 100644
index 2dbbd42b8bd..00000000000
--- a/chromium/content/common/ax_content_tree_data_mojom_traits.h
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_AX_CONTENT_TREE_DATA_MOJOM_TRAITS_H_
-#define CONTENT_COMMON_AX_CONTENT_TREE_DATA_MOJOM_TRAITS_H_
-
-#include "content/common/ax_content_tree_data.h"
-#include "content/common/ax_content_tree_data.mojom-shared.h"
-#include "ui/accessibility/ax_tree_data.h"
-
-namespace mojo {
-
-template <>
-struct StructTraits<ax::mojom::AXContentTreeDataDataView,
-                    content::AXContentTreeData> {
-  static const ui::AXTreeData& tree_data(const content::AXContentTreeData& p) {
-    return p;
-  }
-  static int32_t routing_id(const content::AXContentTreeData& p) {
-    return p.routing_id;
-  }
-  static int32_t parent_routing_id(const content::AXContentTreeData& p) {
-    return p.parent_routing_id;
-  }
-
-  static bool Read(ax::mojom::AXContentTreeDataDataView data,
-                   content::AXContentTreeData* out);
-};
-
-}  // namespace mojo
-
-#endif  // CONTENT_COMMON_AX_CONTENT_TREE_DATA_MOJOM_TRAITS_H_
diff --git a/chromium/content/common/ax_content_tree_update.h b/chromium/content/common/ax_content_tree_update.h
deleted file mode 100644
index 3bc36481888..00000000000
--- a/chromium/content/common/ax_content_tree_update.h
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_AX_CONTENT_TREE_UPDATE_H_
-#define CONTENT_COMMON_AX_CONTENT_TREE_UPDATE_H_
-
-#include "content/common/ax_content_node_data.h"
-#include "content/common/ax_content_tree_data.h"
-#include "content/common/content_export.h"
-#include "ui/accessibility/ax_tree_update.h"
-
-namespace content {
-
-typedef ui::AXTreeUpdateBase<content::AXContentNodeData,
-                             content::AXContentTreeData>
-    AXContentTreeUpdate;
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_AX_CONTENT_TREE_UPDATE_H_
diff --git a/chromium/content/common/ax_content_tree_update.mojom b/chromium/content/common/ax_content_tree_update.mojom
deleted file mode 100644
index 2b09af73695..00000000000
--- a/chromium/content/common/ax_content_tree_update.mojom
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module ax.mojom;
-
-import "ui/accessibility/ax_enums.mojom";
-import "content/common/ax_content_node_data.mojom";
-import "content/common/ax_content_tree_data.mojom";
-import "ui/accessibility/mojom/ax_event_intent.mojom";
-
-// See ui::AXTreeUpdate for comments / explanations of these fields.
-struct AXContentTreeUpdate {
-  bool has_tree_data;
-  AXContentTreeData tree_data;
-  int32 node_id_to_clear;
-  int32 root_id;
-  array<AXContentNodeData> nodes;
-  ax.mojom.EventFrom event_from;
-  array<EventIntent> event_intents;
-};
diff --git a/chromium/content/common/ax_content_tree_update_mojom_traits.cc b/chromium/content/common/ax_content_tree_update_mojom_traits.cc
deleted file mode 100644
index 58b8fb1635c..00000000000
--- a/chromium/content/common/ax_content_tree_update_mojom_traits.cc
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/ax_content_tree_update_mojom_traits.h"
-
-namespace mojo {
-
-// static
-bool StructTraits<ax::mojom::AXContentTreeUpdateDataView,
-                  content::AXContentTreeUpdate>::
-    Read(ax::mojom::AXContentTreeUpdateDataView data,
-         content::AXContentTreeUpdate* out) {
-  if (!data.ReadTreeData(&out->tree_data))
-    return false;
-
-  if (!data.ReadNodes(&out->nodes))
-    return false;
-
-  out->has_tree_data = data.has_tree_data();
-  out->node_id_to_clear = data.node_id_to_clear();
-  out->root_id = data.root_id();
-  out->event_from = data.event_from();
-
-  return data.ReadEventIntents(&out->event_intents);
-}
-
-}  // namespace mojo
diff --git a/chromium/content/common/ax_content_tree_update_mojom_traits.h b/chromium/content/common/ax_content_tree_update_mojom_traits.h
deleted file mode 100644
index 2c6cc08b674..00000000000
--- a/chromium/content/common/ax_content_tree_update_mojom_traits.h
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_AX_CONTENT_TREE_UPDATE_MOJOM_TRAITS_H_
-#define CONTENT_COMMON_AX_CONTENT_TREE_UPDATE_MOJOM_TRAITS_H_
-
-#include "content/common/ax_content_node_data.h"
-#include "content/common/ax_content_node_data_mojom_traits.h"
-#include "content/common/ax_content_tree_data.h"
-#include "content/common/ax_content_tree_data_mojom_traits.h"
-#include "content/common/ax_content_tree_update.h"
-#include "content/common/ax_content_tree_update.mojom-shared.h"
-#include "ui/accessibility/mojom/ax_event_intent_mojom_traits.h"
-
-namespace mojo {
-
-template <>
-struct StructTraits<ax::mojom::AXContentTreeUpdateDataView,
-                    content::AXContentTreeUpdate> {
-  static bool has_tree_data(const content::AXContentTreeUpdate& p) {
-    return p.has_tree_data;
-  }
-  static const content::AXContentTreeData& tree_data(
-      const content::AXContentTreeUpdate& p) {
-    return p.tree_data;
-  }
-  static int32_t node_id_to_clear(const content::AXContentTreeUpdate& p) {
-    return p.node_id_to_clear;
-  }
-  static int32_t root_id(const content::AXContentTreeUpdate& p) {
-    return p.root_id;
-  }
-  static const std::vector<content::AXContentNodeData>& nodes(
-      const content::AXContentTreeUpdate& p) {
-    return p.nodes;
-  }
-
-  static ax::mojom::EventFrom event_from(
-      const content::AXContentTreeUpdate& p) {
-    return p.event_from;
-  }
-
-  static std::vector<ui::AXEventIntent> event_intents(
-      const content::AXContentTreeUpdate& p) {
-    return p.event_intents;
-  }
-
-  static bool Read(ax::mojom::AXContentTreeUpdateDataView data,
-                   content::AXContentTreeUpdate* out);
-};
-
-}  // namespace mojo
-
-#endif  // CONTENT_COMMON_AX_CONTENT_TREE_UPDATE_MOJOM_TRAITS_H_
diff --git a/chromium/content/common/ax_serialization_utils.cc b/chromium/content/common/ax_serialization_utils.cc
index 0cefb2aebbe..fca897842de 100644
--- a/chromium/content/common/ax_serialization_utils.cc
+++ b/chromium/content/common/ax_serialization_utils.cc
@@ -9,7 +9,7 @@
 namespace content {
 
 bool AXShouldIncludePageScaleFactorInRoot() {
-#if !defined(OS_ANDROID) && !defined(OS_MACOSX)
+#if !defined(OS_ANDROID) && !defined(OS_MAC)
   return true;
 #else
   return false;
diff --git a/chromium/content/common/background_fetch/background_fetch_types.cc b/chromium/content/common/background_fetch/background_fetch_types.cc
index b6923364844..eb94075a422 100644
--- a/chromium/content/common/background_fetch/background_fetch_types.cc
+++ b/chromium/content/common/background_fetch/background_fetch_types.cc
@@ -32,7 +32,8 @@ blink::mojom::FetchAPIResponsePtr BackgroundFetchSettledFetch::CloneResponse(
   return blink::mojom::FetchAPIResponse::New(
       response->url_list, response->status_code, response->status_text,
       response->response_type, response->response_source, response->headers,
-      response->mime_type, CloneSerializedBlob(response->blob), response->error,
+      response->mime_type, response->request_method,
+      CloneSerializedBlob(response->blob), response->error,
       response->response_time, response->cache_storage_cache_name,
       response->cors_exposed_header_names,
       CloneSerializedBlob(response->side_data_blob),
diff --git a/chromium/content/common/child_process.mojom b/chromium/content/common/child_process.mojom
index d85e2810e9d..635be0b6dfe 100644
--- a/chromium/content/common/child_process.mojom
+++ b/chromium/content/common/child_process.mojom
@@ -95,4 +95,9 @@ interface ChildProcess {
   // Used for the coverage builds.
   [EnableIf=clang_profiling_inside_sandbox]
   SetProfilingFile(mojo_base.mojom.File file);
+
+  // Write out the accumulated code profiling profile to the configured file.
+  // The callback is invoked once the profile has been flushed to disk.
+  [EnableIf=clang_profiling_inside_sandbox]
+  WriteClangProfilingProfile() => ();
 };
diff --git a/chromium/content/common/child_process_host_impl.cc b/chromium/content/common/child_process_host_impl.cc
index adc7c1e4393..dbd2f448d5b 100644
--- a/chromium/content/common/child_process_host_impl.cc
+++ b/chromium/content/common/child_process_host_impl.cc
@@ -38,7 +38,7 @@
 
 #if defined(OS_LINUX)
 #include "base/linux_util.h"
-#elif defined(OS_MACOSX)
+#elif defined(OS_MAC)
 #include "base/mac/foundation_util.h"
 #include "content/common/mac_helpers.h"
 #endif  // OS_LINUX
@@ -82,7 +82,7 @@ base::FilePath ChildProcessHost::GetChildPath(int flags) {
   if (child_path.empty())
     base::PathService::Get(CHILD_PROCESS_EXE, &child_path);
 
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
   std::string child_base_name = child_path.BaseName().value();
 
   if (flags != CHILD_NORMAL && base::mac::AmIBundled()) {
@@ -332,4 +332,10 @@ void ChildProcessHostImpl::OnBadMessageReceived(const IPC::Message& message) {
   delegate_->OnBadMessageReceived(message);
 }
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+void ChildProcessHostImpl::DumpProfilingData(base::OnceClosure callback) {
+  child_process_->WriteClangProfilingProfile(std::move(callback));
+}
+#endif
+
 }  // namespace content
diff --git a/chromium/content/common/child_process_host_impl.h b/chromium/content/common/child_process_host_impl.h
index c1b13e05e8b..283161416d3 100644
--- a/chromium/content/common/child_process_host_impl.h
+++ b/chromium/content/common/child_process_host_impl.h
@@ -105,6 +105,10 @@ class CONTENT_EXPORT ChildProcessHostImpl
   // non-null.
   bool InitChannel();
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+  void DumpProfilingData(base::OnceClosure callback) override;
+#endif
+
   // The outgoing Mojo invitation which must be consumed to bootstrap Mojo IPC
   // to the child process.
   base::Optional<mojo::OutgoingInvitation> mojo_invitation_{base::in_place};
diff --git a/chromium/content/common/common_param_traits_macros.h b/chromium/content/common/common_param_traits_macros.h
index 1209aecf01a..1dee4da3bf2 100644
--- a/chromium/content/common/common_param_traits_macros.h
+++ b/chromium/content/common/common_param_traits_macros.h
@@ -10,54 +10,22 @@
 
 #include "cc/trees/browser_controls_params.h"
 #include "content/common/frame_messages.h"
-#include "content/common/visual_properties.h"
 #include "ipc/ipc_message_macros.h"
-#include "third_party/blink/public/web/web_device_emulation_params.h"
+#include "services/device/public/mojom/screen_orientation_lock_types.mojom-shared.h"
+#include "third_party/blink/public/common/widget/device_emulation_params.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 
 // Traits for VisualProperties.
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebDeviceEmulationParams::ScreenPosition,
-                          blink::WebDeviceEmulationParams::kScreenPositionLast)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::EmulatedScreenType,
+                          blink::mojom::EmulatedScreenType::kMaxValue)
 
-IPC_ENUM_TRAITS_MAX_VALUE(content::ScreenOrientationValues,
-                          content::SCREEN_ORIENTATION_VALUES_LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(device::mojom::ScreenOrientationLockType,
+                          device::mojom::ScreenOrientationLockType::kMaxValue)
 
-IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScreenOrientationType,
-                              blink::kWebScreenOrientationUndefined,
-                              blink::WebScreenOrientationTypeLast)
-
-IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::DisplayMode,
-                          blink::mojom::DisplayMode::kMaxValue)
-
-IPC_STRUCT_TRAITS_BEGIN(cc::BrowserControlsParams)
-  IPC_STRUCT_TRAITS_MEMBER(top_controls_height)
-  IPC_STRUCT_TRAITS_MEMBER(top_controls_min_height)
-  IPC_STRUCT_TRAITS_MEMBER(bottom_controls_height)
-  IPC_STRUCT_TRAITS_MEMBER(bottom_controls_min_height)
-  IPC_STRUCT_TRAITS_MEMBER(animate_browser_controls_height_changes)
-  IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(content::VisualProperties)
-  IPC_STRUCT_TRAITS_MEMBER(screen_info)
-  IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(max_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(new_size)
-  IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
-  IPC_STRUCT_TRAITS_MEMBER(compositor_viewport_pixel_rect)
-  IPC_STRUCT_TRAITS_MEMBER(browser_controls_params)
-  IPC_STRUCT_TRAITS_MEMBER(scroll_focused_node_into_view)
-  IPC_STRUCT_TRAITS_MEMBER(local_surface_id_allocation)
-  IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
-  IPC_STRUCT_TRAITS_MEMBER(display_mode)
-  IPC_STRUCT_TRAITS_MEMBER(capture_sequence_number)
-  IPC_STRUCT_TRAITS_MEMBER(zoom_level)
-  IPC_STRUCT_TRAITS_MEMBER(page_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(root_widget_window_segments)
-  IPC_STRUCT_TRAITS_MEMBER(is_pinch_gesture_active)
-IPC_STRUCT_TRAITS_END()
+IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::ScreenOrientation,
+                          blink::mojom::ScreenOrientation::kMaxValue)
 
 #endif  // CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
diff --git a/chromium/content/common/content_message_generator.h b/chromium/content/common/content_message_generator.h
index 50181ee0e82..14829d40e08 100644
--- a/chromium/content/common/content_message_generator.h
+++ b/chromium/content/common/content_message_generator.h
@@ -41,11 +41,6 @@
 #ifndef CONTENT_COMMON_RESOURCE_MESSAGES_H_
 #error "Failed to include content/common/resource_messages.h"
 #endif
-#undef CONTENT_COMMON_TEXT_INPUT_CLIENT_MESSAGES_H_
-#include "content/common/text_input_client_messages.h"
-#ifndef CONTENT_COMMON_TEXT_INPUT_CLIENT_MESSAGES_H_
-#error "Failed to include content/common/text_input_client_messages.h"
-#endif
 #undef CONTENT_COMMON_UNFREEZABLE_FRAME_MESSAGES_H_
 #include "content/common/unfreezable_frame_messages.h"
 #ifndef CONTENT_COMMON_UNFREEZABLE_FRAME_MESSAGES_H_
diff --git a/chromium/content/common/content_navigation_policy.cc b/chromium/content/common/content_navigation_policy.cc
index 6b932f006ea..a5c1e837174 100644
--- a/chromium/content/common/content_navigation_policy.cc
+++ b/chromium/content/common/content_navigation_policy.cc
@@ -6,9 +6,11 @@
 
 #include <bitset>
 
+#include "base/command_line.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/system/sys_info.h"
 #include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
 
 namespace content {
 
@@ -30,15 +32,49 @@ bool DeviceHasEnoughMemoryForBackForwardCache() {
   return true;
 }
 
+bool IsBackForwardCacheDisabledByCommandLine() {
+  if (base::CommandLine::InitializedForCurrentProcess() &&
+      base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableBackForwardCache)) {
+    return true;
+  }
+  return false;
+}
+
 bool IsBackForwardCacheEnabled() {
   if (!DeviceHasEnoughMemoryForBackForwardCache())
     return false;
+
+  if (IsBackForwardCacheDisabledByCommandLine())
+    return false;
+
   // The feature needs to be checked last, because checking the feature
   // activates the field trial and assigns the client either to a control or an
   // experiment group - such assignment should be final.
   return base::FeatureList::IsEnabled(features::kBackForwardCache);
 }
 
+bool IsSameSiteBackForwardCacheEnabled() {
+  if (!IsBackForwardCacheEnabled())
+    return false;
+  static constexpr base::FeatureParam<bool> enable_same_site_back_forward_cache(
+      &features::kBackForwardCache, "enable_same_site", false);
+  return enable_same_site_back_forward_cache.Get();
+}
+
+bool ShouldSkipSameSiteBackForwardCacheForPageWithUnload() {
+  if (!IsSameSiteBackForwardCacheEnabled())
+    return true;
+  static constexpr base::FeatureParam<bool> skip_same_site_if_unload_exists(
+      &features::kBackForwardCache, "skip_same_site_if_unload_exists", false);
+  return skip_same_site_if_unload_exists.Get();
+}
+
+bool CanCrossSiteNavigationsProactivelySwapBrowsingInstances() {
+  return IsProactivelySwapBrowsingInstanceEnabled() ||
+         IsBackForwardCacheEnabled();
+}
+
 const char kProactivelySwapBrowsingInstanceLevelParameterName[] = "level";
 
 constexpr base::FeatureParam<ProactivelySwapBrowsingInstanceLevel>::Option
@@ -116,7 +152,7 @@ std::string GetRenderDocumentLevelName(RenderDocumentLevel level) {
   return render_document_level.GetName(level);
 }
 
-bool CreateNewHostForSameSiteSubframe() {
+bool ShouldCreateNewHostForSameSiteSubframe() {
   return GetRenderDocumentLevel() >= RenderDocumentLevel::kSubframe;
 }
 
diff --git a/chromium/content/common/content_navigation_policy.h b/chromium/content/common/content_navigation_policy.h
index e7d1aaedd76..fe3c81b8f01 100644
--- a/chromium/content/common/content_navigation_policy.h
+++ b/chromium/content/common/content_navigation_policy.h
@@ -13,8 +13,16 @@
 namespace content {
 
 CONTENT_EXPORT bool IsBackForwardCacheEnabled();
+CONTENT_EXPORT bool IsSameSiteBackForwardCacheEnabled();
+CONTENT_EXPORT bool ShouldSkipSameSiteBackForwardCacheForPageWithUnload();
+CONTENT_EXPORT bool IsBackForwardCacheDisabledByCommandLine();
 CONTENT_EXPORT bool DeviceHasEnoughMemoryForBackForwardCache();
 
+// Whether proactive BrowsingInstance swap can happen on cross-site navigations.
+// This can be caused by either the ProactivelySwapBrowsingInstance or the
+// BackForwardCache flag.
+CONTENT_EXPORT bool CanCrossSiteNavigationsProactivelySwapBrowsingInstances();
+
 // Levels of ProactivelySwapBrowsingInstance support.
 // These are additive; features enabled at lower levels remain enabled at all
 // higher levels.
@@ -37,9 +45,11 @@ CONTENT_EXPORT std::array<
     static_cast<size_t>(ProactivelySwapBrowsingInstanceLevel::kMaxValue)>
 ProactivelySwapBrowsingInstanceFeatureEnabledLevelValues();
 
-// Whether ProactivelySwapBrowsingInstance is enabled or not. Will return true
-// if the value is set to either of {kCrossSiteSwapProcess,
+// Whether the ProactivelySwapBrowsingInstance flag is enabled or not. Will
+// return true if the value is set to either of {kCrossSiteSwapProcess,
 // kCrossSiteReuseProcess, kSameSite}.
+// Note that even if this returns false, we might still trigger proactive
+// BrowsingInstance swaps if IsBackForwardCacheEnabled() is true.
 CONTENT_EXPORT bool IsProactivelySwapBrowsingInstanceEnabled();
 
 // Whether ProactivelySwapBrowsingInstance with process reuse is enabled or not.
@@ -49,6 +59,9 @@ CONTENT_EXPORT bool IsProactivelySwapBrowsingInstanceWithProcessReuseEnabled();
 
 // Whether ProactivelySwapBrowsingInstance for same-site navigation is enabled
 // or not. Will return true if the value is set to kSameSite.
+// Note that even if this returns false, we might still trigger proactive
+// BrowsingInstance swaps on same-site navigations if
+// IsSameSiteBackForwardCacheEnabled() is true.
 CONTENT_EXPORT bool
 IsProactivelySwapBrowsingInstanceOnSameSiteNavigationEnabled();
 
@@ -64,7 +77,7 @@ enum class RenderDocumentLevel {
   // Also do not reuse RenderFrameHosts when navigating subframes.
   kSubframe = 2,
 };
-CONTENT_EXPORT bool CreateNewHostForSameSiteSubframe();
+CONTENT_EXPORT bool ShouldCreateNewHostForSameSiteSubframe();
 CONTENT_EXPORT RenderDocumentLevel GetRenderDocumentLevel();
 CONTENT_EXPORT std::string GetRenderDocumentLevelName(
     RenderDocumentLevel level);
diff --git a/chromium/content/common/content_param_traits_macros.h b/chromium/content/common/content_param_traits_macros.h
index 34fe4506b51..7fbab979bef 100644
--- a/chromium/content/common/content_param_traits_macros.h
+++ b/chromium/content/common/content_param_traits_macros.h
@@ -17,7 +17,6 @@
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom.h"
-#include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
 #include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/gpu_memory_buffer.h"
 #include "ui/gfx/ipc/geometry/gfx_param_traits.h"
@@ -46,10 +45,4 @@ IPC_STRUCT_TRAITS_BEGIN(viz::Selection<gfx::SelectionBound>)
   IPC_STRUCT_TRAITS_MEMBER(end)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(blink::WebTextAutosizerPageInfo)
-  IPC_STRUCT_TRAITS_MEMBER(main_frame_width)
-  IPC_STRUCT_TRAITS_MEMBER(main_frame_layout_width)
-  IPC_STRUCT_TRAITS_MEMBER(device_scale_adjustment)
-IPC_STRUCT_TRAITS_END()
-
 #endif  // CONTENT_COMMON_CONTENT_PARAM_TRAITS_MACROS_H_
diff --git a/chromium/content/common/content_paths.cc b/chromium/content/common/content_paths.cc
index ac594ed5f3c..6013ca884f8 100644
--- a/chromium/content/common/content_paths.cc
+++ b/chromium/content/common/content_paths.cc
@@ -8,7 +8,7 @@
 #include "base/path_service.h"
 #include "build/build_config.h"
 
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
 #include "base/mac/bundle_locations.h"
 #endif
 
@@ -31,15 +31,6 @@ bool PathProvider(int key, base::FilePath* result) {
       *result = cur;
       return true;
     }
-    case DIR_MEDIA_LIBS: {
-#if defined(OS_MACOSX)
-      *result = base::mac::FrameworkBundlePath();
-      *result = result->Append("Libraries");
-      return true;
-#else
-      return base::PathService::Get(base::DIR_MODULE, result);
-#endif
-    }
     default:
       return false;
   }
diff --git a/chromium/content/common/content_to_visible_time_reporter.cc b/chromium/content/common/content_to_visible_time_reporter.cc
index 430b98102d0..807efbc7064 100644
--- a/chromium/content/common/content_to_visible_time_reporter.cc
+++ b/chromium/content/common/content_to_visible_time_reporter.cc
@@ -107,6 +107,14 @@ ContentToVisibleTimeReporter::TabWasShown(
   DCHECK(!tab_switch_start_state_);
   DCHECK(render_widget_visibility_request_timestamp_.is_null());
 
+  // Invalidate previously issued callbacks, to avoid accessing a null
+  // |tab_switch_start_state_|.
+  //
+  // TODO(https://crbug.com/1121339): Make sure that TabWasShown() is never
+  // called twice without a call to TabWasHidden() in-between, and remove this
+  // mitigation.
+  weak_ptr_factory_.InvalidateWeakPtrs();
+
   has_saved_frames_ = has_saved_frames;
   tab_switch_start_state_ = start_state;
   render_widget_visibility_request_timestamp_ =
diff --git a/chromium/content/common/drag_event_source_info.h b/chromium/content/common/drag_event_source_info.h
index d78ac45ffb0..f4547798f8c 100644
--- a/chromium/content/common/drag_event_source_info.h
+++ b/chromium/content/common/drag_event_source_info.h
@@ -6,7 +6,7 @@
 #define CONTENT_COMMON_DRAG_EVENT_SOURCE_INFO_H_
 
 #include "content/common/content_export.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/gfx/geometry/point.h"
 
 namespace content {
@@ -14,7 +14,7 @@ namespace content {
 // Information about the event that started a drag session.
 struct CONTENT_EXPORT DragEventSourceInfo {
   gfx::Point event_location;
-  ui::DragDropTypes::DragEventSource event_source;
+  ui::mojom::DragEventSource event_source;
 };
 
 }  // namespace content
diff --git a/chromium/content/common/drag_messages.h b/chromium/content/common/drag_messages.h
index 3e78d67c58b..4f2f62b8a13 100644
--- a/chromium/content/common/drag_messages.h
+++ b/chromium/content/common/drag_messages.h
@@ -28,12 +28,6 @@ IPC_MESSAGE_ROUTED5(DragMsg_TargetDragEnter,
                     blink::WebDragOperationsMask /* ops_allowed */,
                     int /* key_modifiers */)
 
-IPC_MESSAGE_ROUTED4(DragMsg_TargetDrop,
-                    content::DropData /* drop_data */,
-                    gfx::PointF /* client_pt */,
-                    gfx::PointF /* screen_pt */,
-                    int /* key_modifiers */)
-
 // Messages sent from the renderer to the browser.
 
 // Used to tell the parent the user started dragging in the content area. The
diff --git a/chromium/content/common/drag_traits.h b/chromium/content/common/drag_traits.h
index f165ec02f5e..b4aa9dcd9f8 100644
--- a/chromium/content/common/drag_traits.h
+++ b/chromium/content/common/drag_traits.h
@@ -7,6 +7,7 @@
 
 #include "content/common/drag_event_source_info.h"
 #include "ipc/ipc_message_macros.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/gfx/geometry/point.h"
 
 #define IPC_MESSAGE_START DragMsgStart
@@ -16,4 +17,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::DragEventSourceInfo)
   IPC_STRUCT_TRAITS_MEMBER(event_source)
 IPC_STRUCT_TRAITS_END()
 
+IPC_ENUM_TRAITS_MAX_VALUE(ui::mojom::DragEventSource,
+                          ui::mojom::DragEventSource::kMaxValue)
+
 #endif  // CONTENT_COMMON_DRAG_TRAITS_H_
diff --git a/chromium/content/common/features.gni b/chromium/content/common/features.gni
index 13874c33dde..0732b2fecac 100644
--- a/chromium/content/common/features.gni
+++ b/chromium/content/common/features.gni
@@ -13,4 +13,4 @@ declare_args() {
   allow_critical_memory_pressure_handling_in_foreground = is_chromecast
 }
 
-enable_screen_capture = is_linux || is_mac || is_win || is_android
+enable_screen_capture = is_linux || is_chromeos || is_mac || is_win || is_android
diff --git a/chromium/content/common/fetch/fetch_request_type_converters.cc b/chromium/content/common/fetch/fetch_request_type_converters.cc
index b4193c138f2..0bc3104eb2e 100644
--- a/chromium/content/common/fetch/fetch_request_type_converters.cc
+++ b/chromium/content/common/fetch/fetch_request_type_converters.cc
@@ -5,7 +5,7 @@
 #include "content/common/fetch/fetch_request_type_converters.h"
 
 #include "content/common/service_worker/service_worker_utils.h"
-#include "content/public/common/referrer.h"
+#include "third_party/blink/public/common/loader/referrer_utils.h"
 #include "ui/base/page_transition_types.h"
 
 namespace mojo {
@@ -28,8 +28,8 @@ blink::mojom::FetchAPIRequestPtr TypeConverter<
   if (input.request_body)
     output->body = input.request_body;
   output->referrer = blink::mojom::Referrer::New(
-      input.referrer, content::Referrer::NetReferrerPolicyToBlinkReferrerPolicy(
-                          input.referrer_policy));
+      input.referrer,
+      blink::ReferrerUtils::NetToMojoReferrerPolicy(input.referrer_policy));
   output->mode = input.mode;
   output->is_main_resource_load =
       content::ServiceWorkerUtils::IsMainRequestDestination(input.destination);
diff --git a/chromium/content/common/font_cache_dispatcher_win.cc b/chromium/content/common/font_cache_dispatcher_win.cc
index 7d5b7155779..8a75ec44140 100644
--- a/chromium/content/common/font_cache_dispatcher_win.cc
+++ b/chromium/content/common/font_cache_dispatcher_win.cc
@@ -11,6 +11,7 @@
 
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/numerics/checked_math.h"
 #include "base/stl_util.h"
 #include "base/strings/string16.h"
 #include "base/thread_annotations.h"
@@ -43,15 +44,16 @@ class FontCache {
     DCHECK(ret);
 
     base::string16 font_name = font.lfFaceName;
-    int ref_count_inc = 1;
+    bool inc_ref_count = true;
     if (!base::Contains(dispatcher_font_map_[dispatcher], font_name)) {
       // Requested font is new to cache.
       dispatcher_font_map_[dispatcher].push_back(font_name);
     } else {
-      ref_count_inc = 0;
+      inc_ref_count = false;
     }
 
-    if (cache_[font_name].ref_count_ == 0) {  // Requested font is new to cache.
+    if (cache_[font_name].ref_count_.ValueOrDie() == 0) {
+      // Requested font is new to cache.
       cache_[font_name].ref_count_ = 1;
     } else {  // Requested font is already in cache, release old handles.
       SelectObject(cache_[font_name].dc_, cache_[font_name].old_font_);
@@ -61,7 +63,9 @@ class FontCache {
     cache_[font_name].font_ = font_handle;
     cache_[font_name].dc_ = hdc;
     cache_[font_name].old_font_ = old_font;
-    cache_[font_name].ref_count_ += ref_count_inc;
+    if (inc_ref_count) {
+      cache_[font_name].ref_count_++;
+    }
   }
 
   void ReleaseCachedFonts(FontCacheDispatcher* dispatcher) {
@@ -86,7 +90,7 @@ class FontCache {
 
     dispatcher_font_map_.erase(it);
     for (FontNameToElement::iterator i = cache_.begin(); i != cache_.end(); ) {
-      if (i->second.ref_count_ == 0) {
+      if (i->second.ref_count_.ValueOrDie() == 0) {
         cache_.erase(i++);
       } else {
         ++i;
@@ -115,7 +119,7 @@ class FontCache {
     HFONT font_;
     HGDIOBJ old_font_;
     HDC dc_;
-    int ref_count_;
+    base::CheckedNumeric<size_t> ref_count_;
   };
   friend struct base::DefaultSingletonTraits<FontCache>;
 
diff --git a/chromium/content/common/font_list_unittest.cc b/chromium/content/common/font_list_unittest.cc
index 710bf96a9ae..06f7dbd4cea 100644
--- a/chromium/content/common/font_list_unittest.cc
+++ b/chromium/content/common/font_list_unittest.cc
@@ -77,7 +77,7 @@ TEST(FontList, GetFontListLocalized) {
 }
 #endif  // defined(OS_WIN)
 
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
 // On some macOS versions, CTFontManager returns LastResort and/or hidden fonts.
 // Ensure that someone (CTFontManager or our FontList code) filters these fonts
 // on all OS versions that we support.
@@ -95,4 +95,4 @@ TEST(FontList, GetFontListDoesNotIncludeHiddenFonts) {
         << font_id << " seems like a hidden font, which should be filtered";
   }
 }
-#endif  // defined(OS_MACOSX)
+#endif  // defined(OS_MAC)
diff --git a/chromium/content/common/frame.mojom b/chromium/content/common/frame.mojom
index 40821a2c3d7..c969ed9b17b 100644
--- a/chromium/content/common/frame.mojom
+++ b/chromium/content/common/frame.mojom
@@ -4,14 +4,13 @@
 
 module content.mojom;
 
-import "content/common/ax_content_tree_update.mojom";
 import "content/common/document_scoped_interface_bundle.mojom";
 import "content/common/frame_messages.mojom";
 import "content/common/native_types.mojom";
 import "content/common/navigation_client.mojom";
 import "content/common/navigation_params.mojom";
+import "content/common/web_ui.mojom";
 import "content/public/common/browser_controls_state.mojom";
-import "content/public/common/transferrable_url_loader.mojom";
 import "content/public/common/window_container_type.mojom";
 import "mojo/public/mojom/base/file_path.mojom";
 import "mojo/public/mojom/base/string16.mojom";
@@ -41,10 +40,13 @@ import "third_party/blink/public/mojom/messaging/transferable_message.mojom";
 import "third_party/blink/public/mojom/page/page.mojom";
 import "third_party/blink/public/mojom/page/widget.mojom";
 import "third_party/blink/public/mojom/portal/portal.mojom";
-import "third_party/blink/public/mojom/referrer.mojom";
+import "third_party/blink/public/mojom/loader/referrer.mojom";
 import "third_party/blink/public/mojom/service_worker/controller_service_worker.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_container.mojom";
+import "third_party/blink/public/mojom/tokens/tokens.mojom";
+import "third_party/blink/public/mojom/widget/visual_properties.mojom";
 import "third_party/blink/public/mojom/window_features/window_features.mojom";
+import "ui/accessibility/mojom/ax_tree_update.mojom";
 import "ui/base/mojom/window_open_disposition.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
 import "url/mojom/origin.mojom";
@@ -102,7 +104,7 @@ interface Frame {
   // accessibility if it wasn't already enabled.
   // See ui/accessibility/ax_mode.h for valid values of |ax_mode|.
   SnapshotAccessibilityTree(uint32 ax_mode)
-      => (ax.mojom.AXContentTreeUpdate snapshot);
+      => (ax.mojom.AXTreeUpdate snapshot);
 
   // Get HTML data by serializing the target frame and replacing all resource
   // links with a path to the local copy passed in the message payload. In order
@@ -189,26 +191,6 @@ interface FrameNavigationControl {
       bool wants_result,
       int32 world_id) => (mojo_base.mojom.Value result);
 
-  // Forwards a message from a portal's host to the main frame in the portal's
-  // guest contents.
-  ForwardMessageFromHost(blink.mojom.TransferableMessage message,
-                         url.mojom.Origin source_origin,
-                         url.mojom.Origin? target_origin);
-
-  // Called on the main frame of a page embedded in a Portal when it is
-  // activated. The frame has the option to adopt the previous page as a portal
-  // identified by |portal_token| with the interface |portal|. The activation
-  // can optionally include a message |data| dispatched with the
-  // PortalActivateEvent. The return value |was_adopted| indicates if the portal
-  // for the predecessor (identified by |portal_token|) was adopted by the
-  // current frame.
-  OnPortalActivated(
-      mojo_base.mojom.UnguessableToken portal_token,
-      pending_associated_remote<blink.mojom.Portal> portal,
-      pending_associated_receiver<blink.mojom.PortalClient> portal_client,
-      blink.mojom.TransferableMessage data)
-      => (blink.mojom.PortalActivateResult result);
-
   // Requests that a provisional RenderFrame swap itself into the frame tree,
   // replacing the RenderFrameProxy that it is associated with. This is used
   // with remote-to-local frame navigations when the RenderFrameProxy
@@ -233,6 +215,10 @@ interface FrameBindingsControl {
   // and make method calls on them.
   // This is used for WebUI only at this time.
   EnableMojoJsBindings();
+
+  // Used to bind WebUI and WebUIHost mojo connections.
+  BindWebUI(pending_receiver<content.mojom.WebUI> receiver,
+            pending_remote<content.mojom.WebUIHost> remote);
 };
 
 // Implemented by a service that provides implementations of the Frame
@@ -306,7 +292,7 @@ struct CreateNewWindowReply {
   int32 main_frame_widget_route_id;
 
   // Initial properties for the main frame RenderWidget.
-  VisualProperties visual_properties;
+  blink.mojom.VisualProperties visual_properties;
 
   // The communication interfaces for the WebFrameWidget in blink.
   pending_associated_remote<blink.mojom.FrameWidgetHost> frame_widget_host;
@@ -392,7 +378,7 @@ interface FrameHost {
       pending_associated_remote<blink.mojom.PortalClient> client)
       => (int32 proxy_routing_id,
           FrameReplicationState initial_replicated_state,
-          mojo_base.mojom.UnguessableToken portal_token,
+          blink.mojom.PortalToken portal_token,
           mojo_base.mojom.UnguessableToken frame_token,
           mojo_base.mojom.UnguessableToken devtools_frame_token);
 
@@ -404,7 +390,7 @@ interface FrameHost {
   // |frame_token| - the unique identifier of the RenderFrameProxy
   // |devtools_frame_token| - the unique identifier of the frame node in the
   //                          frame tree
-  [Sync] AdoptPortal(mojo_base.mojom.UnguessableToken portal_token)
+  [Sync] AdoptPortal(blink.mojom.PortalToken portal_token)
       => (int32 proxy_routing_id,
           viz.mojom.FrameSinkId frame_sink_id,
           FrameReplicationState replicated_state,
@@ -525,12 +511,6 @@ interface FrameHost {
       int32 line_number,
       mojo_base.mojom.String16 source_id);
 
-  // Sent to the browser process to transfer the user activation state from the
-  // source frame to the frame sending this IPC. The browser will update the
-  // user activation state of the frames in the frame tree in the non-source and
-  // non-target renderer processes.
-  TransferUserActivationFrom(int32 source_routing_id);
-
   // Causes a window previously opened via RenderMessageFilter::CreateNewWindow
   // to be shown on the screen. This message is routed to the preexisting frame
   // that opened the window, and |pending_widget_routing_id| corresponds to the
@@ -539,12 +519,12 @@ interface FrameHost {
                     ui.mojom.WindowOpenDisposition disposition,
                     gfx.mojom.Rect rect, bool opened_by_user_gesture);
 
-  // Requests an overlay routing token.
-  RequestOverlayRoutingToken() => (mojo_base.mojom.UnguessableToken token);
-
   // Notifies the browser that this frame has new session history information.
   UpdateState(PageState state);
 
   // Requests that the given URL be opened in the specified manner.
   OpenURL(OpenURLParams params);
+
+  // Called when the renderer is done loading a frame.
+  DidStopLoading();
 };
diff --git a/chromium/content/common/frame_messages.h b/chromium/content/common/frame_messages.h
index 01c30cb7218..33db23c3272 100644
--- a/chromium/content/common/frame_messages.h
+++ b/chromium/content/common/frame_messages.h
@@ -34,9 +34,7 @@
 #include "content/public/common/impression.h"
 #include "content/public/common/navigation_policy.h"
 #include "content/public/common/page_state.h"
-#include "content/public/common/previews_state.h"
 #include "content/public/common/referrer.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/common/stop_find_action.h"
 #include "content/public/common/three_d_api_types.h"
 #include "content/public/common/untrustworthy_context_menu_params.h"
@@ -49,6 +47,7 @@
 #include "services/network/public/mojom/fetch_api.mojom-shared.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
+#include "third_party/blink/public/common/loader/previews_state.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
@@ -153,6 +152,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::UntrustworthyContextMenuParams)
   IPC_STRUCT_TRAITS_MEMBER(y)
   IPC_STRUCT_TRAITS_MEMBER(link_url)
   IPC_STRUCT_TRAITS_MEMBER(link_text)
+  IPC_STRUCT_TRAITS_MEMBER(impression)
   IPC_STRUCT_TRAITS_MEMBER(unfiltered_link_url)
   IPC_STRUCT_TRAITS_MEMBER(src_url)
   IPC_STRUCT_TRAITS_MEMBER(has_image_contents)
@@ -223,13 +223,13 @@ IPC_STRUCT_TRAITS_BEGIN(blink::FramePolicy)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(blink::ViewportIntersectionState)
-  IPC_STRUCT_TRAITS_MEMBER(viewport_offset)
   IPC_STRUCT_TRAITS_MEMBER(viewport_intersection)
-  IPC_STRUCT_TRAITS_MEMBER(main_frame_document_intersection)
+  IPC_STRUCT_TRAITS_MEMBER(main_frame_intersection)
   IPC_STRUCT_TRAITS_MEMBER(compositor_visible_rect)
   IPC_STRUCT_TRAITS_MEMBER(occlusion_state)
   IPC_STRUCT_TRAITS_MEMBER(main_frame_viewport_size)
   IPC_STRUCT_TRAITS_MEMBER(main_frame_scroll_offset)
+  IPC_STRUCT_TRAITS_MEMBER(main_frame_transform)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::FrameNavigateParams)
@@ -245,9 +245,9 @@ IPC_STRUCT_TRAITS_BEGIN(content::FrameNavigateParams)
   IPC_STRUCT_TRAITS_MEMBER(contents_mime_type)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::ScreenInfo)
+IPC_STRUCT_TRAITS_BEGIN(blink::ScreenInfo)
   IPC_STRUCT_TRAITS_MEMBER(device_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(color_space)
+  IPC_STRUCT_TRAITS_MEMBER(display_color_spaces)
   IPC_STRUCT_TRAITS_MEMBER(depth)
   IPC_STRUCT_TRAITS_MEMBER(depth_per_component)
   IPC_STRUCT_TRAITS_MEMBER(is_monochrome)
@@ -343,8 +343,8 @@ IPC_STRUCT_TRAITS_END()
 IPC_STRUCT_TRAITS_BEGIN(blink::ParsedFeaturePolicyDeclaration)
   IPC_STRUCT_TRAITS_MEMBER(feature)
   IPC_STRUCT_TRAITS_MEMBER(allowed_origins)
-  IPC_STRUCT_TRAITS_MEMBER(fallback_value)
-  IPC_STRUCT_TRAITS_MEMBER(opaque_value)
+  IPC_STRUCT_TRAITS_MEMBER(matches_all_origins)
+  IPC_STRUCT_TRAITS_MEMBER(matches_opaque_src)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::FrameReplicationState)
@@ -426,20 +426,6 @@ IPC_MESSAGE_ROUTED2(FrameMsg_CustomContextMenuAction,
                     content::CustomContextMenuContext /* custom_context */,
                     unsigned /* action */)
 
-// Requests that the RenderFrame send back a response after waiting for the
-// commit, activation and frame swap of the current DOM tree in blink.
-IPC_MESSAGE_ROUTED1(FrameMsg_VisualStateRequest, uint64_t /* id */)
-
-// TODO(https://crbug.com/995428): Deprecated.
-// Tells the renderer to reload the frame.
-IPC_MESSAGE_ROUTED0(FrameMsg_Reload)
-
-// Update a proxy's window.name property.  Used when the frame's name is
-// changed in another process.
-IPC_MESSAGE_ROUTED2(FrameMsg_DidUpdateName,
-                    std::string /* name */,
-                    std::string /* unique_name */)
-
 #if BUILDFLAG(ENABLE_PLUGINS)
 // Notifies the renderer of updates to the Plugin Power Saver origin allowlist.
 IPC_MESSAGE_ROUTED1(FrameMsg_UpdatePluginContentOriginAllowlist,
@@ -458,18 +444,12 @@ IPC_MESSAGE_ROUTED2(FrameMsg_SetPepperVolume,
 IPC_MESSAGE_ROUTED1(FrameMsg_MixedContentFound,
                     FrameMsg_MixedContentFound_Params)
 
-// Tell the renderer to add a property to the WebUI binding object.  This
-// only works if we allowed WebUI bindings.
-IPC_MESSAGE_ROUTED2(FrameMsg_SetWebUIProperty,
-                    std::string /* property_name */,
-                    std::string /* property_value_json */)
-
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
 // Sent by the renderer when a child frame is created in the renderer.
 //
-// Each of these messages will have a corresponding FrameHostMsg_Detach message
+// Each of these messages will have a corresponding mojom::FrameHost::Detach API
 // sent when the frame is detached from the DOM.
 // Note that |params_reply| is an out parameter. Browser process defines it for
 // the renderer process.
@@ -479,13 +459,6 @@ IPC_SYNC_MESSAGE_CONTROL1_1(FrameHostMsg_CreateChildFrame,
                             // params_reply
                             FrameHostMsg_CreateChildFrame_Params_Reply)
 
-// Sent by the renderer to the parent RenderFrameHost when a child frame is
-// detached from the DOM.
-IPC_MESSAGE_ROUTED0(FrameHostMsg_Detach)
-
-// Sent when the renderer is done loading a page.
-IPC_MESSAGE_ROUTED0(FrameHostMsg_DidStopLoading)
-
 #if BUILDFLAG(ENABLE_PLUGINS)
 // Notification sent from a renderer to the browser that a Pepper plugin
 // instance is created in the DOM.
@@ -657,39 +630,6 @@ IPC_MESSAGE_ROUTED3(FrameHostMsg_SelectionChanged,
                     uint32_t /* the offset of the text in the document */,
                     gfx::Range /* selection range in the document */)
 
-// Sent as a response to FrameMsg_VisualStateRequest.
-// The message is delivered using RenderWidget::QueueMessage.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_VisualStateResponse, uint64_t /* id */)
-
-// Sent when the renderer runs insecure content in a secure origin.
-IPC_MESSAGE_ROUTED2(FrameHostMsg_DidRunInsecureContent,
-                    GURL /* security_origin */,
-                    GURL /* target URL */)
-
-// Sent when the renderer displays content that was loaded with
-// certificate errors.
-IPC_MESSAGE_ROUTED0(FrameHostMsg_DidDisplayContentWithCertificateErrors)
-
-// Sent when the renderer runs content that was loaded with certificate
-// errors.
-IPC_MESSAGE_ROUTED0(FrameHostMsg_DidRunContentWithCertificateErrors)
-
-// A message from HTML-based UI.  When (trusted) Javascript calls
-// send(message, args), this message is sent to the browser.
-IPC_MESSAGE_ROUTED2(FrameHostMsg_WebUISend,
-                    std::string /* message */,
-                    base::ListValue /* args */)
-
-// Ask the frame host to print a cross-process subframe.
-// The printed content of this subframe belongs to the document specified by
-// its document cookie. Document cookie is a unique id for a printed document
-// associated with a print job.
-// The content will be rendered in the specified rectangular area in its parent
-// frame.
-IPC_MESSAGE_ROUTED2(FrameHostMsg_PrintCrossProcessSubframe,
-                    gfx::Rect /* rect area of the frame content */,
-                    int /* rendered document cookie */)
-
 // Adding a new message? Stick to the sort order above: first platform
 // independent FrameMsg, then ifdefs for platform specific FrameMsg, then
 // platform independent FrameHostMsg, then ifdefs for platform specific
diff --git a/chromium/content/common/frame_replication_state.h b/chromium/content/common/frame_replication_state.h
index 817594b3e68..f90dde3fcee 100644
--- a/chromium/content/common/frame_replication_state.h
+++ b/chromium/content/common/frame_replication_state.h
@@ -106,7 +106,7 @@ struct CONTENT_EXPORT FrameReplicationState {
 
   // The state of feature policies in the opener browsing context. This field is
   // only relevant for a root FrameTreeNode.
-  blink::FeaturePolicy::FeatureState opener_feature_state;
+  blink::FeaturePolicyFeatureState opener_feature_state;
 
   // Accumulated CSP headers - gathered from http headers, <meta> elements,
   // parent frames (in case of about:blank frames).
diff --git a/chromium/content/common/frame_visual_properties.h b/chromium/content/common/frame_visual_properties.h
index fc6c7ede2a0..c59e2e5e780 100644
--- a/chromium/content/common/frame_visual_properties.h
+++ b/chromium/content/common/frame_visual_properties.h
@@ -9,7 +9,7 @@
 #include "base/time/time.h"
 #include "components/viz/common/surfaces/local_surface_id_allocation.h"
 #include "content/common/content_export.h"
-#include "content/public/common/screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace content {
@@ -28,7 +28,7 @@ struct CONTENT_EXPORT FrameVisualProperties {
   // renderer process up to the RenderWidgetHost for a child RenderWidget in
   // another renderer process. That RenderWidgetHost would then be responsible
   // for passing it along to the child RenderWidget.
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   bool auto_resize_enabled = false;
   bool is_pinch_gesture_active = false;
   uint32_t capture_sequence_number = 0u;
diff --git a/chromium/content/common/input/input_event_dispatch_type.h b/chromium/content/common/input/input_event_dispatch_type.h
deleted file mode 100644
index 16623892ca0..00000000000
--- a/chromium/content/common/input/input_event_dispatch_type.h
+++ /dev/null
@@ -1,20 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_INPUT_INPUT_EVENT_DISPATCH_TYPE_H_
-#define CONTENT_COMMON_INPUT_INPUT_EVENT_DISPATCH_TYPE_H_
-
-namespace content {
-
-enum InputEventDispatchType {
-  // Dispatch a blocking event. Sender is waiting on an ACK.
-  DISPATCH_TYPE_BLOCKING,
-  // Dispatch a non-blocking event. Sender will not receive an ACK.
-  DISPATCH_TYPE_NON_BLOCKING,
-  DISPATCH_TYPE_MAX = DISPATCH_TYPE_NON_BLOCKING
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_INPUT_INPUT_EVENT_DISPATCH_TYPE_H_
diff --git a/chromium/content/common/input/synthetic_gesture_params.h b/chromium/content/common/input/synthetic_gesture_params.h
index 041190f440e..451b5ac33f0 100644
--- a/chromium/content/common/input/synthetic_gesture_params.h
+++ b/chromium/content/common/input/synthetic_gesture_params.h
@@ -48,6 +48,8 @@ struct CONTENT_EXPORT SyntheticGestureParams {
     SYNTHETIC_GESTURE_TYPE_MAX = POINTER_ACTION_LIST
   };
 
+  static constexpr int kDefaultSpeedInPixelsPerSec = 800;
+
   virtual GestureType GetGestureType() const = 0;
 
   // Returns true if the specific gesture source type is supported on this
diff --git a/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc b/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc
index f19cc34d065..6889c255821 100644
--- a/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc
@@ -7,15 +7,8 @@
 #include "base/check_op.h"
 
 namespace content {
-namespace {
 
-const float kDefaultSpeedInPixelsPerSec = 800;
-
-}  // namespace
-
-SyntheticSmoothDragGestureParams::SyntheticSmoothDragGestureParams()
-    : speed_in_pixels_s(kDefaultSpeedInPixelsPerSec) {
-}
+SyntheticSmoothDragGestureParams::SyntheticSmoothDragGestureParams() = default;
 
 SyntheticSmoothDragGestureParams::SyntheticSmoothDragGestureParams(
     const SyntheticSmoothDragGestureParams& other)
@@ -25,8 +18,7 @@ SyntheticSmoothDragGestureParams::SyntheticSmoothDragGestureParams(
       speed_in_pixels_s(other.speed_in_pixels_s) {
 }
 
-SyntheticSmoothDragGestureParams::~SyntheticSmoothDragGestureParams() {
-}
+SyntheticSmoothDragGestureParams::~SyntheticSmoothDragGestureParams() = default;
 
 SyntheticGestureParams::GestureType
 SyntheticSmoothDragGestureParams::GetGestureType() const {
diff --git a/chromium/content/common/input/synthetic_smooth_drag_gesture_params.h b/chromium/content/common/input/synthetic_smooth_drag_gesture_params.h
index 96bc39437ec..e87ada7f046 100644
--- a/chromium/content/common/input/synthetic_smooth_drag_gesture_params.h
+++ b/chromium/content/common/input/synthetic_smooth_drag_gesture_params.h
@@ -26,7 +26,7 @@ struct CONTENT_EXPORT SyntheticSmoothDragGestureParams
 
   gfx::PointF start_point;
   std::vector<gfx::Vector2dF> distances;
-  float speed_in_pixels_s;
+  float speed_in_pixels_s = SyntheticGestureParams::kDefaultSpeedInPixelsPerSec;
 
   static const SyntheticSmoothDragGestureParams* Cast(
       const SyntheticGestureParams* gesture_params);
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
index 03649c76472..3913727a843 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
@@ -7,24 +7,15 @@
 #include "base/check_op.h"
 
 namespace content {
-namespace {
 
-const float kDefaultSpeedInPixelsS = 800;
-
-}  // namespace
-
-SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams()
-    : prevent_fling(true),
-      speed_in_pixels_s(kDefaultSpeedInPixelsS),
-      fling_velocity_x(0),
-      fling_velocity_y(0),
-      granularity(ui::ScrollGranularity::kScrollByPixel),
-      key_modifiers(0) {}
+SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams() =
+    default;
 
 SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams(
     const SyntheticSmoothScrollGestureParams& other) = default;
 
-SyntheticSmoothScrollGestureParams::~SyntheticSmoothScrollGestureParams() {}
+SyntheticSmoothScrollGestureParams::~SyntheticSmoothScrollGestureParams() =
+    default;
 
 SyntheticGestureParams::GestureType
 SyntheticSmoothScrollGestureParams::GetGestureType() const {
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
index c9754c9a91e..a2f5ef173ca 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
@@ -27,13 +27,13 @@ struct CONTENT_EXPORT SyntheticSmoothScrollGestureParams
 
   gfx::PointF anchor;
   std::vector<gfx::Vector2dF> distances;  // Positive X/Y to scroll left/up.
-  bool prevent_fling;  // Defaults to true.
-  float speed_in_pixels_s;
-  float fling_velocity_x;
-  float fling_velocity_y;
-  ui::ScrollGranularity granularity;
+  bool prevent_fling = true;              // Defaults to true.
+  float speed_in_pixels_s = SyntheticGestureParams::kDefaultSpeedInPixelsPerSec;
+  float fling_velocity_x = 0;
+  float fling_velocity_y = 0;
+  ui::ScrollGranularity granularity = ui::ScrollGranularity::kScrollByPixel;
   // A bitfield of values from blink::WebInputEvent::Modifiers.
-  int key_modifiers;
+  int modifiers = 0;
 
   static const SyntheticSmoothScrollGestureParams* Cast(
       const SyntheticGestureParams* gesture_params);
diff --git a/chromium/content/common/input_messages.h b/chromium/content/common/input_messages.h
index 5d4704b2867..fda73c6e3da 100644
--- a/chromium/content/common/input_messages.h
+++ b/chromium/content/common/input_messages.h
@@ -13,7 +13,6 @@
 #include "cc/input/overscroll_behavior.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
-#include "content/common/input/input_event_dispatch_type.h"
 #include "content/common/input/synthetic_gesture_params.h"
 #include "content/common/input/synthetic_pinch_gesture_params.h"
 #include "content/common/input/synthetic_pointer_action_list_params.h"
@@ -51,8 +50,6 @@ IPC_ENUM_TRAITS_MAX_VALUE(
 IPC_ENUM_TRAITS_MAX_VALUE(
     content::SyntheticPointerActionParams::Button,
     content::SyntheticPointerActionParams::Button::BUTTON_MAX)
-IPC_ENUM_TRAITS_MAX_VALUE(content::InputEventDispatchType,
-                          content::InputEventDispatchType::DISPATCH_TYPE_MAX)
 
 IPC_STRUCT_TRAITS_BEGIN(content::SyntheticGestureParams)
   IPC_STRUCT_TRAITS_MEMBER(gesture_source_type)
@@ -74,7 +71,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::SyntheticSmoothScrollGestureParams)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_x)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_y)
   IPC_STRUCT_TRAITS_MEMBER(granularity)
-  IPC_STRUCT_TRAITS_MEMBER(key_modifiers)
+  IPC_STRUCT_TRAITS_MEMBER(modifiers)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::SyntheticPinchGestureParams)
diff --git a/chromium/content/common/inter_process_time_ticks_converter.cc b/chromium/content/common/inter_process_time_ticks_converter.cc
index c18a0e44c4f..ddfd34ace04 100644
--- a/chromium/content/common/inter_process_time_ticks_converter.cc
+++ b/chromium/content/common/inter_process_time_ticks_converter.cc
@@ -42,8 +42,7 @@ InterProcessTimeTicksConverter::InterProcessTimeTicksConverter(
   // local range, if possible.
   DCHECK_GT(remote_range.ToTimeDelta().InMicroseconds(), 0);
   range_conversion_rate_ =
-      static_cast<double>(local_range_.ToTimeDelta().InMicroseconds()) /
-      remote_range.ToTimeDelta().InMicroseconds();
+      local_range_.ToTimeDelta() / remote_range.ToTimeDelta();
   local_base_time_ = local_lower_bound;
 }
 
diff --git a/chromium/content/common/mac/attributed_string_type_converters.h b/chromium/content/common/mac/attributed_string_type_converters.h
index 1fa044d305f..ee06f40bf7a 100644
--- a/chromium/content/common/mac/attributed_string_type_converters.h
+++ b/chromium/content/common/mac/attributed_string_type_converters.h
@@ -7,7 +7,6 @@
 
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
-#include "ipc/ipc_message_utils.h"
 #include "ui/base/mojom/attributed_string.mojom.h"
 #include "ui/gfx/range/range.h"
 
@@ -17,11 +16,6 @@
 class NSAttributedString;
 #endif
 
-namespace base {
-class Pickle;
-class PickleIterator;
-}
-
 namespace mojo {
 
 template <>
@@ -40,20 +34,4 @@ struct CONTENT_EXPORT
 
 }  // namespace mojo
 
-// IPC ParamTraits specialization //////////////////////////////////////////////
-
-namespace IPC {
-
-template <>
-struct ParamTraits<ui::mojom::FontAttributePtr> {
-  typedef ui::mojom::FontAttributePtr param_type;
-  static void Write(base::Pickle* m, const param_type& p);
-  static bool Read(const base::Pickle* m,
-                   base::PickleIterator* iter,
-                   param_type* r);
-  static void Log(const param_type& p, std::string* l);
-};
-
-}  // namespace IPC
-
 #endif  // CONTENT_COMMON_MAC_ATTRIBUTED_STRING_TYPE_CONVERTERS_H_
diff --git a/chromium/content/common/mac/attributed_string_type_converters.mm b/chromium/content/common/mac/attributed_string_type_converters.mm
index eb67745731a..e57c621c76f 100644
--- a/chromium/content/common/mac/attributed_string_type_converters.mm
+++ b/chromium/content/common/mac/attributed_string_type_converters.mm
@@ -93,41 +93,3 @@ TypeConverter<ui::mojom::AttributedStringPtr, NSAttributedString*>::Convert(
 }
 
 }  // namespace mojo
-
-// IPC ParamTraits specialization //////////////////////////////////////////////
-
-namespace IPC {
-
-using ui::mojom::FontAttributePtr;
-
-void ParamTraits<FontAttributePtr>::Write(base::Pickle* m,
-                                          const param_type& p) {
-  WriteParam(m, p->font_name);
-  WriteParam(m, p->font_point_size);
-  WriteParam(m, p->effective_range);
-}
-
-bool ParamTraits<FontAttributePtr>::Read(const base::Pickle* m,
-                                         base::PickleIterator* iter,
-                                         param_type* p) {
-  bool success = true;
-
-  base::string16 font_name;
-  success &= ReadParam(m, iter, &font_name);
-
-  float font_point_size;
-  success &= ReadParam(m, iter, &font_point_size);
-
-  gfx::Range range;
-  success &= ReadParam(m, iter, &range);
-
-  if (success) {
-    *p = ui::mojom::FontAttribute::New(std::move(font_name), font_point_size,
-                                       range);
-  }
-  return success;
-}
-
-void ParamTraits<FontAttributePtr>::Log(const param_type& p, std::string* l) {}
-
-}  // namespace IPC
diff --git a/chromium/content/common/media/media_player_delegate_messages.h b/chromium/content/common/media/media_player_delegate_messages.h
index 2ee460cf5c2..fec05a989a6 100644
--- a/chromium/content/common/media/media_player_delegate_messages.h
+++ b/chromium/content/common/media/media_player_delegate_messages.h
@@ -74,6 +74,10 @@ IPC_MESSAGE_ROUTED1(MediaPlayerDelegateMsg_EnterPictureInPicture,
 IPC_MESSAGE_ROUTED1(MediaPlayerDelegateMsg_ExitPictureInPicture,
                     int /* delegate_id, distinguishes instances */)
 
+IPC_MESSAGE_ROUTED2(MediaPlayerDelegateMsg_SetAudioSinkId,
+                    int /* delegate_id, distinguishes instances */,
+                    std::string /* sink_id */)
+
 IPC_MESSAGE_ROUTED2(MediaPlayerDelegateMsg_NotifyPowerExperimentState,
                     int /* delegate_id, distinguishes instances */,
                     bool /* is experiment starting (true) or stopping? */)
@@ -89,13 +93,15 @@ IPC_MESSAGE_ROUTED2(MediaPlayerDelegateHostMsg_OnMediaPaused,
                     int /* delegate_id, distinguishes instances */,
                     bool /* reached end of stream */)
 
-IPC_MESSAGE_ROUTED5(MediaPlayerDelegateHostMsg_OnMediaPlaying,
+IPC_MESSAGE_ROUTED4(MediaPlayerDelegateHostMsg_OnMediaMetadataChanged,
                     int /* delegate_id, distinguishes instances */,
-                    bool /* has_video */,
                     bool /* has_audio */,
-                    bool /* is_remote */,
+                    bool /* has_video */,
                     media::MediaContentType /* media_content_type */)
 
+IPC_MESSAGE_ROUTED1(MediaPlayerDelegateHostMsg_OnMediaPlaying,
+                    int /* delegate_id, distinguishes instances */)
+
 IPC_MESSAGE_ROUTED2(MediaPlayerDelegateHostMsg_OnMutedStatusChanged,
                     int /* delegate_id, distinguishes instances */,
                     bool /* the new muted status */)
@@ -118,6 +124,10 @@ IPC_MESSAGE_ROUTED2(
     int /* delegate_id, distinguishes instances */,
     bool /* picture-in-picture availability */)
 
+IPC_MESSAGE_ROUTED2(MediaPlayerDelegateHostMsg_OnAudioOutputSinkChanged,
+                    int /* delegate_id, distinguishes instances */,
+                    std::string /* hashed_device_id */)
+
 IPC_MESSAGE_ROUTED1(MediaPlayerDelegateHostMsg_OnBufferUnderflow,
                     int /* delegate_id, distinguishes instances */)
 
diff --git a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
deleted file mode 100644
index 361de5d0d69..00000000000
--- a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content.mojom;
-
-import "media/mojo/mojom/audio_data_pipe.mojom";
-import "media/mojo/mojom/audio_input_stream.mojom";
-import "media/mojo/mojom/audio_parameters.mojom";
-import "media/mojo/mojom/media_types.mojom";
-import "mojo/public/mojom/base/unguessable_token.mojom";
-
-// This interface is used by the renderer to ask the browser to create input
-// streams. The renderer supplies the desired audio parameters, and a client
-// to send the stream to when it's ready. The lifetime of the stream is limited
-// by the lifetime of the client.
-interface RendererAudioInputStreamFactory {
-  CreateStream(
-      pending_remote<RendererAudioInputStreamFactoryClient> client,
-      mojo_base.mojom.UnguessableToken session_id,
-      media.mojom.AudioParameters params,
-      bool automatic_gain_control,
-      uint32 shared_memory_count);
-
-  // Associates an output device with an input stream, so that the input knows
-  // which output device to cancel echo from. |input_stream_id| is the id
-  // returned when the stream was created. |output_device_id| is a device
-  // id HMAC. In case either of the parameters are invalid, the operation will
-  // silently fail.
-  AssociateInputAndOutputForAec(
-      mojo_base.mojom.UnguessableToken input_stream_id,
-      string output_device_id);
-};
-
-interface RendererAudioInputStreamFactoryClient {
-  // Called when a stream has been created. Will only be called once for every
-  // CreateStream call. |stream_id| is a handle used to refer to the stream,
-  // specifically to be able to associate it with an output device for echo
-  // cancellation. Loopback streams don't have ids.
-  // TODO(crbug.com/787806): There are plans to allow this function to be called
-  // serveral times in the future. If the stream is terminated e.g. due to the
-  // process hosting it crashing, this function should be called again with a
-  // fresh stream.
-  StreamCreated(
-      pending_remote<media.mojom.AudioInputStream> stream,
-      pending_receiver<media.mojom.AudioInputStreamClient> client_request,
-      media.mojom.ReadOnlyAudioDataPipe data_pipe,
-      bool initially_muted,
-      mojo_base.mojom.UnguessableToken? stream_id);
-};
diff --git a/chromium/content/common/media/renderer_audio_output_stream_factory.mojom b/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
deleted file mode 100644
index c151fec4513..00000000000
--- a/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content.mojom;
-
-import "media/mojo/mojom/audio_output_stream.mojom";
-import "media/mojo/mojom/audio_parameters.mojom";
-import "media/mojo/mojom/media_types.mojom";
-import "mojo/public/mojom/base/unguessable_token.mojom";
-
-// This interface is used to create output streams. The client supplies a
-// mojo receiver for a stream provider, and then supplies the desired audio
-// parameters to that to create the stream.
-interface RendererAudioOutputStreamFactory {
-  // Used to request a device. If successful, |stream_provider_receiver| will be
-  // bound to an AudioOutputStreamProvider implementation, otherwise it will
-  // simply be discarded (won't be bound). If |session_id| is provided, it will
-  // be taken into account together with |device_id| in the selection of the
-  // audio output device to request. If not provided, only |device_id| will be
-  // taken into account in the selection of the audio output device.
-  RequestDeviceAuthorization(
-      pending_receiver<media.mojom.AudioOutputStreamProvider>
-          stream_provider_receiver,
-      mojo_base.mojom.UnguessableToken? session_id,
-      string device_id) =>
-      (media.mojom.OutputDeviceStatus state,
-       media.mojom.AudioParameters output_params,
-       string matched_device_id);
-};
diff --git a/chromium/content/common/native_types.mojom b/chromium/content/common/native_types.mojom
index f26cfe9a10f..f67eac0f5c8 100644
--- a/chromium/content/common/native_types.mojom
+++ b/chromium/content/common/native_types.mojom
@@ -14,9 +14,6 @@ struct FrameOwnerProperties;
 [Native]
 struct FrameReplicationState;
 
-[Native]
-struct VisualProperties;
-
 // NOTE: This type is only mapped and usable on Mac.
 [Native]
 enum ScrollbarButtonsPlacement;
diff --git a/chromium/content/common/navigation_client.mojom b/chromium/content/common/navigation_client.mojom
index fe7852700b2..596de595200 100644
--- a/chromium/content/common/navigation_client.mojom
+++ b/chromium/content/common/navigation_client.mojom
@@ -10,9 +10,9 @@ import "services/network/public/mojom/url_loader.mojom";
 import "services/network/public/mojom/url_loader_factory.mojom";
 import "content/common/frame_messages.mojom";
 import "content/common/navigation_params.mojom";
-import "content/public/common/transferrable_url_loader.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "url/mojom/url.mojom";
+import "third_party/blink/public/mojom/loader/transferrable_url_loader.mojom";
 import "third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom";
 import "third_party/blink/public/mojom/service_worker/controller_service_worker.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_container.mojom";
@@ -61,7 +61,7 @@ interface NavigationClient {
       handle<data_pipe_consumer>? response_body,
       network.mojom.URLLoaderClientEndpoints? url_loader_client_endpoints,
       blink.mojom.URLLoaderFactoryBundle? subresource_loader_factories,
-      array<TransferrableURLLoader>? subresource_overrides,
+      array<blink.mojom.TransferrableURLLoader>? subresource_overrides,
       blink.mojom.ControllerServiceWorkerInfo? controller_service_worker_info,
       blink.mojom.ServiceWorkerContainerInfoForClient? container_info,
       pending_remote<network.mojom.URLLoaderFactory>? prefetch_loader_factory,
diff --git a/chromium/content/common/navigation_params.mojom b/chromium/content/common/navigation_params.mojom
index 872d11d8fda..ce2367bf7c8 100644
--- a/chromium/content/common/navigation_params.mojom
+++ b/chromium/content/common/navigation_params.mojom
@@ -16,12 +16,14 @@ import "services/network/public/mojom/source_location.mojom";
 import "services/network/public/mojom/trust_tokens.mojom";
 import "services/network/public/mojom/url_loader.mojom";
 import "services/network/public/mojom/url_response_head.mojom";
+import "services/network/public/mojom/web_client_hints_types.mojom";
 import "third_party/blink/public/mojom/feature_policy/feature_policy.mojom";
 import "third_party/blink/public/mojom/fetch/fetch_api_request.mojom";
 import "third_party/blink/public/mojom/frame/frame_policy.mojom";
-import "third_party/blink/public/mojom/referrer.mojom";
+import "third_party/blink/public/mojom/loader/referrer.mojom";
 import "url/mojom/origin.mojom";
 import "url/mojom/url.mojom";
+import "third_party/blink/public/mojom/page/page.mojom";
 
 [Native]
 struct Impression;
@@ -96,33 +98,38 @@ struct BeginNavigationParams {
   // Routing id of the initiator of the navigation. This routing id may no
   // longer be valid by the time the navigation is seen by the browser process,
   // if the initiator frame is deleted before the navigation IPC arrives. A
-  // value of MSG_ROUTING_NONE indicates this navigation is not associated
-  // with a frame.
-  int32 initiator_routing_id;
+  // default value of MSG_ROUTING_NONE indicates this navigation is not
+  // associated with a frame.
+  int32 initiator_routing_id = -2;  // -2 == MSG_ROUTING_NONE
 
   // Additional HTTP request headers.
   string headers;
 
   // net::URLRequest load flags (net::LOAD_NORMAL) by default).
-  int32 load_flags;
+  int32 load_flags = 0;  // 0 == net::LOAD_NORMAL
 
   // True if the ServiceWorker should be skipped.
-  bool skip_service_worker;
+  bool skip_service_worker = false;
 
   // Indicates the request context type.
-  blink.mojom.RequestContextType request_context_type;
+  blink.mojom.RequestContextType request_context_type =
+      blink.mojom.RequestContextType.UNSPECIFIED;
 
   // Indicates the request destination.
-  network.mojom.RequestDestination request_destination;
+  network.mojom.RequestDestination request_destination =
+      network.mojom.RequestDestination.kEmpty;
 
   // The mixed content context type for potential mixed content checks.
+  //
+  // [Native] enums are by default initialized to 0
+  // (i.e. blink::WebMixedContentContextType::kNotMixedContent below).
   MixedContentContextType mixed_content_context_type;
 
   // Whether or not the navigation has been initiated by a form submission.
-  bool is_form_submission;
+  bool is_form_submission = false;
 
   // Whether or not the navigation has been initiated by a link click.
-  bool was_initiated_by_link_click;
+  bool was_initiated_by_link_click = false;
 
   // See WebSearchableFormData for a description of these.
   url.mojom.Url searchable_form_url;
@@ -155,6 +162,11 @@ struct BeginNavigationParams {
   // this navigation. Only set on navigations originating from anchors with
   // relevant impression attributes set.
   Impression? impression;
+
+  // Timestamps of the renderer running beforeunload handlers on local frames
+  // in preparation for navigating. Used for metrics.
+  mojo_base.mojom.TimeTicks before_unload_start;
+  mojo_base.mojom.TimeTicks before_unload_end;
 };
 
 // Provided by the browser or the renderer -------------------------------------
@@ -175,6 +187,8 @@ struct CommonNavigationParams {
   blink.mojom.Referrer referrer;
 
   // The type of transition.
+  //
+  // [Native] enums are by default initialized to 0 (i.e. PAGE_TRANSITION_LINK).
   PageTransition transition;
 
   // Type of navigation.
@@ -199,8 +213,8 @@ struct CommonNavigationParams {
 
   // Bitmask that has whether or not to request a Preview version of the
   // document for various preview types or let the browser decide.
-  // Defined in content/public/common/previews_state.h.
-  int32 previews_state;
+  // Defined in third_party/blink/public/common/loader/previews_state.h.
+  int32 previews_state = 0;  // 0 == PREVIEWS_UNSPECIFIED
 
   // The navigationStart time exposed through the Navigation Timing API to JS.
   mojo_base.mojom.TimeTicks navigation_start;
@@ -223,6 +237,13 @@ struct CommonNavigationParams {
   // True if the request was user initiated.
   bool has_user_gesture = false;
 
+  // True if the navigation should allow the target document to invoke a text
+  // fragment (i.e. fragments with :~:text=). This is based on user gesture
+  // presence but separate from the bit above as the semantics for text
+  // fragments are different. Namely, this bit is always consumed on use and is
+  // propagated across client redirects.
+  bool text_fragment_token = false;
+
   // We require a copy of the relevant CSP to perform navigation checks.
   InitiatorCSPInfo initiator_csp_info;
 
@@ -261,6 +282,23 @@ struct NavigationTiming {
   mojo_base.mojom.TimeTicks fetch_start;
 };
 
+// Sent with CommitNavigationParams and should only be set for main-frame
+// same-site navigations where we did a proactive BrowsingInstance swap and
+// we're reusing the old page's process. Needed to ensure that the previous
+// page's pagehide and visibilitychange handlers are run before the new page
+// runs (which is what happens on other same-site main frame navigations).
+struct OldPageInfo {
+  // |routing_id_for_old_main_frame| contains the routing ID of the old page's
+  // main RenderFrameHost.
+  int32 routing_id_for_old_main_frame = -1;
+  // |new_lifecycle_state_for_old_page| contains the latest PageLifecycleState
+  // of the old page to ensure the PageVisibilityState gets properly updated,
+  // the "persisted" property of the pagehide event is set correctly, and
+  // pagehide and visibilitychange events won't get dispatched again when we
+  // unload/freeze the page later on.
+  blink.mojom.PageLifecycleState new_lifecycle_state_for_old_page;
+};
+
 // Used by commit IPC messages. Holds the parameters needed by the renderer to
 // commit a navigation besides those in CommonNavigationParams.
 struct CommitNavigationParams {
@@ -415,6 +453,25 @@ struct CommitNavigationParams {
   // The names of origin trials to be force enabled for this navigation.
   array<string> force_enabled_origin_trials;
 
-  // Whether origin isolation is restricting certain cross-origin web APIs.
-  bool origin_isolation_restricted = false;
+  // Whether the page is origin isolated.
+  // https://github.com/WICG/origin-isolation
+  bool origin_isolated = false;
+
+  // Client-hints enabled; this is based on the top-level frame and should be
+  // further narrowed down by feature policy.
+  array<network.mojom.WebClientHintsType> enabled_client_hints;
+
+  // Whether this is a cross browsing instance navigation.
+  bool is_cross_browsing_instance = false;
+
+  // A list of additional Content Security Policies to be enforced by blink
+  // on the document. This is being used by Content Security Policy: Embedded
+  // Enforcement for enforcing on frames Content Security Policies required by
+  // their embedders.
+  array<string> forced_content_security_policies;
+
+  // Should only be set to a valid value for main-frame same-site navigations
+  // where we did a proactive BrowsingInstance swap and we're reusing the old
+  // page's process.
+  OldPageInfo? old_page_info;
 };
diff --git a/chromium/content/common/page_messages.h b/chromium/content/common/page_messages.h
index ad73d342756..bf96f060246 100644
--- a/chromium/content/common/page_messages.h
+++ b/chromium/content/common/page_messages.h
@@ -7,10 +7,7 @@
 
 #include "content/public/common/common_param_traits.h"
 #include "content/public/common/page_visibility_state.h"
-#include "content/public/common/screen_info.h"
 #include "ipc/ipc_message_macros.h"
-#include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
-#include "ui/gfx/geometry/rect.h"
 
 // IPC messages for page-level actions.
 // TODO(https://crbug.com/775827): Convert to mojo.
@@ -29,19 +26,9 @@ IPC_MESSAGE_ROUTED2(PageMsg_SetHistoryOffsetAndLength,
                     int /* history_offset */,
                     int /* history_length */)
 
-IPC_MESSAGE_ROUTED1(PageMsg_AudioStateChanged, bool /* is_audio_playing */)
-
-// blink::TextAutosizer changes in the main frame's renderer.
-IPC_MESSAGE_ROUTED1(PageMsg_UpdateTextAutosizerPageInfoForRemoteMainFrames,
-                    blink::WebTextAutosizerPageInfo /* page_info */)
-
 // Sends updated preferences to the renderer.
 IPC_MESSAGE_ROUTED1(PageMsg_SetRendererPrefs, blink::mojom::RendererPreferences)
 
-// Sent to all renderers when a portal web contents is activated or if a
-// web contents is adopted as a portal.
-IPC_MESSAGE_ROUTED1(PageMsg_SetInsidePortal, bool /* inside_portal */)
-
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
diff --git a/chromium/content/common/page_state_serialization.cc b/chromium/content/common/page_state_serialization.cc
index 1d92376abf3..1be78a3dde6 100644
--- a/chromium/content/common/page_state_serialization.cc
+++ b/chromium/content/common/page_state_serialization.cc
@@ -710,6 +710,7 @@ void WriteResourceRequestBody(const network::ResourceRequestBody& request_body,
         break;
       case network::mojom::DataElementType::kRawFile:
       case network::mojom::DataElementType::kChunkedDataPipe:
+      case network::mojom::DataElementType::kReadOnceStream:
       case network::mojom::DataElementType::kUnknown:
         NOTREACHED();
         continue;
diff --git a/chromium/content/common/render_accessibility.mojom b/chromium/content/common/render_accessibility.mojom
index 19ec49f79f4..c03f2a04342 100644
--- a/chromium/content/common/render_accessibility.mojom
+++ b/chromium/content/common/render_accessibility.mojom
@@ -4,11 +4,11 @@
 
 module content.mojom;
 
-import "content/common/ax_content_tree_update.mojom";
 import "ui/accessibility/ax_enums.mojom";
 import "ui/accessibility/mojom/ax_action_data.mojom";
 import "ui/accessibility/mojom/ax_event.mojom";
 import "ui/accessibility/mojom/ax_relative_bounds.mojom";
+import "ui/accessibility/mojom/ax_tree_update.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 
@@ -48,7 +48,7 @@ interface RenderAccessibilityHost {
   // reset request from the browser. When the browser requests a reset, it
   // ignores incoming remote calls until it sees one with the correct reset
   // token. Any other time, it ignores further calls with a reset token.
-  HandleAXEvents(array<ax.mojom.AXContentTreeUpdate> updates,
+  HandleAXEvents(array<ax.mojom.AXTreeUpdate> updates,
                  array<ax.mojom.AXEvent> events, int32 reset_token) => ();
 
   // Sent to update the browser of the location of accessibility objects.
diff --git a/chromium/content/common/render_widget_host_ns_view.mojom b/chromium/content/common/render_widget_host_ns_view.mojom
index a8c3582a4fb..3fc749cb041 100644
--- a/chromium/content/common/render_widget_host_ns_view.mojom
+++ b/chromium/content/common/render_widget_host_ns_view.mojom
@@ -74,6 +74,10 @@ interface RenderWidgetHostNSView {
   // Lock or unlock the cursor.
   SetCursorLocked(bool locked);
 
+  // Set whether unaccelerated (unadjusted) mouse move events are
+  // generated while the cursor is locked.
+  SetCursorLockedUnacceleratedMovement(bool unaccelerated_movement);
+
   // Open the dictionary overlay for the currently selected string. This
   // will roundtrip to the NSView to determine the selected range.
   ShowDictionaryOverlayForSelection();
diff --git a/chromium/content/common/renderer.mojom b/chromium/content/common/renderer.mojom
index 39a399c3064..727a0695856 100644
--- a/chromium/content/common/renderer.mojom
+++ b/chromium/content/common/renderer.mojom
@@ -17,9 +17,21 @@ import "third_party/blink/public/mojom/manifest/manifest.mojom";
 import "third_party/blink/public/mojom/page/page.mojom";
 import "third_party/blink/public/mojom/page/widget.mojom";
 import "third_party/blink/public/mojom/renderer_preferences.mojom";
+import "third_party/blink/public/mojom/widget/visual_properties.mojom";
 import "third_party/blink/public/mojom/user_agent/user_agent_metadata.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
 
+// A View (i.e. a "main frame") can be created for a few different cases, these
+// values are used to specify which it is.
+enum ViewWidgetType {
+  // A standard view that's the top-level widget in a frame hierarchy.
+  kTopLevel,
+  // A GuestView used to render contents inside a <webview> element.
+  kGuestView,
+  // A view used to render contents inside a <portal> element.
+  kPortal
+};
+
 struct CreateViewParams {
   // Renderer-wide preferences.
   blink.mojom.RendererPreferences renderer_preferences;
@@ -101,15 +113,16 @@ struct CreateViewParams {
   // Initial state for the main frame RenderWidget.
   // TODO(danakj): This should be optional and not included when there is no
   // main_frame_widget_routing_id.
-  VisualProperties visual_properties;
+  blink.mojom.VisualProperties visual_properties;
 
   // Whether lookup of frames in the created RenderView (e.g. lookup via
   // window.open or via <a target=...>) should be renderer-wide (i.e. going
   // beyond the usual opener-relationship-based BrowsingInstance boundaries).
   bool renderer_wide_named_frame_lookup;
 
-  // Set this to true when creating a RenderView inside a portal.
-  bool inside_portal;
+  // Indicates whether the view is a regular top-level widget or some other
+  // nested "main frame" widget type.
+  ViewWidgetType type;
 
   // Endpoint for any messages that are broadcast to all views in a WebContents.
   pending_associated_receiver<blink.mojom.PageBroadcast> blink_page_broadcast;
@@ -127,7 +140,7 @@ struct CreateFrameWidgetParams {
   pending_associated_receiver<blink.mojom.Widget> widget;
 
   // The initial visual properties of the widget.
-  VisualProperties visual_properties;
+  blink.mojom.VisualProperties visual_properties;
 };
 
 struct CreateFrameParams {
diff --git a/chromium/content/common/sandbox_init_linux.cc b/chromium/content/common/sandbox_init_linux.cc
index 4d81210f654..81848619178 100644
--- a/chromium/content/common/sandbox_init_linux.cc
+++ b/chromium/content/common/sandbox_init_linux.cc
@@ -10,19 +10,19 @@
 #include "base/files/scoped_file.h"
 #include "build/build_config.h"
 #include "sandbox/linux/bpf_dsl/policy.h"
-#include "services/service_manager/sandbox/linux/sandbox_seccomp_bpf_linux.h"
+#include "sandbox/policy/linux/sandbox_seccomp_bpf_linux.h"
 
 namespace content {
 
 bool InitializeSandbox(std::unique_ptr<sandbox::bpf_dsl::Policy> policy,
                        base::ScopedFD proc_fd) {
-  return service_manager::SandboxSeccompBPF::StartSandboxWithExternalPolicy(
+  return sandbox::policy::SandboxSeccompBPF::StartSandboxWithExternalPolicy(
       std::move(policy), std::move(proc_fd));
 }
 
 #if !defined(OS_NACL_NONSFI)
 std::unique_ptr<sandbox::bpf_dsl::Policy> GetBPFSandboxBaselinePolicy() {
-  return service_manager::SandboxSeccompBPF::GetBaselinePolicy();
+  return sandbox::policy::SandboxSeccompBPF::GetBaselinePolicy();
 }
 #endif  // !defined(OS_NACL_NONSFI)
 
diff --git a/chromium/content/common/sandbox_init_mac.cc b/chromium/content/common/sandbox_init_mac.cc
index e681cf87b12..34191d1e7fc 100644
--- a/chromium/content/common/sandbox_init_mac.cc
+++ b/chromium/content/common/sandbox_init_mac.cc
@@ -18,9 +18,9 @@
 #include "media/gpu/mac/vt_video_decode_accelerator_mac.h"
 #include "sandbox/mac/seatbelt.h"
 #include "sandbox/mac/seatbelt_exec.h"
-#include "services/service_manager/sandbox/mac/sandbox_mac.h"
-#include "services/service_manager/sandbox/sandbox.h"
-#include "services/service_manager/sandbox/sandbox_type.h"
+#include "sandbox/policy/mac/sandbox_mac.h"
+#include "sandbox/policy/sandbox.h"
+#include "sandbox/policy/sandbox_type.h"
 #include "ui/gl/init/gl_factory.h"
 
 namespace content {
@@ -29,9 +29,9 @@ namespace {
 
 // Helper method to make a closure from a closure.
 base::OnceClosure MaybeWrapWithGPUSandboxHook(
-    service_manager::SandboxType sandbox_type,
+    sandbox::policy::SandboxType sandbox_type,
     base::OnceClosure original) {
-  if (sandbox_type != service_manager::SandboxType::kGpu)
+  if (sandbox_type != sandbox::policy::SandboxType::kGpu)
     return original;
 
   return base::BindOnce(
@@ -78,12 +78,12 @@ base::OnceClosure MaybeWrapWithGPUSandboxHook(
 // Fill in |sandbox_type| based on the command line.  Returns false if the
 // current process type doesn't need to be sandboxed or if the sandbox was
 // disabled from the command line.
-bool GetSandboxTypeFromCommandLine(service_manager::SandboxType* sandbox_type) {
+bool GetSandboxTypeFromCommandLine(sandbox::policy::SandboxType* sandbox_type) {
   DCHECK(sandbox_type);
 
   auto* command_line = base::CommandLine::ForCurrentProcess();
-  *sandbox_type = service_manager::SandboxTypeFromCommandLine(*command_line);
-  if (service_manager::IsUnsandboxedSandboxType(*sandbox_type))
+  *sandbox_type = sandbox::policy::SandboxTypeFromCommandLine(*command_line);
+  if (IsUnsandboxedSandboxType(*sandbox_type))
     return false;
 
   if (command_line->HasSwitch(sandbox::switches::kSeatbeltClientName)) {
@@ -97,17 +97,17 @@ bool GetSandboxTypeFromCommandLine(service_manager::SandboxType* sandbox_type) {
 
 }  // namespace
 
-bool InitializeSandbox(service_manager::SandboxType sandbox_type) {
-  return service_manager::Sandbox::Initialize(
+bool InitializeSandbox(sandbox::policy::SandboxType sandbox_type) {
+  return sandbox::policy::Sandbox::Initialize(
       sandbox_type,
       MaybeWrapWithGPUSandboxHook(sandbox_type, base::OnceClosure()));
 }
 
 bool InitializeSandbox(base::OnceClosure post_warmup_hook) {
-  service_manager::SandboxType sandbox_type =
-      service_manager::SandboxType::kNoSandbox;
+  sandbox::policy::SandboxType sandbox_type =
+      sandbox::policy::SandboxType::kNoSandbox;
   return !GetSandboxTypeFromCommandLine(&sandbox_type) ||
-         service_manager::Sandbox::Initialize(
+         sandbox::policy::Sandbox::Initialize(
              sandbox_type, MaybeWrapWithGPUSandboxHook(
                                sandbox_type, std::move(post_warmup_hook)));
 }
diff --git a/chromium/content/common/sandbox_init_win.cc b/chromium/content/common/sandbox_init_win.cc
index e363bd25a6e..8d8e925967f 100644
--- a/chromium/content/common/sandbox_init_win.cc
+++ b/chromium/content/common/sandbox_init_win.cc
@@ -12,16 +12,16 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/sandbox_init.h"
 #include "content/public/common/sandboxed_process_launcher_delegate.h"
+#include "sandbox/policy/sandbox.h"
+#include "sandbox/policy/win/sandbox_win.h"
 #include "sandbox/win/src/sandbox.h"
 #include "sandbox/win/src/sandbox_types.h"
-#include "services/service_manager/sandbox/sandbox.h"
-#include "services/service_manager/sandbox/win/sandbox_win.h"
 
 namespace content {
 
-bool InitializeSandbox(service_manager::SandboxType sandbox_type,
+bool InitializeSandbox(sandbox::policy::SandboxType sandbox_type,
                        sandbox::SandboxInterfaceInfo* sandbox_info) {
-  return service_manager::Sandbox::Initialize(sandbox_type, sandbox_info);
+  return sandbox::policy::Sandbox::Initialize(sandbox_type, sandbox_info);
 }
 
 sandbox::ResultCode StartSandboxedProcess(
@@ -47,7 +47,7 @@ sandbox::ResultCode StartSandboxedProcess(
       child_command_line->AppendSwitch(switches::kWaitForDebugger);
   }
 
-  return service_manager::SandboxWin::StartSandboxedProcess(
+  return sandbox::policy::SandboxWin::StartSandboxedProcess(
       child_command_line, type_str, handles_to_inherit, delegate, process);
 }
 
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl.cc b/chromium/content/common/service_manager/service_manager_connection_impl.cc
index c36c475e21e..6b2ed580e93 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl.cc
+++ b/chromium/content/common/service_manager/service_manager_connection_impl.cc
@@ -14,7 +14,7 @@
 #include "base/compiler_specific.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
-#include "base/message_loop/message_loop_current.h"
+#include "base/task/current_thread.h"
 #include "base/thread_annotations.h"
 #include "base/threading/thread_checker.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -23,7 +23,7 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "services/service_manager/public/cpp/service.h"
-#include "services/service_manager/public/cpp/service_binding.h"
+#include "services/service_manager/public/cpp/service_receiver.h"
 #include "services/service_manager/public/mojom/constants.mojom.h"
 
 #if defined(OS_ANDROID)
@@ -50,11 +50,12 @@ class ServiceManagerConnectionImpl::IOThreadContext
     : public base::RefCountedThreadSafe<IOThreadContext>,
       public service_manager::Service {
  public:
-  IOThreadContext(service_manager::mojom::ServiceRequest service_request,
-                  scoped_refptr<base::SequencedTaskRunner> io_task_runner,
-                  mojo::PendingReceiver<service_manager::mojom::Connector>
-                      connector_receiver)
-      : pending_service_request_(std::move(service_request)),
+  IOThreadContext(
+      mojo::PendingReceiver<service_manager::mojom::Service> service_receiver,
+      scoped_refptr<base::SequencedTaskRunner> io_task_runner,
+      mojo::PendingReceiver<service_manager::mojom::Connector>
+          connector_receiver)
+      : pending_service_receiver_(std::move(service_receiver)),
         io_task_runner_(io_task_runner),
         pending_connector_receiver_(std::move(connector_receiver)) {
     // This will be reattached by any of the IO thread functions on first call.
@@ -114,16 +115,15 @@ class ServiceManagerConnectionImpl::IOThreadContext
  private:
   friend class base::RefCountedThreadSafe<IOThreadContext>;
 
-  class MessageLoopObserver
-      : public base::MessageLoopCurrent::DestructionObserver {
+  class MessageLoopObserver : public base::CurrentThread::DestructionObserver {
    public:
     explicit MessageLoopObserver(base::WeakPtr<IOThreadContext> context)
         : context_(context) {
-      base::MessageLoopCurrent::Get()->AddDestructionObserver(this);
+      base::CurrentThread::Get()->AddDestructionObserver(this);
     }
 
     ~MessageLoopObserver() override {
-      base::MessageLoopCurrent::Get()->RemoveDestructionObserver(this);
+      base::CurrentThread::Get()->RemoveDestructionObserver(this);
     }
 
     void ShutDown() {
@@ -155,18 +155,18 @@ class ServiceManagerConnectionImpl::IOThreadContext
 
   static void WrapServiceRequestHandlerNoCallback(
       const ServiceRequestHandler& handler,
-      service_manager::mojom::ServiceRequest request,
+      mojo::PendingReceiver<service_manager::mojom::Service> receiver,
       CreatePackagedServiceInstanceCallback callback) {
-    handler.Run(std::move(request));
+    handler.Run(std::move(receiver));
     std::move(callback).Run(base::GetCurrentProcId());
   }
 
   void StartOnIOThread() {
     // Should bind |io_thread_checker_| to the context's thread.
     DCHECK(io_thread_checker_.CalledOnValidThread());
-    service_binding_ = std::make_unique<service_manager::ServiceBinding>(
-        this, std::move(pending_service_request_));
-    service_binding_->GetConnector()->BindConnectorReceiver(
+    service_receiver_ = std::make_unique<service_manager::ServiceReceiver>(
+        this, std::move(pending_service_receiver_));
+    service_receiver_->GetConnector()->BindConnectorReceiver(
         std::move(pending_connector_receiver_));
 
     // MessageLoopObserver owns itself.
@@ -196,7 +196,7 @@ class ServiceManagerConnectionImpl::IOThreadContext
     // unwinds.
     scoped_refptr<IOThreadContext> keepalive(this);
 
-    service_binding_.reset();
+    service_receiver_.reset();
 
     StopOnIOThread();
   }
@@ -222,20 +222,19 @@ class ServiceManagerConnectionImpl::IOThreadContext
       mojo::PendingReceiver<service_manager::mojom::Service> receiver,
       CreatePackagedServiceInstanceCallback callback) override {
     DCHECK(io_thread_checker_.CalledOnValidThread());
-    service_manager::mojom::ServiceRequest request(std::move(receiver));
     auto it = request_handlers_.find(service_name);
     if (it == request_handlers_.end()) {
       if (default_request_handler_) {
         callback_task_runner_->PostTask(
             FROM_HERE, base::BindOnce(default_request_handler_, service_name,
-                                      std::move(request)));
+                                      std::move(receiver)));
       } else {
         LOG(ERROR) << "Can't create service " << service_name
                    << ". No handler found.";
       }
       std::move(callback).Run(base::nullopt);
     } else {
-      it->second.Run(std::move(request), std::move(callback));
+      it->second.Run(std::move(receiver), std::move(callback));
     }
   }
 
@@ -251,7 +250,8 @@ class ServiceManagerConnectionImpl::IOThreadContext
 
   // Temporary state established on construction and consumed on the IO thread
   // once the connection is started.
-  service_manager::mojom::ServiceRequest pending_service_request_;
+  mojo::PendingReceiver<service_manager::mojom::Service>
+      pending_service_receiver_;
   scoped_refptr<base::SequencedTaskRunner> io_task_runner_;
   mojo::PendingReceiver<service_manager::mojom::Connector>
       pending_connector_receiver_;
@@ -263,7 +263,7 @@ class ServiceManagerConnectionImpl::IOThreadContext
   // Callback to run if the service is stopped by the service manager.
   base::OnceClosure stop_callback_;
 
-  std::unique_ptr<service_manager::ServiceBinding> service_binding_;
+  std::unique_ptr<service_manager::ServiceReceiver> service_receiver_;
 
   // Not owned.
   MessageLoopObserver* message_loop_observer_ = nullptr;
@@ -321,11 +321,11 @@ void ServiceManagerConnection::SetFactoryForTest(Factory* factory) {
 
 // static
 std::unique_ptr<ServiceManagerConnection> ServiceManagerConnection::Create(
-    service_manager::mojom::ServiceRequest request,
+    mojo::PendingReceiver<service_manager::mojom::Service> receiver,
     scoped_refptr<base::SequencedTaskRunner> io_task_runner) {
   if (service_manager_connection_factory)
     return service_manager_connection_factory->Run();
-  return std::make_unique<ServiceManagerConnectionImpl>(std::move(request),
+  return std::make_unique<ServiceManagerConnectionImpl>(std::move(receiver),
                                                         io_task_runner);
 }
 
@@ -335,11 +335,11 @@ ServiceManagerConnection::~ServiceManagerConnection() {}
 // ServiceManagerConnectionImpl, public:
 
 ServiceManagerConnectionImpl::ServiceManagerConnectionImpl(
-    service_manager::mojom::ServiceRequest request,
+    mojo::PendingReceiver<service_manager::mojom::Service> receiver,
     scoped_refptr<base::SequencedTaskRunner> io_task_runner) {
   mojo::PendingReceiver<service_manager::mojom::Connector> connector_receiver;
   connector_ = service_manager::Connector::Create(&connector_receiver);
-  context_ = new IOThreadContext(std::move(request), io_task_runner,
+  context_ = new IOThreadContext(std::move(receiver), io_task_runner,
                                  std::move(connector_receiver));
 }
 
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl.h b/chromium/content/common/service_manager/service_manager_connection_impl.h
index 38bdd6186fe..642323846f8 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl.h
+++ b/chromium/content/common/service_manager/service_manager_connection_impl.h
@@ -13,6 +13,7 @@
 #include "base/sequenced_task_runner.h"
 #include "content/common/content_export.h"
 #include "content/public/common/service_manager_connection.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "services/service_manager/public/cpp/identity.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
@@ -27,7 +28,7 @@ class CONTENT_EXPORT ServiceManagerConnectionImpl
     : public ServiceManagerConnection {
  public:
   explicit ServiceManagerConnectionImpl(
-      service_manager::mojom::ServiceRequest request,
+      mojo::PendingReceiver<service_manager::mojom::Service> receiver,
       scoped_refptr<base::SequencedTaskRunner> io_task_runner);
   ~ServiceManagerConnectionImpl() override;
 
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc b/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
index 47d7312fc3c..608488a675c 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
+++ b/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
@@ -34,10 +34,11 @@ TEST(ServiceManagerConnectionImplTest, ServiceLaunchThreading) {
   base::WaitableEvent event(base::WaitableEvent::ResetPolicy::MANUAL,
                             base::WaitableEvent::InitialState::NOT_SIGNALED);
   connection.AddServiceRequestHandler(
-      kTestServiceName, base::BindLambdaForTesting(
-                            [&event](service_manager::mojom::ServiceRequest) {
-                              event.Signal();
-                            }));
+      kTestServiceName,
+      base::BindLambdaForTesting(
+          [&event](mojo::PendingReceiver<service_manager::mojom::Service>) {
+            event.Signal();
+          }));
   connection.Start();
 
   mojo::PendingRemote<service_manager::mojom::Service> packaged_service;
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.cc b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
index b09fd3dc98b..d3b57dd9305 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.cc
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
@@ -13,6 +13,7 @@
 #include "base/strings/stringprintf.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/http/http_util.h"
+#include "net/url_request/redirect_info.h"
 #include "net/url_request/redirect_util.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_request_body.h"
@@ -132,11 +133,11 @@ ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
 
   // If the request is a MAIN_FRAME request, the first-party URL gets
   // updated on redirects.
-  const net::URLRequest::FirstPartyURLPolicy first_party_url_policy =
+  const net::RedirectInfo::FirstPartyURLPolicy first_party_url_policy =
       original_request.resource_type ==
               static_cast<int>(blink::mojom::ResourceType::kMainFrame)
-          ? net::URLRequest::UPDATE_FIRST_PARTY_URL_ON_REDIRECT
-          : net::URLRequest::NEVER_CHANGE_FIRST_PARTY_URL;
+          ? net::RedirectInfo::FirstPartyURLPolicy::UPDATE_URL_ON_REDIRECT
+          : net::RedirectInfo::FirstPartyURLPolicy::NEVER_CHANGE_URL;
   return net::RedirectInfo::ComputeRedirectInfo(
       original_request.method, original_request.url,
       original_request.site_for_cookies, first_party_url_policy,
diff --git a/chromium/content/common/service_worker/service_worker_utils.cc b/chromium/content/common/service_worker/service_worker_utils.cc
index eb8dd0ecf59..0de8e1bf73b 100644
--- a/chromium/content/common/service_worker/service_worker_utils.cc
+++ b/chromium/content/common/service_worker/service_worker_utils.cc
@@ -15,7 +15,6 @@
 #include "content/public/common/origin_util.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_byte_range.h"
-#include "net/http/http_util.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "third_party/blink/public/common/features.h"
@@ -246,51 +245,6 @@ const char* ServiceWorkerUtils::FetchResponseSourceToSuffix(
   return ".Unknown";
 }
 
-ServiceWorkerUtils::ResourceResponseHeadAndMetadata::
-    ResourceResponseHeadAndMetadata(
-        network::mojom::URLResponseHeadPtr head,
-        scoped_refptr<net::IOBufferWithSize> metadata)
-    : head(std::move(head)), metadata(std::move(metadata)) {}
-
-ServiceWorkerUtils::ResourceResponseHeadAndMetadata::
-    ResourceResponseHeadAndMetadata(ResourceResponseHeadAndMetadata&& other) =
-        default;
-
-ServiceWorkerUtils::ResourceResponseHeadAndMetadata::
-    ~ResourceResponseHeadAndMetadata() = default;
-
-ServiceWorkerUtils::ResourceResponseHeadAndMetadata
-ServiceWorkerUtils::CreateResourceResponseHeadAndMetadata(
-    const net::HttpResponseInfo* http_info,
-    uint32_t options,
-    base::TimeTicks request_start_time,
-    base::TimeTicks response_start_time,
-    int response_data_size) {
-  DCHECK(http_info);
-  DCHECK(http_info->headers);
-
-  auto head = network::mojom::URLResponseHead::New();
-  head->request_start = request_start_time;
-  head->response_start = response_start_time;
-  head->request_time = http_info->request_time;
-  head->response_time = http_info->response_time;
-  head->headers = http_info->headers;
-  head->headers->GetMimeType(&head->mime_type);
-  head->headers->GetCharset(&head->charset);
-  head->content_length = response_data_size;
-  head->was_fetched_via_spdy = http_info->was_fetched_via_spdy;
-  head->was_alpn_negotiated = http_info->was_alpn_negotiated;
-  head->connection_info = http_info->connection_info;
-  head->alpn_negotiated_protocol = http_info->alpn_negotiated_protocol;
-  head->remote_endpoint = http_info->remote_endpoint;
-  head->cert_status = http_info->ssl_info.cert_status;
-
-  if (options & network::mojom::kURLLoadOptionSendSSLInfoWithResponse)
-    head->ssl_info = http_info->ssl_info;
-
-  return {std::move(head), std::move(http_info->metadata)};
-}
-
 bool LongestScopeMatcher::MatchLongest(const GURL& scope) {
   if (!ServiceWorkerUtils::ScopeMatches(scope, url_))
     return false;
diff --git a/chromium/content/common/service_worker/service_worker_utils.h b/chromium/content/common/service_worker/service_worker_utils.h
index 1ea5f93e362..3346272023f 100644
--- a/chromium/content/common/service_worker/service_worker_utils.h
+++ b/chromium/content/common/service_worker/service_worker_utils.h
@@ -14,8 +14,6 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/public/common/content_switches.h"
-#include "net/http/http_request_headers.h"
-#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/fetch/fetch_api_request_headers_map.h"
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
@@ -77,26 +75,6 @@ class ServiceWorkerUtils {
   CONTENT_EXPORT static const char* FetchResponseSourceToSuffix(
       network::mojom::FetchResponseSource source);
 
-  struct CONTENT_EXPORT ResourceResponseHeadAndMetadata {
-    ResourceResponseHeadAndMetadata(
-        network::mojom::URLResponseHeadPtr head,
-        scoped_refptr<net::IOBufferWithSize> metadata);
-    ResourceResponseHeadAndMetadata(ResourceResponseHeadAndMetadata&& other);
-    ResourceResponseHeadAndMetadata(
-        const ResourceResponseHeadAndMetadata& other) = delete;
-    ~ResourceResponseHeadAndMetadata();
-
-    network::mojom::URLResponseHeadPtr head;
-    scoped_refptr<net::IOBufferWithSize> metadata;
-  };
-
-  CONTENT_EXPORT static ResourceResponseHeadAndMetadata
-  CreateResourceResponseHeadAndMetadata(const net::HttpResponseInfo* http_info,
-                                        uint32_t options,
-                                        base::TimeTicks request_start_time,
-                                        base::TimeTicks response_start_time,
-                                        int response_data_size);
-
  private:
   static bool IsPathRestrictionSatisfiedInternal(
       const GURL& scope,
diff --git a/chromium/content/common/text_input_client_messages.h b/chromium/content/common/text_input_client_messages.h
deleted file mode 100644
index f10568fee28..00000000000
--- a/chromium/content/common/text_input_client_messages.h
+++ /dev/null
@@ -1,68 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_TEXT_INPUT_CLIENT_MESSAGES_H_
-#define CONTENT_COMMON_TEXT_INPUT_CLIENT_MESSAGES_H_
-
-#include <stddef.h>
-
-#include "build/build_config.h"
-#include "ipc/ipc_message_macros.h"
-#include "ui/gfx/geometry/rect.h"
-#include "ui/gfx/range/range.h"
-
-#if defined(OS_MACOSX)
-#include "content/common/mac/attributed_string_type_converters.h"
-#include "ui/base/mojom/attributed_string.mojom.h"
-#endif
-
-#define IPC_MESSAGE_START TextInputClientMsgStart
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-
-#if defined(OS_MACOSX)
-IPC_STRUCT_TRAITS_BEGIN(ui::mojom::FontAttribute)
-  IPC_STRUCT_TRAITS_MEMBER(font_name)
-  IPC_STRUCT_TRAITS_MEMBER(font_point_size)
-  IPC_STRUCT_TRAITS_MEMBER(effective_range)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(ui::mojom::AttributedString)
-  IPC_STRUCT_TRAITS_MEMBER(string)
-  IPC_STRUCT_TRAITS_MEMBER(attributes)
-IPC_STRUCT_TRAITS_END()
-#endif
-
-// Browser -> Renderer Messages ////////////////////////////////////////////////
-// These messages are sent from the browser to the renderer. Each one has a
-// corresponding reply message.
-////////////////////////////////////////////////////////////////////////////////
-
-// Tells the renderer to send back the text fragment in a given range.
-IPC_MESSAGE_ROUTED1(TextInputClientMsg_StringForRange,
-                    gfx::Range)
-
-// Tells the renderer to send back the word under the given point and its
-// baseline point.
-IPC_MESSAGE_ROUTED1(TextInputClientMsg_StringAtPoint, gfx::Point)
-
-////////////////////////////////////////////////////////////////////////////////
-
-// Renderer -> Browser Replies /////////////////////////////////////////////////
-// These messages are sent in reply to the above messages.
-////////////////////////////////////////////////////////////////////////////////
-
-#if defined(OS_MACOSX)
-// Reply message for TextInputClientMsg_StringForRange.
-IPC_MESSAGE_ROUTED2(TextInputClientReplyMsg_GotStringForRange,
-                    ui::mojom::AttributedString,
-                    gfx::Point)
-
-// Reply message for TextInputClientMsg_StringAtPoint
-IPC_MESSAGE_ROUTED2(TextInputClientReplyMsg_GotStringAtPoint,
-                    ui::mojom::AttributedString,
-                    gfx::Point)
-#endif  // defined(OS_MACOSX)
-
-#endif  // CONTENT_COMMON_TEXT_INPUT_CLIENT_MESSAGES_H_
diff --git a/chromium/content/common/trace_utils.h b/chromium/content/common/trace_utils.h
new file mode 100644
index 00000000000..498968552e7
--- /dev/null
+++ b/chromium/content/common/trace_utils.h
@@ -0,0 +1,70 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_TRACE_UTILS_H_
+#define CONTENT_COMMON_TRACE_UTILS_H_
+
+#include <string>
+
+#include "base/trace_event/traced_value.h"
+
+namespace content {
+
+struct TracingCategory {
+  static constexpr const char kNavigation[] = "navigation";
+};
+
+// Class which facilitates annotating with traces all possible return paths
+// from a function or a method. Setting the return reason is enforced by a
+// CHECK at runtime to ensure that no return branches have been missed.
+// Template usage is necessary since the tracing code requires the category to
+// be constant at compile time.
+//
+// Example usage:
+//
+// void SomeMethod() {
+//   TraceReturnReason<TracingCategory::kNavigation> trace_return("Method");
+//
+//   if (condition) {
+//     trace_return.set_return_reason("foo");
+//     trace_return.traced_value()->SetBoolean("condition", true);
+//     return;
+//   }
+//
+//   trace_return.set_return_reason("default return");
+//   return;
+// }
+//
+template <const char* category>
+class TraceReturnReason {
+ public:
+  explicit TraceReturnReason(const char* const name)
+      : name_(name),
+        traced_value_(std::make_unique<base::trace_event::TracedValue>()) {
+    TRACE_EVENT_BEGIN0(category, name_);
+  }
+
+  ~TraceReturnReason() {
+    CHECK(reason_set_);
+    TRACE_EVENT_END1(category, name_, "return", std::move(traced_value_));
+  }
+
+  void set_return_reason(const std::string& reason) {
+    reason_set_ = true;
+    traced_value_->SetString("reason", reason);
+  }
+
+  // This method exposes the internal TracedValue member so usage of this
+  // class allows easy addition of more data to the end of the event.
+  base::trace_event::TracedValue* traced_value() { return traced_value_.get(); }
+
+ private:
+  const char* const name_;
+  bool reason_set_ = false;
+  std::unique_ptr<base::trace_event::TracedValue> traced_value_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_TRACE_UTILS_H_
diff --git a/chromium/content/common/unique_name_helper.cc b/chromium/content/common/unique_name_helper.cc
index 2e833638fdc..9aa9b98cf9d 100644
--- a/chromium/content/common/unique_name_helper.cc
+++ b/chromium/content/common/unique_name_helper.cc
@@ -43,7 +43,7 @@ class PendingChildFrameAdapter : public UniqueNameHelper::FrameAdapter {
     NOTREACHED();
     return 0;
   }
-  std::vector<base::StringPiece> CollectAncestorNames(
+  std::vector<std::string> CollectAncestorNames(
       BeginPoint begin_point,
       bool (*should_stop)(base::StringPiece)) const override {
     DCHECK_EQ(BeginPoint::kParentFrame, begin_point);
@@ -69,13 +69,14 @@ constexpr char kDynamicFrameMarker[] = "<!--dynamicFrame";
 constexpr size_t kMaxRequestedNameSize = 80;
 
 bool IsNameWithFramePath(base::StringPiece name) {
-  return name.starts_with(kFramePathPrefix) && name.ends_with("-->") &&
+  return base::StartsWith(name, kFramePathPrefix) &&
+         base::EndsWith(name, "-->") &&
          (kFramePathPrefixLength + kFramePathSuffixLength) < name.size();
 }
 
 std::string GenerateCandidate(const FrameAdapter* frame) {
   std::string new_name(kFramePathPrefix);
-  std::vector<base::StringPiece> ancestor_names = frame->CollectAncestorNames(
+  std::vector<std::string> ancestor_names = frame->CollectAncestorNames(
       FrameAdapter::BeginPoint::kParentFrame, &IsNameWithFramePath);
   std::reverse(ancestor_names.begin(), ancestor_names.end());
   // Note: This checks ancestor_names[0] twice, but it's nicer to do the name
diff --git a/chromium/content/common/unique_name_helper.h b/chromium/content/common/unique_name_helper.h
index 725b67f89a2..6a05472a91a 100644
--- a/chromium/content/common/unique_name_helper.h
+++ b/chromium/content/common/unique_name_helper.h
@@ -96,7 +96,7 @@ class CONTENT_EXPORT UniqueNameHelper {
     // the chain from this frame to the root frame. |begin_point| indicates the
     // reference point for starting the collection. |should_stop| is a
     // boolean predicate that indicates when to stop collection of names.
-    virtual std::vector<base::StringPiece> CollectAncestorNames(
+    virtual std::vector<std::string> CollectAncestorNames(
         BeginPoint begin_point,
         bool (*should_stop)(base::StringPiece)) const = 0;
     // Returns a vector of ints representing the child index of each frame in
diff --git a/chromium/content/common/unique_name_helper_unittest.cc b/chromium/content/common/unique_name_helper_unittest.cc
index bb196c2551a..ac894539d30 100644
--- a/chromium/content/common/unique_name_helper_unittest.cc
+++ b/chromium/content/common/unique_name_helper_unittest.cc
@@ -64,11 +64,11 @@ class TestFrameAdapter : public UniqueNameHelper::FrameAdapter {
     return 0;
   }
 
-  std::vector<base::StringPiece> CollectAncestorNames(
+  std::vector<std::string> CollectAncestorNames(
       BeginPoint begin_point,
       bool (*should_stop)(base::StringPiece)) const override {
     EXPECT_EQ(BeginPoint::kParentFrame, begin_point);
-    std::vector<base::StringPiece> result;
+    std::vector<std::string> result;
     for (auto* adapter = parent_; adapter; adapter = adapter->parent_) {
       result.push_back(adapter->GetNameForCurrentMode());
       if (should_stop(result.back()))
diff --git a/chromium/content/common/user_agent.cc b/chromium/content/common/user_agent.cc
index 80d658a1906..1968595853d 100644
--- a/chromium/content/common/user_agent.cc
+++ b/chromium/content/common/user_agent.cc
@@ -12,11 +12,12 @@
 #include "base/strings/stringprintf.h"
 #include "base/system/sys_info.h"
 #include "build/build_config.h"
+#include "build/lacros_buildflags.h"
 #include "build/util/webkit_version.h"
 
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
-#elif defined(OS_POSIX) && !defined(OS_MACOSX)
+#elif defined(OS_POSIX) && !defined(OS_MAC)
 #include <sys/utsname.h>
 #endif
 
@@ -27,7 +28,7 @@ namespace {
 std::string GetUserAgentPlatform() {
 #if defined(OS_WIN)
   return "";
-#elif defined(OS_MACOSX)
+#elif defined(OS_MAC)
   return "Macintosh; ";
 #elif defined(USE_X11) || defined(USE_OZONE)
   return "X11; ";  // strange, but that's what Firefox uses
@@ -58,7 +59,7 @@ std::string GetWebKitRevision() {
 std::string BuildCpuInfo() {
   std::string cpuinfo;
 
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
   cpuinfo = "Intel";
 #elif defined(OS_WIN)
   base::win::OSInfo* os_info = base::win::OSInfo::GetInstance();
@@ -72,7 +73,7 @@ std::string BuildCpuInfo() {
     else if (windows_architecture == base::win::OSInfo::IA64_ARCHITECTURE)
       cpuinfo = "Win64; IA64";
   }
-#elif defined(OS_POSIX) && !defined(OS_MACOSX)
+#elif defined(OS_POSIX) && !defined(OS_MAC)
   // Should work on any Posix system.
   struct utsname unixinfo;
   uname(&unixinfo);
@@ -92,16 +93,18 @@ std::string BuildCpuInfo() {
 // Return the CPU architecture in Linux or Windows and the empty string
 // elsewhere.
 std::string GetLowEntropyCpuArchitecture() {
-#if !defined(OS_MACOSX) && !defined(OS_ANDROID) && defined(OS_POSIX)
+#if !defined(OS_MAC) && !defined(OS_ANDROID) && defined(OS_POSIX)
   // This extra cpu_info_str variable is required to make sure the compiler
   // doesn't optimize the copy away and have the StringPiece point at the
   // internal std::string, resulting in a memory violation.
   std::string cpu_info_str = BuildCpuInfo();
   base::StringPiece cpu_info = cpu_info_str;
-  if (cpu_info.starts_with("arm") || cpu_info.starts_with("aarch")) {
+  if (base::StartsWith(cpu_info, "arm") ||
+      base::StartsWith(cpu_info, "aarch")) {
     return "arm";
-  } else if ((cpu_info.starts_with("i") && cpu_info.substr(2, 2) == "86") ||
-             cpu_info.starts_with("x86")) {
+  } else if ((base::StartsWith(cpu_info, "i") &&
+              cpu_info.substr(2, 2) == "86") ||
+             base::StartsWith(cpu_info, "x86")) {
     return "x86";
   }
 #elif defined(OS_WIN)
@@ -120,7 +123,8 @@ std::string GetLowEntropyCpuArchitecture() {
 std::string GetOSVersion(IncludeAndroidBuildNumber include_android_build_number,
                          IncludeAndroidModel include_android_model) {
   std::string os_version;
-#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+#if defined(OS_WIN) || defined(OS_MAC) || defined(OS_CHROMEOS) || \
+    BUILDFLAG(IS_LACROS)
   int32_t os_major_version = 0;
   int32_t os_minor_version = 0;
   int32_t os_bugfix_version = 0;
@@ -137,12 +141,12 @@ std::string GetOSVersion(IncludeAndroidBuildNumber include_android_build_number,
   base::StringAppendF(&os_version,
 #if defined(OS_WIN)
                       "%d.%d", os_major_version, os_minor_version
-#elif defined(OS_MACOSX)
+#elif defined(OS_MAC)
                       "%d_%d_%d", os_major_version, os_minor_version,
                       os_bugfix_version
-#elif defined(OS_CHROMEOS)
-                      "%d.%d.%d",
-                      os_major_version, os_minor_version, os_bugfix_version
+#elif defined(OS_CHROMEOS) || BUILDFLAG(IS_LACROS)
+                      "%d.%d.%d", os_major_version, os_minor_version,
+                      os_bugfix_version
 #elif defined(OS_ANDROID)
                       "%s%s", android_version_str.c_str(),
                       android_info_str.c_str()
@@ -165,7 +169,7 @@ std::string BuildOSCpuInfoFromOSVersionAndCpuType(const std::string& os_version,
                                                   const std::string& cpu_type) {
   std::string os_cpu;
 
-#if !defined(OS_ANDROID) && defined(OS_POSIX) && !defined(OS_MACOSX)
+#if !defined(OS_ANDROID) && defined(OS_POSIX) && !defined(OS_MAC)
   // Should work on any Posix system.
   struct utsname unixinfo;
   uname(&unixinfo);
@@ -179,9 +183,9 @@ std::string BuildOSCpuInfoFromOSVersionAndCpuType(const std::string& os_version,
     base::StringAppendF(&os_cpu, "Windows NT %s", os_version.c_str());
 #else
   base::StringAppendF(&os_cpu,
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
                       "%s Mac OS X %s", cpu_type.c_str(), os_version.c_str()
-#elif defined(OS_CHROMEOS)
+#elif defined(OS_CHROMEOS) || BUILDFLAG(IS_LACROS)
                       "CrOS "
                       "%s %s",
                       cpu_type.c_str(),  // e.g. i686
diff --git a/chromium/content/common/user_agent_unittest.cc b/chromium/content/common/user_agent_unittest.cc
index f8cd41abced..eb6b74c59d3 100644
--- a/chromium/content/common/user_agent_unittest.cc
+++ b/chromium/content/common/user_agent_unittest.cc
@@ -55,7 +55,7 @@ TEST(UserAgentStringTest, BuildOSCpuInfoFromOSVersionAndCpuType) {
         /*cpu_type=*/"CPU TYPE",
         /*expected_os_cpu_info=*/"Windows NT VERSION; CPU TYPE",
     },
-#elif defined(OS_MACOSX)
+#elif defined(OS_MAC)
     {
         /*os_version=*/"10_15_4",
         /*cpu_type=*/"Intel",
diff --git a/chromium/content/common/view_messages.h b/chromium/content/common/view_messages.h
index 19fa7ac2692..1a18cbf17c0 100644
--- a/chromium/content/common/view_messages.h
+++ b/chromium/content/common/view_messages.h
@@ -54,7 +54,7 @@
 #include "ui/gfx/ipc/skia/gfx_skia_param_traits.h"
 #include "ui/native_theme/native_theme.h"
 
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
 #include "third_party/blink/public/platform/mac/web_scrollbar_theme.h"
 #endif
 
@@ -73,7 +73,7 @@ IPC_ENUM_TRAITS_MAX_VALUE(content::ThreeDAPIType,
                           content::THREE_D_API_TYPE_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(ui::TextInputType, ui::TEXT_INPUT_TYPE_MAX)
 
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::ScrollerStyle, blink::kScrollerStyleOverlay)
 #endif
 
@@ -135,10 +135,6 @@ IPC_MESSAGE_ROUTED2(ViewHostMsg_ShowWidget,
 IPC_MESSAGE_ROUTED1(ViewHostMsg_ShowFullscreenWidget,
                     int /* route_id */)
 
-// Sent from an inactive renderer for the browser to route to the active
-// renderer, instructing it to close.
-IPC_MESSAGE_ROUTED0(ViewHostMsg_RouteCloseEvent)
-
 // Notifies the browser that we want to show a destination url for a potential
 // action (e.g. when the user is hovering over a link).
 IPC_MESSAGE_ROUTED1(ViewHostMsg_UpdateTargetURL,
diff --git a/chromium/content/common/visual_properties.cc b/chromium/content/common/visual_properties.cc
deleted file mode 100644
index 34c16c3fba5..00000000000
--- a/chromium/content/common/visual_properties.cc
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/visual_properties.h"
-
-namespace content {
-
-VisualProperties::VisualProperties() = default;
-
-VisualProperties::VisualProperties(const VisualProperties& other) = default;
-
-VisualProperties::~VisualProperties() = default;
-
-VisualProperties& VisualProperties::operator=(const VisualProperties& other) =
-    default;
-
-}  // namespace content
diff --git a/chromium/content/common/visual_properties.h b/chromium/content/common/visual_properties.h
deleted file mode 100644
index 058fbee62b5..00000000000
--- a/chromium/content/common/visual_properties.h
+++ /dev/null
@@ -1,138 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_VISUAL_PROPERTIES_H_
-#define CONTENT_COMMON_VISUAL_PROPERTIES_H_
-
-#include "base/optional.h"
-#include "base/time/time.h"
-#include "cc/trees/browser_controls_params.h"
-#include "components/viz/common/surfaces/local_surface_id_allocation.h"
-#include "content/common/content_export.h"
-#include "content/public/common/screen_info.h"
-#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
-#include "ui/gfx/geometry/size.h"
-
-namespace content {
-
-// Visual properties contain context required to render a frame tree.
-// For legacy reasons, both Page visual properties [shared by all Renderers] and
-// Widget visual properties [unique to local frame roots] are passed along the
-// same data structure. Separating these is tricky because they both affect
-// rendering, and if updates are received asynchronously, this can cause
-// incorrect behavior.
-// Visual properties are also used for Pepper fullscreen and popups, which are
-// also based on Widgets.
-//
-// The data flow for VisualProperties is tricky. For legacy reasons, visual
-// properties are currently always sent from RenderWidgetHosts to RenderWidgets.
-// However, RenderWidgets can also send visual properties to out-of-process
-// subframes [by bouncing through CrossProcessFrameConnector]. This causes a
-// cascading series of VisualProperty messages. This is necessary due to the
-// current implementation to make sure that cross-process surfaces get
-// simultaneously synchronized. For more details, see:
-// https://docs.google.com/document/d/1VKOLBYlujcn862w9LAyUbv6oW9RZgD65oDCI_G5AEVQ/edit#heading=h.wno2seszsyen
-// https://docs.google.com/document/d/1J7BTRsylGApm6KHaaTu-m6LLvSWJgf1B9CM-USKIp1k/edit#heading=h.ichmoicfam1y
-//
-// Known problems:
-// + It's not clear which properties are page-specific and which are
-// widget-specific. We should document them.
-// + It's not clear which properties are only set by the browser, which are only
-// set by the renderer, and which are set by both.
-// + Given the frame tree A(B(A')) where A and A' are same-origin, same process
-// and B is separate origin separate process:
-//   (1) RenderWidget A gets SynchronizeVisualProperties, passes it to proxy for
-//   B, sets values on RenderView/Page.
-//   (2) RenderWidget B gets SynchronizeVisualProperties, passes it to proxy for
-//   A'
-//   (3) RenderWidget A' gets SynchronizeVisualProperties.
-// In between (1) and (3), frames associated with RenderWidget A' will see
-// updated page properties from (1) but are still seeing old widget properties.
-
-struct CONTENT_EXPORT VisualProperties {
-  VisualProperties();
-  VisualProperties(const VisualProperties& other);
-  ~VisualProperties();
-
-  VisualProperties& operator=(const VisualProperties& other);
-
-  // Information about the screen (dpi, depth, etc..).
-  ScreenInfo screen_info;
-
-  // Whether or not blink should be in auto-resize mode.
-  bool auto_resize_enabled = false;
-
-  // The minimum size for Blink if auto-resize is enabled.
-  gfx::Size min_size_for_auto_resize;
-
-  // The maximum size for Blink if auto-resize is enabled.
-  gfx::Size max_size_for_auto_resize;
-
-  // The size for the widget in DIPs.
-  gfx::Size new_size;
-
-  // The size of the area of the widget that is visible to the user, in DIPs.
-  // The visible area may be empty if the visible area does not intersect with
-  // the widget, for example in the case of a child frame that is entirely
-  // scrolled out of the main frame's viewport. It may also be smaller than the
-  // widget's size in |new_size| due to the UI hiding part of the widget, such
-  // as with an on-screen keyboard.
-  gfx::Size visible_viewport_size;
-
-  // The rect of compositor's viewport in pixels. Note that for top level
-  // widgets this is roughly the DSF scaled new_size put into a rect. For child
-  // frame widgets it is a pixel-perfect bounds of the visible region of the
-  // widget. The size would be similar to visible_viewport_size, but in physical
-  // pixels and computed via very different means.
-  // TODO(danakj): It would be super nice to remove one of |new_size|,
-  // |visible_viewport_size| and |compositor_viewport_pixel_rect|. Their values
-  // overlap in purpose, creating a very confusing situation about which to use
-  // for what, and how they should relate or not.
-  gfx::Rect compositor_viewport_pixel_rect;
-
-  // Browser controls params such as top and bottom controls heights, whether
-  // controls shrink blink size etc.
-  cc::BrowserControlsParams browser_controls_params;
-
-  // Whether or not the focused node should be scrolled into view after the
-  // resize.
-  bool scroll_focused_node_into_view = false;
-
-  // The local surface ID to use (if valid) and its allocation time.
-  base::Optional<viz::LocalSurfaceIdAllocation> local_surface_id_allocation;
-
-  // Indicates whether tab-initiated fullscreen was granted.
-  bool is_fullscreen_granted = false;
-
-  // The display mode.
-  blink::mojom::DisplayMode display_mode =
-      blink::mojom::DisplayMode::kUndefined;
-
-  // This represents the latest capture sequence number requested. When this is
-  // incremented, that means the caller wants to synchronize surfaces which
-  // should cause a new LocalSurfaceId to be generated.
-  uint32_t capture_sequence_number = 0u;
-
-  // This represents the page zoom level for a WebContents.
-  // (0 is the default value which results in 1.0 zoom factor).
-  double zoom_level = 0;
-
-  // This represents the page's scale factor, which changes during pinch zoom.
-  // It needs to be shared with subframes.
-  float page_scale_factor = 1.f;
-
-  // The logical segments of the root widget, in widget-relative DIPs. This
-  // property is set by the root RenderWidget in the renderer process, then
-  // propagated to child local frame roots via RenderFrameProxy/
-  // CrossProcessFrameConnector.
-  std::vector<gfx::Rect> root_widget_window_segments;
-
-  // Indicates whether a pinch gesture is currently active. Originates in the
-  // main frame's renderer, and needs to be shared with subframes.
-  bool is_pinch_gesture_active = false;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_VISUAL_PROPERTIES_H_
diff --git a/chromium/content/common/web_ui.mojom b/chromium/content/common/web_ui.mojom
new file mode 100644
index 00000000000..8ef66d38f95
--- /dev/null
+++ b/chromium/content/common/web_ui.mojom
@@ -0,0 +1,21 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "mojo/public/mojom/base/values.mojom";
+
+// For WebUI APIs, implemented by browser.
+interface WebUIHost {
+  // A message from HTML-based UI. When (trusted) JavaScript calls
+  // send(message, args), this message is sent to the browser.
+  Send(string message, mojo_base.mojom.ListValue args);
+};
+
+// For adding a property to the WebUI binding object, implemented by renderer.
+interface WebUI {
+  // Add a property to the WebUI binding object. This only works if we allowed
+  // WebUI bindings.
+  SetProperty(string property_name, string property_value_json);
+};
diff --git a/chromium/content/common/widget_messages.h b/chromium/content/common/widget_messages.h
index 676ce8bd627..e8a1e83f15f 100644
--- a/chromium/content/common/widget_messages.h
+++ b/chromium/content/common/widget_messages.h
@@ -13,10 +13,9 @@
 #include "content/common/common_param_traits_macros.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/content_to_visible_time_reporter.h"
-#include "content/common/visual_properties.h"
 #include "content/public/common/common_param_traits.h"
 #include "ipc/ipc_message_macros.h"
-#include "third_party/blink/public/common/screen_orientation/web_screen_orientation_type.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
 #include "ui/base/ime/text_input_action.h"
@@ -30,53 +29,19 @@
 
 #define IPC_MESSAGE_START WidgetMsgStart
 
-// Traits for WebDeviceEmulationParams.
-IPC_STRUCT_TRAITS_BEGIN(blink::WebFloatRect)
-  IPC_STRUCT_TRAITS_MEMBER(x)
-  IPC_STRUCT_TRAITS_MEMBER(y)
-  IPC_STRUCT_TRAITS_MEMBER(width)
-  IPC_STRUCT_TRAITS_MEMBER(height)
-IPC_STRUCT_TRAITS_END()
-
 IPC_STRUCT_TRAITS_BEGIN(blink::WebSize)
   IPC_STRUCT_TRAITS_MEMBER(width)
   IPC_STRUCT_TRAITS_MEMBER(height)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(blink::WebDeviceEmulationParams)
-  IPC_STRUCT_TRAITS_MEMBER(screen_position)
-  IPC_STRUCT_TRAITS_MEMBER(screen_size)
-  IPC_STRUCT_TRAITS_MEMBER(view_position)
-  IPC_STRUCT_TRAITS_MEMBER(device_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(view_size)
-  IPC_STRUCT_TRAITS_MEMBER(scale)
-  IPC_STRUCT_TRAITS_MEMBER(viewport_offset)
-  IPC_STRUCT_TRAITS_MEMBER(viewport_scale)
-  IPC_STRUCT_TRAITS_MEMBER(screen_orientation_angle)
-  IPC_STRUCT_TRAITS_MEMBER(screen_orientation_type)
-IPC_STRUCT_TRAITS_END()
-
 //
 // Browser -> Renderer Messages.
 //
 
-// Sent to inform the renderer to invoke a context menu.
-// The parameter specifies the location in the render widget's coordinates.
-IPC_MESSAGE_ROUTED2(WidgetMsg_ShowContextMenu,
-                    ui::MenuSourceType,
-                    gfx::Point /* location where menu should be shown */)
-
 // Tells the render widget to close.
 // Expects a Close_ACK message when finished.
 IPC_MESSAGE_ROUTED0(WidgetMsg_Close)
 
-// Enables device emulation. See WebDeviceEmulationParams for description.
-IPC_MESSAGE_ROUTED1(WidgetMsg_EnableDeviceEmulation,
-                    blink::WebDeviceEmulationParams /* params */)
-
-// Disables device emulation, enabled previously by EnableDeviceEmulation.
-IPC_MESSAGE_ROUTED0(WidgetMsg_DisableDeviceEmulation)
-
 // Sent to inform the widget that it was hidden.  This allows it to reduce its
 // resource utilization.
 IPC_MESSAGE_ROUTED0(WidgetMsg_WasHidden)
@@ -100,30 +65,12 @@ IPC_MESSAGE_ROUTED1(WidgetMsg_SetActive, bool /* active */)
 // are in progress.
 IPC_MESSAGE_ROUTED0(WidgetMsg_SetBounds_ACK)
 
-// Updates a RenderWidget's visual properties. This should include all
-// geometries and compositing inputs so that they are updated atomically.
-IPC_MESSAGE_ROUTED1(WidgetMsg_UpdateVisualProperties,
-                    content::VisualProperties /* visual_properties */)
-
-// Informs the RenderWidget of its position on the user's screen, as well as
-// the position of the native window holding the RenderWidget.
-// TODO(danakj): These should be part of UpdateVisualProperties.
-IPC_MESSAGE_ROUTED2(WidgetMsg_UpdateScreenRects,
-                    gfx::Rect /* widget_screen_rect */,
-                    gfx::Rect /* window_screen_rect */)
-
 // Sent by a parent frame to notify its child about the state of the child's
 // intersection with the parent's viewport, primarily for use by the
 // IntersectionObserver API. Also see FrameHostMsg_UpdateViewportIntersection.
 IPC_MESSAGE_ROUTED1(WidgetMsg_SetViewportIntersection,
                     blink::ViewportIntersectionState /* intersection_state */)
 
-
-// Sent by the browser to synchronize with the next compositor frame by
-// requesting an ACK be queued. Used only for tests.
-IPC_MESSAGE_ROUTED1(WidgetMsg_WaitForNextFrameForTests,
-                    int /* main_frame_thread_observer_routing_id */)
-
 //
 // Renderer -> Browser Messages.
 //
@@ -134,29 +81,13 @@ IPC_MESSAGE_ROUTED1(WidgetMsg_WaitForNextFrameForTests,
 // message to close the widget.
 IPC_MESSAGE_ROUTED0(WidgetHostMsg_Close)
 
-// Sent in response to a WidgetMsg_UpdateScreenRects so that the renderer can
-// throttle these messages.
-IPC_MESSAGE_ROUTED0(WidgetHostMsg_UpdateScreenRects_ACK)
-
 // Sent by the renderer process to request that the browser change the bounds of
 // the widget. This corresponds to the window.resizeTo() and window.moveTo()
 // APIs, and the browser may ignore this message.
 IPC_MESSAGE_ROUTED1(WidgetHostMsg_RequestSetBounds, gfx::Rect /* bounds */)
 
-// Sends a set of queued messages that were being held until the next
-// CompositorFrame is being submitted from the renderer. These messages are
-// sent before the OnRenderFrameMetadataChanged message is sent (via mojo) and
-// before the CompositorFrame is sent to the viz service. The |frame_token|
-// will match the token in the about-to-be-submitted CompositorFrame.
-IPC_MESSAGE_ROUTED2(WidgetHostMsg_FrameSwapMessages,
-                    uint32_t /* frame_token */,
-                    std::vector<IPC::Message> /* messages */)
-
 // Indicates that the render widget has been closed in response to a
 // Close message.
 IPC_MESSAGE_CONTROL1(WidgetHostMsg_Close_ACK, int /* old_route_id */)
 
-// Sent in reply to WidgetMsg_WaitForNextFrameForTests.
-IPC_MESSAGE_ROUTED0(WidgetHostMsg_WaitForNextFrameForTests_ACK)
-
 #endif  //  CONTENT_COMMON_WIDGET_MESSAGES_H_
diff --git a/chromium/content/common/zygote/sandbox_support_linux.cc b/chromium/content/common/zygote/sandbox_support_linux.cc
index dabc1009f72..f23c5c9ac2b 100644
--- a/chromium/content/common/zygote/sandbox_support_linux.cc
+++ b/chromium/content/common/zygote/sandbox_support_linux.cc
@@ -8,8 +8,8 @@
 #include "base/posix/global_descriptors.h"
 #include "base/posix/unix_domain_socket.h"
 #include "build/build_config.h"
+#include "sandbox/policy/linux/sandbox_linux.h"
 #include "services/service_manager/embedder/descriptors.h"
-#include "services/service_manager/sandbox/linux/sandbox_linux.h"
 
 namespace content {
 
@@ -18,7 +18,7 @@ int SharedMemoryIPCSupport::MakeSharedMemorySegment(size_t length,
                                                     bool executable) {
   base::Pickle request;
   request.WriteInt(
-      service_manager::SandboxLinux::METHOD_MAKE_SHARED_MEMORY_SEGMENT);
+      sandbox::policy::SandboxLinux::METHOD_MAKE_SHARED_MEMORY_SEGMENT);
   request.WriteUInt32(length);
   request.WriteBool(executable);
   uint8_t reply_buf[10];
diff --git a/chromium/content/common/zygote/zygote_communication_linux.cc b/chromium/content/common/zygote/zygote_communication_linux.cc
index 4ae0b9eebb3..9b7866ddba3 100644
--- a/chromium/content/common/zygote/zygote_communication_linux.cc
+++ b/chromium/content/common/zygote/zygote_communication_linux.cc
@@ -19,9 +19,9 @@
 #include "base/stl_util.h"
 #include "content/common/zygote/zygote_commands_linux.h"
 #include "content/public/common/content_switches.h"
+#include "sandbox/policy/switches.h"
 #include "services/service_manager/embedder/result_codes.h"
 #include "services/service_manager/embedder/switches.h"
-#include "services/service_manager/sandbox/switches.h"
 #include "third_party/icu/source/i18n/unicode/timezone.h"
 
 namespace content {
@@ -230,7 +230,7 @@ void ZygoteCommunication::Init(
                              service_manager::switches::kZygoteProcess);
 
   if (type_ == ZygoteType::kUnsandboxed)
-    cmd_line.AppendSwitch(service_manager::switches::kNoZygoteSandbox);
+    cmd_line.AppendSwitch(sandbox::policy::switches::kNoZygoteSandbox);
 
   const base::CommandLine& browser_command_line =
       *base::CommandLine::ForCurrentProcess();
@@ -241,10 +241,10 @@ void ZygoteCommunication::Init(
   // Append any switches from the service manager that need to be forwarded on
   // to the zygote/renderers.
   static const char* const kForwardSwitches[] = {
-      service_manager::switches::kAllowSandboxDebugging,
+      sandbox::policy::switches::kAllowSandboxDebugging,
       service_manager::switches::kDisableInProcessStackTraces,
-      service_manager::switches::kDisableSeccompFilterSandbox,
-      service_manager::switches::kNoSandbox,
+      sandbox::policy::switches::kDisableSeccompFilterSandbox,
+      sandbox::policy::switches::kNoSandbox,
   };
   cmd_line.CopySwitchesFrom(browser_command_line, kForwardSwitches,
                             base::size(kForwardSwitches));