BASELINE: Update Chromium to 68.0.3440.125

Change-Id: I23f19369e01f688e496f5bf179abb521ad73874f Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Allan Sandfeld Jensen <allan.jensen@qt.io> 2018-08-24 12:15:48 +0200
committer: Allan Sandfeld Jensen <allan.jensen@qt.io> 2018-08-28 13:30:04 +0000
commit: b014812705fc80bff0a5c120dfcef88f349816dc (patch)
tree: 25a2e2d9fa285f1add86aa333389a839f81a39ae /chromium/content/common
parent: 9f4560b1027ae06fdb497023cdcaf91b8511fa74 (diff)
download: qtwebengine-chromium-b014812705fc80bff0a5c120dfcef88f349816dc.tar.gz
133 files changed, 1886 insertions, 2772 deletions
diff --git a/chromium/content/common/BUILD.gn b/chromium/content/common/BUILD.gn
index 397d9172812..de4c4d2af49 100644
--- a/chromium/content/common/BUILD.gn
+++ b/chromium/content/common/BUILD.gn
@@ -7,7 +7,6 @@ import("//build/buildflag_header.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//ipc/features.gni")
-import("//media/media_options.gni")
 import("//mojo/public/tools/bindings/mojom.gni")
 import("//ppapi/buildflags/buildflags.gni")
 import("//sandbox/features.gni")
@@ -65,8 +64,6 @@ source_set("common") {
     "browser_plugin/browser_plugin_constants.cc",
     "browser_plugin/browser_plugin_constants.h",
     "browser_plugin/browser_plugin_messages.h",
-    "cache_storage/cache_storage_types.cc",
-    "cache_storage/cache_storage_types.h",
     "child_process_host_impl.cc",
     "child_process_host_impl.h",
     "common_sandbox_support_linux.cc",
@@ -138,8 +135,8 @@ source_set("common") {
     "frame_owner_properties.h",
     "frame_replication_state.cc",
     "frame_replication_state.h",
-    "frame_resize_params.cc",
-    "frame_resize_params.h",
+    "frame_visual_properties.cc",
+    "frame_visual_properties.h",
     "gin_java_bridge_messages.h",
     "in_process_child_thread_params.cc",
     "in_process_child_thread_params.h",
@@ -205,7 +202,6 @@ source_set("common") {
     "mac/font_loader.h",
     "mac/font_loader.mm",
     "media/aec_dump_messages.h",
-    "media/audio_messages.h",
     "media/cdm_info.cc",
     "media/media_devices.cc",
     "media/media_devices.h",
@@ -231,9 +227,9 @@ source_set("common") {
     "net/url_request_user_data.h",
     "notifications/notification_struct_traits.cc",
     "notifications/notification_struct_traits.h",
-    "origin_trials/trial_policy_impl.cc",
-    "origin_trials/trial_policy_impl.h",
     "origin_util.cc",
+    "p2p_messages.h",
+    "p2p_socket_type.h",
     "page_message_enums.h",
     "page_messages.h",
     "page_state_serialization.cc",
@@ -250,13 +246,12 @@ source_set("common") {
     "plugin_list.h",
     "possibly_associated_interface_ptr.h",
     "possibly_associated_interface_ptr_info.h",
+    "possibly_associated_wrapper_shared_url_loader_factory.h",
     "presentation/presentation_struct_traits.cc",
     "presentation/presentation_struct_traits.h",
     "process_type.cc",
     "render_widget_surface_properties.cc",
     "render_widget_surface_properties.h",
-    "resize_params.cc",
-    "resize_params.h",
     "resource_messages.h",
     "resource_timing_info.cc",
     "resource_timing_info.h",
@@ -264,7 +259,6 @@ source_set("common") {
     "sandbox_init_mac.cc",
     "sandbox_init_win.cc",
     "savable_subframe.h",
-    "send_zygote_child_ping_linux.cc",
     "service_manager/service_manager_connection_impl.cc",
     "service_manager/service_manager_connection_impl.h",
     "service_worker/service_worker_loader_helpers.cc",
@@ -280,7 +274,6 @@ source_set("common") {
     "service_worker/service_worker_utils.h",
     "single_request_url_loader_factory.cc",
     "single_request_url_loader_factory.h",
-    "speech_recognition_messages.h",
     "swapped_out_messages.cc",
     "swapped_out_messages.h",
     "task_scheduler.cc",
@@ -299,9 +292,8 @@ source_set("common") {
     "user_agent.cc",
     "view_message_enums.h",
     "view_messages.h",
-    "wrapper_shared_url_loader_factory.cc",
-    "wrapper_shared_url_loader_factory.h",
-    "zygote_commands_linux.h",
+    "visual_properties.cc",
+    "visual_properties.h",
   ]
 
   configs += [
@@ -326,7 +318,6 @@ source_set("common") {
     "//base",
     "//base/third_party/dynamic_annotations",
     "//build/util:webkit_version",
-    "//cc/ipc",
     "//components/discardable_memory/common",
     "//components/services/filesystem/public/interfaces",
     "//components/tracing",
@@ -334,9 +325,9 @@ source_set("common") {
     "//components/viz/service",
     "//content:resources",
     "//content/app/resources",
+    "//content/common/service_worker:service_worker_types_proto",
     "//content/public/common:interfaces",
     "//content/public/common:service_names",
-    "//content/public/common:zygote_buildflags",
     "//device/base/synchronization",
     "//device/bluetooth",
     "//gpu",
@@ -372,6 +363,7 @@ source_set("common") {
     "//services/service_manager/public/cpp",
     "//services/service_manager/public/mojom",
     "//services/service_manager/runner/common",
+    "//services/service_manager/zygote:zygote_buildflags",
     "//services/ui/public/interfaces",
     "//services/video_capture/public/mojom",
     "//services/viz/public/interfaces",
@@ -380,6 +372,8 @@ source_set("common") {
     "//third_party/angle:angle_gpu_info_util",
     "//third_party/boringssl",
     "//third_party/icu",
+    "//third_party/webrtc/rtc_base:rtc_base",
+    "//third_party/webrtc_overrides",
     "//ui/base",
     "//ui/base/ime",
     "//ui/display",
@@ -437,17 +431,6 @@ source_set("common") {
     deps += [ "//ppapi/proxy:ipc_sources" ]
   }
 
-  if (enable_webrtc) {
-    sources += [
-      "p2p_messages.h",
-      "p2p_socket_type.h",
-    ]
-    deps += [
-      "//third_party/webrtc/rtc_base:rtc_base",
-      "//third_party/webrtc_overrides",
-    ]
-  }
-
   if (use_ozone) {
     deps += [ "//ui/ozone" ]
   } else {
@@ -510,6 +493,8 @@ source_set("common") {
       "sandbox_policy_fuchsia.cc",
       "sandbox_policy_fuchsia.h",
     ]
+
+    deps += [ "//third_party/fuchsia-sdk:launchpad" ]
   }
 }
 
@@ -535,6 +520,8 @@ mojom("mojo_bindings") {
   # both a direct and an indirect dependency on the same target
   skip_deps_check = true
 
+  disable_variants = true
+
   sources = [
     "appcache.mojom",
     "associated_interfaces.mojom",
@@ -542,7 +529,6 @@ mojom("mojo_bindings") {
     "child_control.mojom",
     "child_memory_coordinator.mojom",
     "field_trial_recorder.mojom",
-    "file_utilities.mojom",
     "frame.mojom",
     "frame_sink_provider.mojom",
     "histogram_fetcher.mojom",
@@ -583,6 +569,7 @@ mojom("mojo_bindings") {
     "shared_worker/shared_worker_factory.mojom",
     "shared_worker/shared_worker_host.mojom",
     "shared_worker/shared_worker_info.mojom",
+    "speech_recognizer.mojom",
     "storage_partition_service.mojom",
     "url_loader_factory_bundle.mojom",
     "widget.mojom",
diff --git a/chromium/content/common/DEPS b/chromium/content/common/DEPS
index 17e3223f618..c6649bd23f8 100644
--- a/chromium/content/common/DEPS
+++ b/chromium/content/common/DEPS
@@ -23,7 +23,6 @@ include_rules = [
   "+third_party/blink/public/mojom",
   "+third_party/blink/public/platform/WebAddressSpace.h",
   "+third_party/blink/public/platform/web_content_security_policy.h",
-  "+third_party/blink/public/platform/web_display_mode.h",
   "+third_party/blink/public/platform/web_drag_operation.h",
   "+third_party/blink/public/platform/web_float_point.h",
   "+third_party/blink/public/platform/web_float_rect.h",
@@ -45,6 +44,7 @@ include_rules = [
   "+third_party/blink/public/platform/web_screen_info.h",
   "+third_party/blink/public/platform/web_scrollbar_buttons_placement.h",
   "+third_party/blink/public/platform/web_scroll_into_view_params.h",
+  "+third_party/blink/public/platform/web_scroll_types.h",
   "+third_party/blink/public/platform/web_storage_area.h",
   "+third_party/blink/public/platform/web_sudden_termination_disabler_type.h",
   "+third_party/blink/public/platform/web_touch_event.h",
@@ -64,9 +64,6 @@ include_rules = [
   "+third_party/blink/public/platform/modules/presentation/presentation.mojom.h",
   "+third_party/blink/public/platform/modules/push_messaging/web_push_error.h",
   "+third_party/blink/public/platform/modules/remoteplayback/web_remote_playback_availability.h",
-  "+third_party/blink/public/platform/modules/screen_orientation/web_lock_orientation_error.h",
-  "+third_party/blink/public/platform/modules/screen_orientation/web_screen_orientation_lock_type.h",
-  "+third_party/blink/public/platform/modules/screen_orientation/web_screen_orientation_type.h",
   "+third_party/blink/public/platform/modules/payments/WebPaymentAppRequest.h",
   "+third_party/blink/public/platform/modules/serviceworker/WebServiceWorkerClientType.h",
   "+third_party/blink/public/platform/modules/serviceworker/web_service_worker_error.h",
@@ -76,6 +73,7 @@ include_rules = [
   "+third_party/blink/public/web/web_find_options.h",
   "+third_party/blink/public/web/web_frame_owner_properties.h",
   "+third_party/blink/public/web/web_frame_serializer_cache_control_policy.h",
+  "+third_party/blink/public/web/web_fullscreen_options.h",
   "+third_party/blink/public/web/web_ime_text_span.h",
   "+third_party/blink/public/web/web_media_player_action.h",
   "+third_party/blink/public/web/web_plugin_action.h",
diff --git a/chromium/content/common/OWNERS b/chromium/content/common/OWNERS
index 5baee77702b..c3390635291 100644
--- a/chromium/content/common/OWNERS
+++ b/chromium/content/common/OWNERS
@@ -7,10 +7,14 @@ per-file sandbox_init_win.cc=set noparent
 per-file sandbox_init_win.cc=file://sandbox/win/OWNERS
 
 # Mac Sandbox.
-per-file sandbox_init_mac.*=rsesek@chromium.org
-per-file sandbox_mac*=rsesek@chromium.org
+per-file sandbox_init_mac.cc=set noparent
+per-file sandbox_init_mac.cc=file://sandbox/mac/OWNERS
+
+per-file sandbox_mac*=set noparent
+per-file sandbox_mac*=file://sandbox/mac/OWNERS
+
 per-file *.sb=set noparent
-per-file *.sb=rsesek@chromium.org
+per-file *.sb=file://sandbox/mac/OWNERS
 
 per-file pepper*=bauerb@chromium.org
 per-file plugin*=bauerb@chromium.org
diff --git a/chromium/content/common/associated_interface_provider_impl.h b/chromium/content/common/associated_interface_provider_impl.h
index 91d196c4c90..a46b6575ca5 100644
--- a/chromium/content/common/associated_interface_provider_impl.h
+++ b/chromium/content/common/associated_interface_provider_impl.h
@@ -11,6 +11,7 @@
 #include <memory>
 
 #include "base/macros.h"
+#include "base/single_thread_task_runner.h"
 #include "content/common/associated_interfaces.mojom.h"
 
 namespace content {
diff --git a/chromium/content/common/browser_plugin/browser_plugin_messages.h b/chromium/content/common/browser_plugin/browser_plugin_messages.h
index 87991910cd3..bef070d8e16 100644
--- a/chromium/content/common/browser_plugin/browser_plugin_messages.h
+++ b/chromium/content/common/browser_plugin/browser_plugin_messages.h
@@ -9,13 +9,13 @@
 
 #include "base/process/process.h"
 #include "base/unguessable_token.h"
-#include "cc/ipc/cc_param_traits.h"
+#include "cc/trees/render_frame_metadata.h"
 #include "components/viz/common/surfaces/surface_info.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/cursors/webcursor.h"
 #include "content/common/edit_command.h"
-#include "content/common/frame_resize_params.h"
+#include "content/common/frame_visual_properties.h"
 #include "content/public/common/drop_data.h"
 #include "content/public/common/screen_info.h"
 #include "ipc/ipc_channel_handle.h"
@@ -156,10 +156,10 @@ IPC_MESSAGE_CONTROL1(BrowserPluginHostMsg_UnlockMouse_ACK,
                      int /* browser_plugin_instance_id */)
 
 // Sent when plugin's position has changed.
-IPC_MESSAGE_CONTROL3(BrowserPluginHostMsg_UpdateResizeParams,
+IPC_MESSAGE_CONTROL3(BrowserPluginHostMsg_SynchronizeVisualProperties,
                      int /* browser_plugin_instance_id */,
                      viz::LocalSurfaceId /* local_surface_id */,
-                     content::FrameResizeParams /* resize_params */)
+                     content::FrameVisualProperties /* resize_params */)
 
 // -----------------------------------------------------------------------------
 // These messages are from the browser process to the embedder.
@@ -187,11 +187,10 @@ IPC_MESSAGE_CONTROL2(BrowserPluginMsg_AdvanceFocus,
                      int /* browser_plugin_instance_id */,
                      bool /* reverse */)
 
-// When a guest resizes due to auto-resize, this message informs the
-// BrowserPlugin to request a new viz::LocalSurfaceId.
-IPC_MESSAGE_CONTROL2(BrowserPluginMsg_ResizeDueToAutoResize,
+// Informs the BrowserPlugin that the guest's visual properties have changed.
+IPC_MESSAGE_CONTROL2(BrowserPluginMsg_DidUpdateVisualProperties,
                      int /* browser_plugin_instance_id */,
-                     uint64_t /* sequence_number */)
+                     cc::RenderFrameMetadata /* metadata */)
 
 // Requests a viz::LocalSurfaceId to enable auto-resize mode from the parent
 // renderer.
diff --git a/chromium/content/common/cache_storage/OWNERS b/chromium/content/common/cache_storage/OWNERS
index d55e59d60d9..5e0c72bf2bb 100644
--- a/chromium/content/common/cache_storage/OWNERS
+++ b/chromium/content/common/cache_storage/OWNERS
@@ -1,4 +1,3 @@
-michaeln@chromium.org
 nhiroki@chromium.org
 jkarlin@chromium.org
 jsbell@chromium.org
diff --git a/chromium/content/common/cache_storage/cache_storage.typemap b/chromium/content/common/cache_storage/cache_storage.typemap
deleted file mode 100644
index b04b8896324..00000000000
--- a/chromium/content/common/cache_storage/cache_storage.typemap
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2018 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-mojom = "//third_party/blink/public/platform/modules/cache_storage/cache_storage.mojom"
-public_headers = [
-  "//content/common/cache_storage/cache_storage_types.h",
-  "//content/common/service_worker/service_worker_types.h",
-]
-traits_headers =
-    [ "//content/common/cache_storage/cache_storage_mojom_traits.h" ]
-sources = [
-  "//content/common/cache_storage/cache_storage_mojom_traits.cc",
-]
-type_mappings = [
-  "blink.mojom.BatchOperation=content::CacheStorageBatchOperation",
-  "blink.mojom.OperationType=content::CacheStorageCacheOperationType",
-  "blink.mojom.QueryParams=content::CacheStorageCacheQueryParams",
-]
diff --git a/chromium/content/common/cache_storage/cache_storage_mojom_traits.cc b/chromium/content/common/cache_storage/cache_storage_mojom_traits.cc
deleted file mode 100644
index 0face783f87..00000000000
--- a/chromium/content/common/cache_storage/cache_storage_mojom_traits.cc
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/cache_storage/cache_storage_mojom_traits.h"
-#include "base/logging.h"
-#include "content/public/common/referrer_struct_traits.h"
-
-namespace mojo {
-
-using blink::mojom::CacheStorageError;
-using blink::mojom::OperationType;
-
-OperationType
-EnumTraits<OperationType, content::CacheStorageCacheOperationType>::ToMojom(
-    content::CacheStorageCacheOperationType input) {
-  switch (input) {
-    case content::CACHE_STORAGE_CACHE_OPERATION_TYPE_UNDEFINED:
-      return OperationType::kUndefined;
-    case content::CACHE_STORAGE_CACHE_OPERATION_TYPE_PUT:
-      return OperationType::kPut;
-    case content::CACHE_STORAGE_CACHE_OPERATION_TYPE_DELETE:
-      return OperationType::kDelete;
-  }
-  NOTREACHED();
-  return OperationType::kUndefined;
-}
-
-bool EnumTraits<OperationType, content::CacheStorageCacheOperationType>::
-    FromMojom(OperationType input,
-              content::CacheStorageCacheOperationType* out) {
-  switch (input) {
-    case OperationType::kUndefined:
-      *out = content::CACHE_STORAGE_CACHE_OPERATION_TYPE_UNDEFINED;
-      return true;
-    case OperationType::kPut:
-      *out = content::CACHE_STORAGE_CACHE_OPERATION_TYPE_PUT;
-      return true;
-    case OperationType::kDelete:
-      *out = content::CACHE_STORAGE_CACHE_OPERATION_TYPE_DELETE;
-      return true;
-  }
-  return false;
-}
-
-bool StructTraits<blink::mojom::QueryParamsDataView,
-                  content::CacheStorageCacheQueryParams>::
-    Read(blink::mojom::QueryParamsDataView data,
-         content::CacheStorageCacheQueryParams* out) {
-  base::Optional<base::string16> cache_name;
-  if (!data.ReadCacheName(&cache_name))
-    return false;
-  out->cache_name = base::NullableString16(std::move(cache_name));
-  out->ignore_search = data.ignore_search();
-  out->ignore_method = data.ignore_method();
-  out->ignore_vary = data.ignore_vary();
-  return true;
-}
-
-bool StructTraits<blink::mojom::BatchOperationDataView,
-                  content::CacheStorageBatchOperation>::
-    Read(blink::mojom::BatchOperationDataView data,
-         content::CacheStorageBatchOperation* out) {
-  if (!data.ReadRequest(&out->request))
-    return false;
-  if (!data.ReadResponse(&out->response))
-    return false;
-  if (!data.ReadMatchParams(&out->match_params))
-    return false;
-  if (!data.ReadOperationType(&out->operation_type))
-    return false;
-  return true;
-}
-
-}  // namespace mojo
diff --git a/chromium/content/common/cache_storage/cache_storage_types.cc b/chromium/content/common/cache_storage/cache_storage_types.cc
deleted file mode 100644
index 198e6eaf300..00000000000
--- a/chromium/content/common/cache_storage/cache_storage_types.cc
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/cache_storage/cache_storage_types.h"
-
-namespace content {
-
-CacheStorageCacheQueryParams::CacheStorageCacheQueryParams()
-    : ignore_search(false), ignore_method(false), ignore_vary(false) {
-}
-
-CacheStorageBatchOperation::CacheStorageBatchOperation() {
-}
-
-CacheStorageBatchOperation::CacheStorageBatchOperation(
-    const CacheStorageBatchOperation& other) = default;
-
-}  // namespace content
diff --git a/chromium/content/common/cache_storage/cache_storage_types.h b/chromium/content/common/cache_storage/cache_storage_types.h
deleted file mode 100644
index 61d8b769170..00000000000
--- a/chromium/content/common/cache_storage/cache_storage_types.h
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_CACHE_STORAGE_CACHE_STORAGE_TYPES_H_
-#define CONTENT_COMMON_CACHE_STORAGE_CACHE_STORAGE_TYPES_H_
-
-#include <map>
-#include <string>
-
-#include "base/strings/nullable_string16.h"
-#include "content/common/content_export.h"
-#include "content/common/service_worker/service_worker_types.h"
-
-// This file is to have common definitions that are to be shared by
-// browser and child process.
-
-namespace content {
-
-// Controls how requests are matched in the Cache API.
-struct CONTENT_EXPORT CacheStorageCacheQueryParams {
-  CacheStorageCacheQueryParams();
-
-  bool ignore_search = false;
-  bool ignore_method = false;
-  bool ignore_vary = false;
-  base::NullableString16 cache_name;
-};
-
-// The type of a single batch operation in the Cache API.
-enum CacheStorageCacheOperationType {
-  CACHE_STORAGE_CACHE_OPERATION_TYPE_UNDEFINED,
-  CACHE_STORAGE_CACHE_OPERATION_TYPE_PUT,
-  CACHE_STORAGE_CACHE_OPERATION_TYPE_DELETE,
-  CACHE_STORAGE_CACHE_OPERATION_TYPE_LAST =
-      CACHE_STORAGE_CACHE_OPERATION_TYPE_DELETE
-};
-
-// A single batch operation for the Cache API.
-struct CONTENT_EXPORT CacheStorageBatchOperation {
-  CacheStorageBatchOperation();
-  CacheStorageBatchOperation(const CacheStorageBatchOperation& other);
-
-  CacheStorageCacheOperationType operation_type;
-  ServiceWorkerFetchRequest request;
-  ServiceWorkerResponse response;
-  CacheStorageCacheQueryParams match_params;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_CACHE_STORAGE_CACHE_STORAGE_TYPES_H_
diff --git a/chromium/content/common/child_process_host_impl.cc b/chromium/content/common/child_process_host_impl.cc
index d2b99832168..bc78aba80ac 100644
--- a/chromium/content/common/child_process_host_impl.cc
+++ b/chromium/content/common/child_process_host_impl.cc
@@ -11,7 +11,6 @@
 #include "base/files/file_path.h"
 #include "base/hash.h"
 #include "base/logging.h"
-#include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/numerics/safe_math.h"
 #include "base/path_service.h"
@@ -68,7 +67,7 @@ base::FilePath ChildProcessHost::GetChildPath(int flags) {
   // On most platforms, the child executable is the same as the current
   // executable.
   if (child_path.empty())
-    PathService::Get(CHILD_PROCESS_EXE, &child_path);
+    base::PathService::Get(CHILD_PROCESS_EXE, &child_path);
   return child_path;
 }
 
diff --git a/chromium/content/common/child_process_host_impl.h b/chromium/content/common/child_process_host_impl.h
index 659cffaf25d..99644ea03dd 100644
--- a/chromium/content/common/child_process_host_impl.h
+++ b/chromium/content/common/child_process_host_impl.h
@@ -71,6 +71,8 @@ class CONTENT_EXPORT ChildProcessHostImpl : public ChildProcessHost,
   void BindInterface(const std::string& interface_name,
                      mojo::ScopedMessagePipeHandle interface_pipe) override;
 
+  base::Process& peer_process() { return peer_process_; }
+
  private:
   friend class ChildProcessHost;
 
diff --git a/chromium/content/common/common_param_traits_unittest.cc b/chromium/content/common/common_param_traits_unittest.cc
index 71b30f65c4d..4d4ee04d13b 100644
--- a/chromium/content/common/common_param_traits_unittest.cc
+++ b/chromium/content/common/common_param_traits_unittest.cc
@@ -12,6 +12,7 @@
 
 #include "base/macros.h"
 #include "base/values.h"
+#include "components/viz/common/surfaces/surface_info.h"
 #include "content/common/resource_messages.h"
 #include "content/public/common/content_constants.h"
 #include "ipc/ipc_message.h"
@@ -285,3 +286,24 @@ TEST(IPCMessageTest, RenderWidgetSurfaceProperties) {
             output.has_transparent_background);
 #endif
 }
+
+static constexpr viz::FrameSinkId kArbitraryFrameSinkId(1, 1);
+
+TEST(IPCMessageTest, SurfaceInfo) {
+  IPC::Message msg(1, 2, IPC::Message::PRIORITY_NORMAL);
+  const viz::SurfaceId kArbitrarySurfaceId(
+      kArbitraryFrameSinkId,
+      viz::LocalSurfaceId(3, base::UnguessableToken::Create()));
+  constexpr float kArbitraryDeviceScaleFactor = 0.9f;
+  const gfx::Size kArbitrarySize(65, 321);
+  const viz::SurfaceInfo surface_info_in(
+      kArbitrarySurfaceId, kArbitraryDeviceScaleFactor, kArbitrarySize);
+  IPC::ParamTraits<viz::SurfaceInfo>::Write(&msg, surface_info_in);
+
+  viz::SurfaceInfo surface_info_out;
+  base::PickleIterator iter(msg);
+  EXPECT_TRUE(
+      IPC::ParamTraits<viz::SurfaceInfo>::Read(&msg, &iter, &surface_info_out));
+
+  ASSERT_EQ(surface_info_in, surface_info_out);
+}
diff --git a/chromium/content/common/common_sandbox_support_linux.cc b/chromium/content/common/common_sandbox_support_linux.cc
index ed806b7f998..c80e44a6d2b 100644
--- a/chromium/content/common/common_sandbox_support_linux.cc
+++ b/chromium/content/common/common_sandbox_support_linux.cc
@@ -4,21 +4,14 @@
 
 #include "content/public/common/common_sandbox_support_linux.h"
 
-#include <stddef.h>
 #include <sys/stat.h>
 
 #include <limits>
 #include <memory>
 
 #include "base/numerics/safe_conversions.h"
-#include "base/pickle.h"
 #include "base/posix/eintr_wrapper.h"
-#include "base/posix/global_descriptors.h"
-#include "base/posix/unix_domain_socket.h"
 #include "base/sys_byteorder.h"
-#include "base/trace_event/trace_event.h"
-#include "content/public/common/content_descriptors.h"
-#include "services/service_manager/sandbox/linux/sandbox_linux.h"
 
 namespace content {
 
@@ -97,23 +90,4 @@ bool GetFontTable(int fd,
   return true;
 }
 
-int MakeSharedMemorySegmentViaIPC(size_t length, bool executable) {
-  base::Pickle request;
-  request.WriteInt(
-      service_manager::SandboxLinux::METHOD_MAKE_SHARED_MEMORY_SEGMENT);
-  request.WriteUInt32(length);
-  request.WriteBool(executable);
-  uint8_t reply_buf[10];
-  int result_fd;
-  ssize_t result = base::UnixDomainSocket::SendRecvMsg(
-      GetSandboxFD(), reply_buf, sizeof(reply_buf), &result_fd, request);
-  if (result == -1)
-    return -1;
-  return result_fd;
-}
-
-int GetSandboxFD() {
-  return kSandboxIPCChannel + base::GlobalDescriptors::kBaseDescriptor;
-}
-
-}  // namespace content
+}  // namespace content
+\ No newline at end of file
diff --git a/chromium/content/common/content_message_generator.h b/chromium/content/common/content_message_generator.h
index ab5609447eb..84e0f51ad8d 100644
--- a/chromium/content/common/content_message_generator.h
+++ b/chromium/content/common/content_message_generator.h
@@ -52,11 +52,6 @@
 #ifndef CONTENT_COMMON_MEDIA_AEC_DUMP_MESSAGES_H_
 #error "Failed to include content/common/media/aec_dump_messages.h"
 #endif
-#undef CONTENT_COMMON_MEDIA_AUDIO_MESSAGES_H_
-#include "content/common/media/audio_messages.h"
-#ifndef CONTENT_COMMON_MEDIA_AUDIO_MESSAGES_H_
-#error "Failed to include content/common/media/audio_messages.h"
-#endif
 #undef CONTENT_COMMON_MEDIA_MEDIA_PLAYER_DELEGATE_MESSAGES_H_
 #include "content/common/media/media_player_delegate_messages.h"
 #ifndef CONTENT_COMMON_MEDIA_MEDIA_PLAYER_DELEGATE_MESSAGES_H_
@@ -94,11 +89,6 @@
 #error \
     "Failed to include content/common/service_worker/service_worker_messages.h"
 #endif
-#undef CONTENT_COMMON_SPEECH_RECOGNITION_MESSAGES_H_
-#include "content/common/speech_recognition_messages.h"
-#ifndef CONTENT_COMMON_SPEECH_RECOGNITION_MESSAGES_H_
-#error "Failed to include content/common/speech_recognition_messages.h"
-#endif
 #undef CONTENT_COMMON_TEXT_INPUT_CLIENT_MESSAGES_H_
 #include "content/common/text_input_client_messages.h"
 #ifndef CONTENT_COMMON_TEXT_INPUT_CLIENT_MESSAGES_H_
@@ -117,13 +107,11 @@
 #error "Failed to include content/common/input/sync_compositor_messages.h"
 #endif
 
-#if BUILDFLAG(ENABLE_WEBRTC)
 #undef CONTENT_COMMON_P2P_MESSAGES_H_
 #include "content/common/p2p_messages.h"
 #ifndef CONTENT_COMMON_P2P_MESSAGES_H_
 #error "Failed to include content/common/p2p_messages.h"
 #endif
-#endif
 
 #if defined(OS_ANDROID)
 #undef CONTENT_COMMON_GIN_JAVA_BRIDGE_MESSAGES_H_
diff --git a/chromium/content/common/content_param_traits.cc b/chromium/content/common/content_param_traits.cc
index be32e05f410..310cd7f7c6f 100644
--- a/chromium/content/common/content_param_traits.cc
+++ b/chromium/content/common/content_param_traits.cc
@@ -7,6 +7,11 @@
 #include <stddef.h>
 
 #include "base/strings/string_number_conversions.h"
+#include "base/unguessable_token.h"
+#include "components/viz/common/surfaces/frame_sink_id.h"
+#include "components/viz/common/surfaces/local_surface_id.h"
+#include "components/viz/common/surfaces/surface_id.h"
+#include "components/viz/common/surfaces/surface_info.h"
 #include "content/common/frame_message_structs.h"
 #include "ipc/ipc_mojo_message_helper.h"
 #include "ipc/ipc_mojo_param_traits.h"
@@ -17,6 +22,7 @@
 #include "ui/accessibility/ax_modes.h"
 #include "ui/base/ui_base_features.h"
 #include "ui/events/blink/web_input_event_traits.h"
+// #include "ui/gfx/ipc/geometry/gfx_param_traits.h"
 
 namespace IPC {
 
@@ -61,7 +67,7 @@ void ParamTraits<WebInputEventPointer>::Log(const param_type& p,
   l->append(", ");
   LogParam(p->GetType(), l);
   l->append(", ");
-  LogParam(p->TimeStampSeconds(), l);
+  LogParam(p->TimeStamp(), l);
   l->append(")");
 }
 
@@ -240,6 +246,139 @@ void ParamTraits<scoped_refptr<
   l->append("<blink::TransferableMessage>");
 }
 
+void ParamTraits<viz::FrameSinkId>::Write(base::Pickle* m,
+                                          const param_type& p) {
+  DCHECK(p.is_valid());
+  WriteParam(m, p.client_id());
+  WriteParam(m, p.sink_id());
+}
+
+bool ParamTraits<viz::FrameSinkId>::Read(const base::Pickle* m,
+                                         base::PickleIterator* iter,
+                                         param_type* p) {
+  uint32_t client_id;
+  if (!ReadParam(m, iter, &client_id))
+    return false;
+
+  uint32_t sink_id;
+  if (!ReadParam(m, iter, &sink_id))
+    return false;
+
+  *p = viz::FrameSinkId(client_id, sink_id);
+  return p->is_valid();
+}
+
+void ParamTraits<viz::FrameSinkId>::Log(const param_type& p, std::string* l) {
+  l->append("viz::FrameSinkId(");
+  LogParam(p.client_id(), l);
+  l->append(", ");
+  LogParam(p.sink_id(), l);
+  l->append(")");
+}
+
+void ParamTraits<viz::LocalSurfaceId>::Write(base::Pickle* m,
+                                             const param_type& p) {
+  DCHECK(p.is_valid());
+  WriteParam(m, p.parent_sequence_number());
+  WriteParam(m, p.child_sequence_number());
+  WriteParam(m, p.embed_token());
+}
+
+bool ParamTraits<viz::LocalSurfaceId>::Read(const base::Pickle* m,
+                                            base::PickleIterator* iter,
+                                            param_type* p) {
+  uint32_t parent_sequence_number;
+  if (!ReadParam(m, iter, &parent_sequence_number))
+    return false;
+
+  uint32_t child_sequence_number;
+  if (!ReadParam(m, iter, &child_sequence_number))
+    return false;
+
+  base::UnguessableToken embed_token;
+  if (!ReadParam(m, iter, &embed_token))
+    return false;
+
+  *p = viz::LocalSurfaceId(parent_sequence_number, child_sequence_number,
+                           embed_token);
+  return p->is_valid();
+}
+
+void ParamTraits<viz::LocalSurfaceId>::Log(const param_type& p,
+                                           std::string* l) {
+  l->append("viz::LocalSurfaceId(");
+  LogParam(p.parent_sequence_number(), l);
+  l->append(", ");
+  LogParam(p.child_sequence_number(), l);
+  l->append(", ");
+  LogParam(p.embed_token(), l);
+  l->append(")");
+}
+
+void ParamTraits<viz::SurfaceId>::Write(base::Pickle* m, const param_type& p) {
+  WriteParam(m, p.frame_sink_id());
+  WriteParam(m, p.local_surface_id());
+}
+
+bool ParamTraits<viz::SurfaceId>::Read(const base::Pickle* m,
+                                       base::PickleIterator* iter,
+                                       param_type* p) {
+  viz::FrameSinkId frame_sink_id;
+  if (!ReadParam(m, iter, &frame_sink_id))
+    return false;
+
+  viz::LocalSurfaceId local_surface_id;
+  if (!ReadParam(m, iter, &local_surface_id))
+    return false;
+
+  *p = viz::SurfaceId(frame_sink_id, local_surface_id);
+  return true;
+}
+
+void ParamTraits<viz::SurfaceId>::Log(const param_type& p, std::string* l) {
+  l->append("viz::SurfaceId(");
+  LogParam(p.frame_sink_id(), l);
+  l->append(", ");
+  LogParam(p.local_surface_id(), l);
+  l->append(")");
+}
+
+void ParamTraits<viz::SurfaceInfo>::Write(base::Pickle* m,
+                                          const param_type& p) {
+  WriteParam(m, p.id());
+  WriteParam(m, p.device_scale_factor());
+  WriteParam(m, p.size_in_pixels());
+}
+
+bool ParamTraits<viz::SurfaceInfo>::Read(const base::Pickle* m,
+                                         base::PickleIterator* iter,
+                                         param_type* p) {
+  viz::SurfaceId surface_id;
+  if (!ReadParam(m, iter, &surface_id))
+    return false;
+
+  float device_scale_factor;
+  if (!ReadParam(m, iter, &device_scale_factor))
+    return false;
+
+  gfx::Size size_in_pixels;
+  if (!ReadParam(m, iter, &size_in_pixels))
+    return false;
+
+  *p = viz::SurfaceInfo(surface_id, device_scale_factor, size_in_pixels);
+  return p->is_valid();
+}
+
+void ParamTraits<viz::SurfaceInfo>::Log(const param_type& p, std::string* l) {
+  l->append("viz::SurfaceInfo(");
+  LogParam(p.id(), l);
+  l->append(", ");
+  LogParam(p.device_scale_factor(), l);
+  l->append(", ");
+  LogParam(p.size_in_pixels(), l);
+  l->append(")");
+}
+
 }  // namespace IPC
 
 // Generate param traits write methods.
diff --git a/chromium/content/common/content_param_traits.h b/chromium/content/common/content_param_traits.h
index ffe7fc9edc1..e9a29ff4075 100644
--- a/chromium/content/common/content_param_traits.h
+++ b/chromium/content/common/content_param_traits.h
@@ -30,6 +30,13 @@ namespace content {
 struct FrameMsg_ViewChanged_Params;
 }
 
+namespace viz {
+class FrameSinkId;
+class LocalSurfaceId;
+class SurfaceId;
+class SurfaceInfo;
+}  // namespace viz
+
 namespace IPC {
 
 template <>
@@ -109,6 +116,46 @@ struct CONTENT_EXPORT ParamTraits<content::FrameMsg_ViewChanged_Params> {
   static void Log(const param_type& p, std::string* l);
 };
 
+template <>
+struct CONTENT_EXPORT ParamTraits<viz::FrameSinkId> {
+  typedef viz::FrameSinkId param_type;
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
+template <>
+struct CONTENT_EXPORT ParamTraits<viz::LocalSurfaceId> {
+  typedef viz::LocalSurfaceId param_type;
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
+template <>
+struct CONTENT_EXPORT ParamTraits<viz::SurfaceId> {
+  typedef viz::SurfaceId param_type;
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
+template <>
+struct CONTENT_EXPORT ParamTraits<viz::SurfaceInfo> {
+  typedef viz::SurfaceInfo param_type;
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
 }  // namespace IPC
 
 #endif  // CONTENT_COMMON_CONTENT_PARAM_TRAITS_H_
diff --git a/chromium/content/common/content_param_traits_macros.h b/chromium/content/common/content_param_traits_macros.h
index 9dd58cf6618..65199c2f005 100644
--- a/chromium/content/common/content_param_traits_macros.h
+++ b/chromium/content/common/content_param_traits_macros.h
@@ -8,8 +8,8 @@
 #ifndef CONTENT_COMMON_CONTENT_PARAM_TRAITS_MACROS_H_
 #define CONTENT_COMMON_CONTENT_PARAM_TRAITS_MACROS_H_
 
-#include "cc/ipc/cc_param_traits.h"
 #include "content/common/content_export.h"
+#include "content/common/content_param_traits.h"
 #include "content/common/download/mhtml_save_status.h"
 #include "content/common/render_widget_surface_properties.h"
 #include "content/public/common/input_event_ack_state.h"
@@ -22,6 +22,7 @@
 #include "third_party/blink/public/web/web_ime_text_span.h"
 #include "ui/gfx/gpu_memory_buffer.h"
 #include "ui/gfx/ipc/geometry/gfx_param_traits.h"
+#include "ui/gfx/ipc/gfx_param_traits.h"
 
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
@@ -48,6 +49,11 @@ IPC_ENUM_TRAITS_MAX_VALUE(blink::WebImeTextSpan::Type,
 IPC_ENUM_TRAITS_MAX_VALUE(ui::mojom::ImeTextSpanThickness,
                           ui::mojom::ImeTextSpanThickness::kThick)
 
+IPC_STRUCT_TRAITS_BEGIN(viz::Selection<gfx::SelectionBound>)
+  IPC_STRUCT_TRAITS_MEMBER(start)
+  IPC_STRUCT_TRAITS_MEMBER(end)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(blink::WebImeTextSpan)
   IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(start_offset)
diff --git a/chromium/content/common/content_paths.cc b/chromium/content/common/content_paths.cc
index 60ba02e3a6d..ac594ed5f3c 100644
--- a/chromium/content/common/content_paths.cc
+++ b/chromium/content/common/content_paths.cc
@@ -17,10 +17,10 @@ namespace content {
 bool PathProvider(int key, base::FilePath* result) {
   switch (key) {
     case CHILD_PROCESS_EXE:
-      return PathService::Get(base::FILE_EXE, result);
+      return base::PathService::Get(base::FILE_EXE, result);
     case DIR_TEST_DATA: {
       base::FilePath cur;
-      if (!PathService::Get(base::DIR_SOURCE_ROOT, &cur))
+      if (!base::PathService::Get(base::DIR_SOURCE_ROOT, &cur))
         return false;
       cur = cur.Append(FILE_PATH_LITERAL("content"));
       cur = cur.Append(FILE_PATH_LITERAL("test"));
@@ -37,7 +37,7 @@ bool PathProvider(int key, base::FilePath* result) {
       *result = result->Append("Libraries");
       return true;
 #else
-      return PathService::Get(base::DIR_MODULE, result);
+      return base::PathService::Get(base::DIR_MODULE, result);
 #endif
     }
     default:
@@ -48,7 +48,7 @@ bool PathProvider(int key, base::FilePath* result) {
 // This cannot be done as a static initializer sadly since Visual Studio will
 // eliminate this object file if there is no direct entry point into it.
 void RegisterPathProvider() {
-  PathService::RegisterProvider(PathProvider, PATH_START, PATH_END);
+  base::PathService::RegisterProvider(PathProvider, PATH_START, PATH_END);
 }
 
 }  // namespace content
diff --git a/chromium/content/common/content_security_policy/content_security_policy.cc b/chromium/content/common/content_security_policy/content_security_policy.cc
index c0b29bb9466..0a5565c573c 100644
--- a/chromium/content/common/content_security_policy/content_security_policy.cc
+++ b/chromium/content/common/content_security_policy/content_security_policy.cc
@@ -16,6 +16,7 @@ static CSPDirective::Name CSPFallback(CSPDirective::Name directive) {
     case CSPDirective::DefaultSrc:
     case CSPDirective::FormAction:
     case CSPDirective::UpgradeInsecureRequests:
+    case CSPDirective::NavigateTo:
       return CSPDirective::Unknown;
 
     case CSPDirective::FrameSrc:
@@ -32,6 +33,19 @@ static CSPDirective::Name CSPFallback(CSPDirective::Name directive) {
   return CSPDirective::Unknown;
 }
 
+// Looks by name for a directive in a list of directives.
+// If it is not found, returns nullptr.
+static const CSPDirective* FindDirective(
+    const CSPDirective::Name name,
+    const std::vector<CSPDirective>& directives) {
+  for (const CSPDirective& directive : directives) {
+    if (directive.name == name) {
+      return &directive;
+    }
+  }
+  return nullptr;
+}
+
 std::string ElideURLForReportViolation(const GURL& url) {
   // TODO(arthursonzogni): the url length should be limited to 1024 char. Find
   // a function that will not break the utf8 encoding while eliding the string.
@@ -69,6 +83,8 @@ void ReportViolation(CSPContext* context,
     message << "Refused to send form data to '";
   else if (directive_name == CSPDirective::FrameSrc)
     message << "Refused to frame '";
+  else if (directive_name == CSPDirective::NavigateTo)
+    message << "Refused to navigate to '";
 
   message << ElideURLForReportViolation(safe_url)
           << "' because it violates the following Content Security Policy "
@@ -97,9 +113,12 @@ bool AllowDirective(CSPContext* context,
                     CSPDirective::Name directive_name,
                     const GURL& url,
                     bool is_redirect,
+                    bool is_response_check,
                     const SourceLocation& source_location) {
-  if (CSPSourceList::Allow(directive.source_list, url, context, is_redirect))
+  if (CSPSourceList::Allow(directive.source_list, url, context, is_redirect,
+                           is_response_check)) {
     return true;
+  }
 
   ReportViolation(context, policy, directive, directive_name, url, is_redirect,
                   source_location);
@@ -146,20 +165,30 @@ bool ContentSecurityPolicy::Allow(const ContentSecurityPolicy& policy,
                                   CSPDirective::Name directive_name,
                                   const GURL& url,
                                   bool is_redirect,
+                                  bool is_response_check,
                                   CSPContext* context,
-                                  const SourceLocation& source_location) {
-  if (ShouldBypassContentSecurityPolicy(context, url)) return true;
+                                  const SourceLocation& source_location,
+                                  bool is_form_submission) {
+  if (ShouldBypassContentSecurityPolicy(context, url))
+    return true;
+
+  // 'navigate-to' has no effect when doing a form submission and a
+  // 'form-action' directive is present.
+  if (is_form_submission && directive_name == CSPDirective::Name::NavigateTo &&
+      FindDirective(CSPDirective::Name::FormAction, policy.directives)) {
+    return true;
+  }
 
   CSPDirective::Name current_directive_name = directive_name;
   do {
-    for (const CSPDirective& directive : policy.directives) {
-      if (directive.name == current_directive_name) {
-        bool allowed =
-            AllowDirective(context, policy, directive, directive_name, url,
-                           is_redirect, source_location);
-        return allowed ||
-               policy.header.type == blink::kWebContentSecurityPolicyTypeReport;
-      }
+    const CSPDirective* current_directive =
+        FindDirective(current_directive_name, policy.directives);
+    if (current_directive) {
+      bool allowed =
+          AllowDirective(context, policy, *current_directive, directive_name,
+                         url, is_redirect, is_response_check, source_location);
+      return allowed ||
+             policy.header.type == blink::kWebContentSecurityPolicyTypeReport;
     }
     current_directive_name = CSPFallback(current_directive_name);
   } while (current_directive_name != CSPDirective::Unknown);
diff --git a/chromium/content/common/content_security_policy/content_security_policy.h b/chromium/content/common/content_security_policy/content_security_policy.h
index 7366f00e2ce..abac1dead71 100644
--- a/chromium/content/common/content_security_policy/content_security_policy.h
+++ b/chromium/content/common/content_security_policy/content_security_policy.h
@@ -45,8 +45,10 @@ struct CONTENT_EXPORT ContentSecurityPolicy {
                     CSPDirective::Name directive,
                     const GURL& url,
                     bool is_redirect,
+                    bool is_response_check,
                     CSPContext* context,
-                    const SourceLocation& source_location);
+                    const SourceLocation& source_location,
+                    bool is_form_submission);
 
   // Returns true if |policy| specifies that an insecure HTTP request should be
   // upgraded to HTTPS.
diff --git a/chromium/content/common/content_security_policy/content_security_policy_unittest.cc b/chromium/content/common/content_security_policy/content_security_policy_unittest.cc
index a8596b39fac..a7e57115ffc 100644
--- a/chromium/content/common/content_security_policy/content_security_policy_unittest.cc
+++ b/chromium/content/common/content_security_policy/content_security_policy_unittest.cc
@@ -50,9 +50,9 @@ TEST(ContentSecurityPolicy, NoDirective) {
   ContentSecurityPolicy policy(EmptyCspHeader(), std::vector<CSPDirective>(),
                                report_end_points, false);
 
-  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FormAction,
-                                           GURL("http://www.example.com"),
-                                           false, &context, SourceLocation()));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FormAction, GURL("http://www.example.com"), false,
+      false, &context, SourceLocation(), true));
   ASSERT_EQ(0u, context.violations().size());
 }
 
@@ -62,15 +62,15 @@ TEST(ContentSecurityPolicy, ReportViolation) {
   // source = "www.example.com"
   CSPSource source("", "www.example.com", false, url::PORT_UNSPECIFIED, false,
                    "");
-  CSPSourceList source_list(false, false, {source});
+  CSPSourceList source_list(false, false, false, {source});
   CSPDirective directive(CSPDirective::FormAction, source_list);
   std::vector<std::string> report_end_points;  // empty
   ContentSecurityPolicy policy(EmptyCspHeader(), {directive}, report_end_points,
                                false);
 
-  EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FormAction,
-                                            GURL("http://www.not-example.com"),
-                                            false, &context, SourceLocation()));
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FormAction, GURL("http://www.not-example.com"),
+      false, false, &context, SourceLocation(), true));
 
   ASSERT_EQ(1u, context.violations().size());
   const char console_message[] =
@@ -83,8 +83,8 @@ TEST(ContentSecurityPolicy, ReportViolation) {
 TEST(ContentSecurityPolicy, DirectiveFallback) {
   CSPSource source_a("http", "a.com", false, url::PORT_UNSPECIFIED, false, "");
   CSPSource source_b("http", "b.com", false, url::PORT_UNSPECIFIED, false, "");
-  CSPSourceList source_list_a(false, false, {source_a});
-  CSPSourceList source_list_b(false, false, {source_b});
+  CSPSourceList source_list_a(false, false, false, {source_a});
+  CSPSourceList source_list_b(false, false, false, {source_b});
 
   std::vector<std::string> report_end_points;  // Empty.
 
@@ -94,9 +94,9 @@ TEST(ContentSecurityPolicy, DirectiveFallback) {
         EmptyCspHeader(),
         {CSPDirective(CSPDirective::DefaultSrc, source_list_a)},
         report_end_points, false);
-    EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                              GURL("http://b.com"), false,
-                                              &context, SourceLocation()));
+    EXPECT_FALSE(ContentSecurityPolicy::Allow(
+        policy, CSPDirective::FrameSrc, GURL("http://b.com"), false, false,
+        &context, SourceLocation(), false));
     ASSERT_EQ(1u, context.violations().size());
     const char console_message[] =
         "Refused to frame 'http://b.com/' because it violates "
@@ -104,18 +104,18 @@ TEST(ContentSecurityPolicy, DirectiveFallback) {
         "http://a.com\". Note that 'frame-src' was not explicitly "
         "set, so 'default-src' is used as a fallback.\n";
     EXPECT_EQ(console_message, context.violations()[0].console_message);
-    EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                             GURL("http://a.com"), false,
-                                             &context, SourceLocation()));
+    EXPECT_TRUE(ContentSecurityPolicy::Allow(
+        policy, CSPDirective::FrameSrc, GURL("http://a.com"), false, false,
+        &context, SourceLocation(), false));
   }
   {
     CSPContextTest context;
     ContentSecurityPolicy policy(
         EmptyCspHeader(), {CSPDirective(CSPDirective::ChildSrc, source_list_a)},
         report_end_points, false);
-    EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                              GURL("http://b.com"), false,
-                                              &context, SourceLocation()));
+    EXPECT_FALSE(ContentSecurityPolicy::Allow(
+        policy, CSPDirective::FrameSrc, GURL("http://b.com"), false, false,
+        &context, SourceLocation(), false));
     ASSERT_EQ(1u, context.violations().size());
     const char console_message[] =
         "Refused to frame 'http://b.com/' because it violates "
@@ -123,24 +123,24 @@ TEST(ContentSecurityPolicy, DirectiveFallback) {
         "http://a.com\". Note that 'frame-src' was not explicitly "
         "set, so 'child-src' is used as a fallback.\n";
     EXPECT_EQ(console_message, context.violations()[0].console_message);
-    EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                             GURL("http://a.com"), false,
-                                             &context, SourceLocation()));
+    EXPECT_TRUE(ContentSecurityPolicy::Allow(
+        policy, CSPDirective::FrameSrc, GURL("http://a.com"), false, false,
+        &context, SourceLocation(), false));
   }
   {
     CSPContextTest context;
-    CSPSourceList source_list(false, false, {source_a, source_b});
+    CSPSourceList source_list(false, false, false, {source_a, source_b});
     ContentSecurityPolicy policy(
         EmptyCspHeader(),
         {CSPDirective(CSPDirective::FrameSrc, {source_list_a}),
          CSPDirective(CSPDirective::ChildSrc, {source_list_b})},
         report_end_points, false);
-    EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                             GURL("http://a.com"), false,
-                                             &context, SourceLocation()));
-    EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                              GURL("http://b.com"), false,
-                                              &context, SourceLocation()));
+    EXPECT_TRUE(ContentSecurityPolicy::Allow(
+        policy, CSPDirective::FrameSrc, GURL("http://a.com"), false, false,
+        &context, SourceLocation(), false));
+    EXPECT_FALSE(ContentSecurityPolicy::Allow(
+        policy, CSPDirective::FrameSrc, GURL("http://b.com"), false, false,
+        &context, SourceLocation(), false));
     ASSERT_EQ(1u, context.violations().size());
     const char console_message[] =
         "Refused to frame 'http://b.com/' because it violates "
@@ -155,27 +155,27 @@ TEST(ContentSecurityPolicy, RequestsAllowedWhenBypassingCSP) {
   std::vector<std::string> report_end_points;  // empty
   CSPSource source("https", "example.com", false, url::PORT_UNSPECIFIED, false,
                    "");
-  CSPSourceList source_list(false, false, {source});
+  CSPSourceList source_list(false, false, false, {source});
   ContentSecurityPolicy policy(
       EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
       report_end_points, false);
 
-  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                           GURL("https://example.com/"), false,
-                                           &context, SourceLocation()));
-  EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                            GURL("https://not-example.com/"),
-                                            false, &context, SourceLocation()));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("https://example.com/"), false,
+      false, &context, SourceLocation(), false));
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("https://not-example.com/"), false,
+      false, &context, SourceLocation(), false));
 
   // Register 'https' as bypassing CSP, which should now bypass is entirely.
   context.AddSchemeToBypassCSP("https");
 
-  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                           GURL("https://example.com/"), false,
-                                           &context, SourceLocation()));
-  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                           GURL("https://not-example.com/"),
-                                           false, &context, SourceLocation()));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("https://example.com/"), false,
+      false, &context, SourceLocation(), false));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("https://not-example.com/"), false,
+      false, &context, SourceLocation(), false));
 }
 
 TEST(ContentSecurityPolicy, FilesystemAllowedWhenBypassingCSP) {
@@ -183,31 +183,31 @@ TEST(ContentSecurityPolicy, FilesystemAllowedWhenBypassingCSP) {
   std::vector<std::string> report_end_points;  // empty
   CSPSource source("https", "example.com", false, url::PORT_UNSPECIFIED, false,
                    "");
-  CSPSourceList source_list(false, false, {source});
+  CSPSourceList source_list(false, false, false, {source});
   ContentSecurityPolicy policy(
       EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
       report_end_points, false);
 
   EXPECT_FALSE(ContentSecurityPolicy::Allow(
       policy, CSPDirective::FrameSrc,
-      GURL("filesystem:https://example.com/file.txt"), false, &context,
-      SourceLocation()));
+      GURL("filesystem:https://example.com/file.txt"), false, false, &context,
+      SourceLocation(), false));
   EXPECT_FALSE(ContentSecurityPolicy::Allow(
       policy, CSPDirective::FrameSrc,
-      GURL("filesystem:https://not-example.com/file.txt"), false, &context,
-      SourceLocation()));
+      GURL("filesystem:https://not-example.com/file.txt"), false, false,
+      &context, SourceLocation(), false));
 
   // Register 'https' as bypassing CSP, which should now bypass is entirely.
   context.AddSchemeToBypassCSP("https");
 
   EXPECT_TRUE(ContentSecurityPolicy::Allow(
       policy, CSPDirective::FrameSrc,
-      GURL("filesystem:https://example.com/file.txt"), false, &context,
-      SourceLocation()));
+      GURL("filesystem:https://example.com/file.txt"), false, false, &context,
+      SourceLocation(), false));
   EXPECT_TRUE(ContentSecurityPolicy::Allow(
       policy, CSPDirective::FrameSrc,
-      GURL("filesystem:https://not-example.com/file.txt"), false, &context,
-      SourceLocation()));
+      GURL("filesystem:https://not-example.com/file.txt"), false, false,
+      &context, SourceLocation(), false));
 }
 
 TEST(ContentSecurityPolicy, BlobAllowedWhenBypassingCSP) {
@@ -215,34 +215,34 @@ TEST(ContentSecurityPolicy, BlobAllowedWhenBypassingCSP) {
   std::vector<std::string> report_end_points;  // empty
   CSPSource source("https", "example.com", false, url::PORT_UNSPECIFIED, false,
                    "");
-  CSPSourceList source_list(false, false, {source});
+  CSPSourceList source_list(false, false, false, {source});
   ContentSecurityPolicy policy(
       EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
       report_end_points, false);
 
-  EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                            GURL("blob:https://example.com/"),
-                                            false, &context, SourceLocation()));
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("blob:https://example.com/"), false,
+      false, &context, SourceLocation(), false));
   EXPECT_FALSE(ContentSecurityPolicy::Allow(
       policy, CSPDirective::FrameSrc, GURL("blob:https://not-example.com/"),
-      false, &context, SourceLocation()));
+      false, false, &context, SourceLocation(), false));
 
   // Register 'https' as bypassing CSP, which should now bypass is entirely.
   context.AddSchemeToBypassCSP("https");
 
-  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
-                                           GURL("blob:https://example.com/"),
-                                           false, &context, SourceLocation()));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("blob:https://example.com/"), false,
+      false, &context, SourceLocation(), false));
   EXPECT_TRUE(ContentSecurityPolicy::Allow(
       policy, CSPDirective::FrameSrc, GURL("blob:https://not-example.com/"),
-      false, &context, SourceLocation()));
+      false, false, &context, SourceLocation(), false));
 }
 
 TEST(ContentSecurityPolicy, ShouldUpgradeInsecureRequest) {
   std::vector<std::string> report_end_points;  // empty
   CSPSource source("https", "example.com", false, url::PORT_UNSPECIFIED, false,
                    "");
-  CSPSourceList source_list(false, false, {source});
+  CSPSourceList source_list(false, false, false, {source});
   ContentSecurityPolicy policy(
       EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
       report_end_points, false);
@@ -254,4 +254,91 @@ TEST(ContentSecurityPolicy, ShouldUpgradeInsecureRequest) {
   EXPECT_TRUE(ContentSecurityPolicy::ShouldUpgradeInsecureRequest(policy));
 }
 
+TEST(ContentSecurityPolicy, NavigateToChecks) {
+  CSPContextTest context;
+  std::vector<std::string> report_end_points;  // empty
+  CSPSource example("https", "example.test", false, url::PORT_UNSPECIFIED,
+                    false, "");
+  CSPSourceList none_source_list(false, false, false, {});
+  CSPSourceList example_source_list(false, false, false, {example});
+  CSPSourceList self_source_list(true, false, false, {});
+  CSPSourceList redirects_source_list(false, false, true, {});
+  CSPSourceList redirects_example_source_list(false, false, true, {example});
+  context.SetSelf(example);
+
+  struct TestCase {
+    const CSPSourceList& navigate_to_list;
+    const GURL& url;
+    bool is_redirect;
+    bool is_response_check;
+    bool expected;
+    bool is_form_submission;
+    const CSPSourceList* form_action_list;
+  } cases[] = {
+      // Basic source matching.
+      {none_source_list, GURL("https://example.test"), false, false, false,
+       false, nullptr},
+      {example_source_list, GURL("https://example.test"), false, false, true,
+       false, nullptr},
+      {example_source_list, GURL("https://not-example.test"), false, false,
+       false, false, nullptr},
+      {self_source_list, GURL("https://example.test"), false, false, true,
+       false, nullptr},
+
+      // Checking allow_redirect flag interactions.
+      {redirects_source_list, GURL("https://example.test"), false, false, true,
+       false, nullptr},
+      {redirects_source_list, GURL("https://example.test"), true, false, true,
+       false, nullptr},
+      {redirects_source_list, GURL("https://example.test"), true, true, true,
+       false, nullptr},
+      {redirects_source_list, GURL("https://example.test"), false, true, false,
+       false, nullptr},
+      {redirects_example_source_list, GURL("https://example.test"), false, true,
+       true, false, nullptr},
+
+      // Interaction with form-action
+
+      // Form submission without form-action present
+      {none_source_list, GURL("https://example.test"), false, false, false,
+       true, nullptr},
+      {example_source_list, GURL("https://example.test"), false, false, true,
+       true, nullptr},
+      {example_source_list, GURL("https://not-example.test"), false, false,
+       false, true, nullptr},
+      {self_source_list, GURL("https://example.test"), false, false, true, true,
+       nullptr},
+
+      // Form submission with form-action present
+      {none_source_list, GURL("https://example.test"), false, false, true, true,
+       &example_source_list},
+      {example_source_list, GURL("https://example.test"), false, false, true,
+       true, &example_source_list},
+      {example_source_list, GURL("https://not-example.test"), false, false,
+       true, true, &example_source_list},
+      {self_source_list, GURL("https://example.test"), false, false, true, true,
+       &example_source_list},
+
+  };
+
+  for (const auto& test : cases) {
+    std::vector<CSPDirective> directives;
+    directives.push_back(
+        CSPDirective(CSPDirective::NavigateTo, test.navigate_to_list));
+
+    if (test.form_action_list)
+      directives.push_back(
+          CSPDirective(CSPDirective::FormAction, *(test.form_action_list)));
+
+    ContentSecurityPolicy policy(EmptyCspHeader(), directives,
+                                 report_end_points, false);
+
+    EXPECT_EQ(test.expected,
+              ContentSecurityPolicy::Allow(
+                  policy, CSPDirective::NavigateTo, test.url, test.is_redirect,
+                  test.is_response_check, &context, SourceLocation(),
+                  test.is_form_submission));
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/common/content_security_policy/csp_context.cc b/chromium/content/common/content_security_policy/csp_context.cc
index 99b8ef4d48a..7791627ad19 100644
--- a/chromium/content/common/content_security_policy/csp_context.cc
+++ b/chromium/content/common/content_security_policy/csp_context.cc
@@ -32,41 +32,48 @@ CSPContext::~CSPContext() {}
 bool CSPContext::IsAllowedByCsp(CSPDirective::Name directive_name,
                                 const GURL& url,
                                 bool is_redirect,
+                                bool is_response_check,
                                 const SourceLocation& source_location,
-                                CheckCSPDisposition check_csp_disposition) {
+                                CheckCSPDisposition check_csp_disposition,
+                                bool is_form_submission) {
   if (SchemeShouldBypassCSP(url.scheme_piece()))
     return true;
 
   bool allow = true;
   for (const auto& policy : policies_) {
     if (ShouldCheckPolicy(policy, check_csp_disposition)) {
-      allow &= ContentSecurityPolicy::Allow(policy, directive_name, url,
-                                            is_redirect, this, source_location);
+      allow &= ContentSecurityPolicy::Allow(
+          policy, directive_name, url, is_redirect, is_response_check, this,
+          source_location, is_form_submission);
     }
   }
+
+  DCHECK(allow || check_csp_disposition != CSPContext::CHECK_REPORT_ONLY_CSP);
+
   return allow;
 }
 
 bool CSPContext::ShouldModifyRequestUrlForCsp(
-    const GURL& url,
-    bool is_subresource_or_form_submission,
-    GURL* new_url) {
+    bool is_subresource_or_form_submission) {
   for (const auto& policy : policies_) {
-    if (url.scheme() == "http" &&
-        ContentSecurityPolicy::ShouldUpgradeInsecureRequest(policy) &&
+    if (ContentSecurityPolicy::ShouldUpgradeInsecureRequest(policy) &&
         is_subresource_or_form_submission) {
-      *new_url = url;
-      GURL::Replacements replacements;
-      replacements.SetSchemeStr("https");
-      if (url.port() == "80")
-        replacements.SetPortStr("443");
-      *new_url = new_url->ReplaceComponents(replacements);
       return true;
     }
   }
   return false;
 }
 
+void CSPContext::ModifyRequestUrlForCsp(GURL* url) {
+  if (url->scheme() == "http") {
+    GURL::Replacements replacements;
+    replacements.SetSchemeStr("https");
+    if (url->port() == "80")
+      replacements.SetPortStr("443");
+    *url = url->ReplaceComponents(replacements);
+  }
+}
+
 void CSPContext::SetSelf(const url::Origin origin) {
   self_source_.reset();
 
@@ -88,6 +95,10 @@ void CSPContext::SetSelf(const url::Origin origin) {
   DCHECK_NE("", self_source_->scheme);
 }
 
+void CSPContext::SetSelf(const CSPSource& self_source) {
+  self_source_ = self_source;
+}
+
 bool CSPContext::SchemeShouldBypassCSP(const base::StringPiece& scheme) {
   return false;
 }
diff --git a/chromium/content/common/content_security_policy/csp_context.h b/chromium/content/common/content_security_policy/csp_context.h
index 3697e14c713..e7f1ceedbe9 100644
--- a/chromium/content/common/content_security_policy/csp_context.h
+++ b/chromium/content/common/content_security_policy/csp_context.h
@@ -49,17 +49,21 @@ class CONTENT_EXPORT CSPContext {
   bool IsAllowedByCsp(CSPDirective::Name directive_name,
                       const GURL& url,
                       bool is_redirect,
+                      bool is_response_check,
                       const SourceLocation& source_location,
-                      CheckCSPDisposition check_csp_disposition);
+                      CheckCSPDisposition check_csp_disposition,
+                      bool is_form_submission);
 
   // Returns true if the request URL needs to be modified (e.g. upgraded to
-  // HTTPS) according to the CSP. If true, |new_url| will contain the new URL
-  // that should be used instead of |url|.
-  bool ShouldModifyRequestUrlForCsp(const GURL& url,
-                                    bool is_suresource_or_form_submssion,
-                                    GURL* new_url);
+  // HTTPS) according to the CSP.
+  bool ShouldModifyRequestUrlForCsp(bool is_suresource_or_form_submssion);
+
+  // If the scheme of |url| is HTTP, this upgrades it to HTTPS, otherwise it
+  // doesn't modify it.
+  void ModifyRequestUrlForCsp(GURL* url);
 
   void SetSelf(const url::Origin origin);
+  void SetSelf(const CSPSource& self_source);
 
   // When a CSPSourceList contains 'self', the url is allowed when it match the
   // CSPSource returned by this function.
diff --git a/chromium/content/common/content_security_policy/csp_context_unittest.cc b/chromium/content/common/content_security_policy/csp_context_unittest.cc
index d5cf5780947..49ce33e13e1 100644
--- a/chromium/content/common/content_security_policy/csp_context_unittest.cc
+++ b/chromium/content/common/content_security_policy/csp_context_unittest.cc
@@ -60,7 +60,8 @@ ContentSecurityPolicy BuildPolicy(CSPDirective::Name directive_name,
       ContentSecurityPolicyHeader(std::string(),  // header
                                   blink::kWebContentSecurityPolicyTypeEnforce,
                                   blink::kWebContentSecurityPolicySourceHTTP),
-      {CSPDirective(directive_name, CSPSourceList(false, false, sources))},
+      {CSPDirective(directive_name,
+                    CSPSourceList(false, false, false, sources))},
       std::vector<std::string>(), false);  // report_end_points
 }
 
@@ -74,13 +75,13 @@ TEST(CSPContextTest, SchemeShouldBypassCSP) {
 
   EXPECT_FALSE(context.IsAllowedByCsp(
       CSPDirective::FrameSrc, GURL("data:text/html,<html></html>"), false,
-      SourceLocation(), CSPContext::CHECK_ALL_CSP));
+      false, SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
 
   context.AddSchemeToBypassCSP("data");
 
   EXPECT_TRUE(context.IsAllowedByCsp(
       CSPDirective::FrameSrc, GURL("data:text/html,<html></html>"), false,
-      SourceLocation(), CSPContext::CHECK_ALL_CSP));
+      false, SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
 }
 
 TEST(CSPContextTest, MultiplePolicies) {
@@ -97,17 +98,17 @@ TEST(CSPContextTest, MultiplePolicies) {
       BuildPolicy(CSPDirective::FrameSrc, {source_a, source_c}));
 
   EXPECT_TRUE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("http://a.com"), false, SourceLocation(),
-      CSPContext::CHECK_ALL_CSP));
+      CSPDirective::FrameSrc, GURL("http://a.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
   EXPECT_FALSE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("http://b.com"), false, SourceLocation(),
-      CSPContext::CHECK_ALL_CSP));
+      CSPDirective::FrameSrc, GURL("http://b.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
   EXPECT_FALSE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("http://c.com"), false, SourceLocation(),
-      CSPContext::CHECK_ALL_CSP));
+      CSPDirective::FrameSrc, GURL("http://c.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
   EXPECT_FALSE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("http://d.com"), false, SourceLocation(),
-      CSPContext::CHECK_ALL_CSP));
+      CSPDirective::FrameSrc, GURL("http://d.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
 }
 
 TEST(CSPContextTest, SanitizeDataForUseInCspViolation) {
@@ -126,8 +127,8 @@ TEST(CSPContextTest, SanitizeDataForUseInCspViolation) {
   // When the |blocked_url| and |source_location| aren't sensitive information.
   {
     EXPECT_FALSE(context.IsAllowedByCsp(CSPDirective::FrameSrc, blocked_url,
-                                        false, source_location,
-                                        CSPContext::CHECK_ALL_CSP));
+                                        false, false, source_location,
+                                        CSPContext::CHECK_ALL_CSP, false));
     ASSERT_EQ(1u, context.violations().size());
     EXPECT_EQ(context.violations()[0].blocked_url, blocked_url);
     EXPECT_EQ(context.violations()[0].source_location.url,
@@ -145,8 +146,8 @@ TEST(CSPContextTest, SanitizeDataForUseInCspViolation) {
   // When the |blocked_url| and |source_location| are sensitive information.
   {
     EXPECT_FALSE(context.IsAllowedByCsp(CSPDirective::FrameSrc, blocked_url,
-                                        false, source_location,
-                                        CSPContext::CHECK_ALL_CSP));
+                                        false, false, source_location,
+                                        CSPContext::CHECK_ALL_CSP, false));
     ASSERT_EQ(2u, context.violations().size());
     EXPECT_EQ(context.violations()[1].blocked_url, blocked_url.GetOrigin());
     EXPECT_EQ(context.violations()[1].source_location.url, "http://a.com/");
@@ -176,8 +177,8 @@ TEST(CSPContextTest, MultipleInfringement) {
       BuildPolicy(CSPDirective::FrameSrc, {source_c}));
 
   EXPECT_FALSE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("http://c.com"), false, SourceLocation(),
-      CSPContext::CHECK_ALL_CSP));
+      CSPDirective::FrameSrc, GURL("http://c.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
   ASSERT_EQ(2u, context.violations().size());
   const char console_message_a[] =
       "Refused to frame 'http://c.com/' because it violates the following "
@@ -207,8 +208,8 @@ TEST(CSPContextTest, CheckCSPDisposition) {
   // With CHECK_ALL_CSP, both policies should be checked and violations should
   // be reported.
   EXPECT_FALSE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("https://not-example.com"), false,
-      SourceLocation(), CSPContext::CHECK_ALL_CSP));
+      CSPDirective::FrameSrc, GURL("https://not-example.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_ALL_CSP, false));
   ASSERT_EQ(2u, context.violations().size());
   const char console_message_a[] =
       "Refused to frame 'https://not-example.com/' because it violates the "
@@ -229,8 +230,8 @@ TEST(CSPContextTest, CheckCSPDisposition) {
   // With CHECK_REPORT_ONLY_CSP, the request should be allowed but reported.
   context.ClearViolations();
   EXPECT_TRUE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("https://not-example.com"), false,
-      SourceLocation(), CSPContext::CHECK_REPORT_ONLY_CSP));
+      CSPDirective::FrameSrc, GURL("https://not-example.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_REPORT_ONLY_CSP, false));
   ASSERT_EQ(1u, context.violations().size());
   EXPECT_EQ(console_message_b, context.violations()[0].console_message);
 
@@ -238,8 +239,8 @@ TEST(CSPContextTest, CheckCSPDisposition) {
   // enforced policy violation should be reported.
   context.ClearViolations();
   EXPECT_FALSE(context.IsAllowedByCsp(
-      CSPDirective::FrameSrc, GURL("https://not-example.com"), false,
-      SourceLocation(), CSPContext::CHECK_ENFORCED_CSP));
+      CSPDirective::FrameSrc, GURL("https://not-example.com"), false, false,
+      SourceLocation(), CSPContext::CHECK_ENFORCED_CSP, false));
   ASSERT_EQ(1u, context.violations().size());
   EXPECT_EQ(console_message_a, context.violations()[0].console_message);
 }
@@ -250,27 +251,40 @@ TEST(CSPContextTest, ShouldModifyRequestUrlForCsp) {
   CSPContextTest context;
   context.AddContentSecurityPolicy(BuildPolicy(
       CSPDirective::UpgradeInsecureRequests, std::vector<CSPSource>()));
-  GURL new_url;
   // An HTTP subresource or form submission should be upgraded.
-  EXPECT_TRUE(context.ShouldModifyRequestUrlForCsp(GURL("http://example.com"),
-                                                   true, &new_url));
-  EXPECT_EQ(GURL("https://example.com"), new_url);
-  EXPECT_TRUE(context.ShouldModifyRequestUrlForCsp(
-      GURL("http://example.com:80"), true, &new_url));
-  EXPECT_EQ(GURL("https://example.com:443"), new_url);
+  EXPECT_TRUE(context.ShouldModifyRequestUrlForCsp(true));
+
+  // Main-frame navigation requests should not be modified.
+  EXPECT_FALSE(context.ShouldModifyRequestUrlForCsp(false));
+}
+
+// Tests that URLs passed to ModifyRequestUrlForCsp are modified according to
+// the spec for upgrades.
+TEST(CSPContextTest, ModifyRequestUrlForCsp) {
+  CSPContextTest context;
+  GURL test_url;
+
+  test_url = GURL("http://example.com");
+  context.ModifyRequestUrlForCsp(&test_url);
+  EXPECT_EQ(GURL("https://example.com"), test_url);
+
+  test_url = GURL("http://example.com:80");
+  context.ModifyRequestUrlForCsp(&test_url);
+  EXPECT_EQ(GURL("https://example.com:443"), test_url);
+
   // Non-standard ports should not be modified.
-  EXPECT_TRUE(context.ShouldModifyRequestUrlForCsp(
-      GURL("http://example-weird-port.com:8088"), true, &new_url));
-  EXPECT_EQ(GURL("https://example-weird-port.com:8088"), new_url);
+  test_url = GURL("http://example-weird-port.com:8088");
+  context.ModifyRequestUrlForCsp(&test_url);
+  EXPECT_EQ(GURL("https://example-weird-port.com:8088"), test_url);
 
   // Non-HTTP URLs don't need to be modified.
-  EXPECT_FALSE(context.ShouldModifyRequestUrlForCsp(GURL("https://example.com"),
-                                                    true, &new_url));
-  EXPECT_FALSE(context.ShouldModifyRequestUrlForCsp(
-      GURL("data:text/html,<html></html>"), true, &new_url));
-  // Nor do main-frame navigation requests.
-  EXPECT_FALSE(context.ShouldModifyRequestUrlForCsp(GURL("http://example.com"),
-                                                    false, &new_url));
+  test_url = GURL("https://example.com");
+  context.ModifyRequestUrlForCsp(&test_url);
+  EXPECT_EQ(GURL("https://example.com"), test_url);
+
+  test_url = GURL("data:text/html,<html></html>");
+  context.ModifyRequestUrlForCsp(&test_url);
+  EXPECT_EQ(GURL("data:text/html,<html></html>"), test_url);
 }
 
 }  // namespace content
diff --git a/chromium/content/common/content_security_policy/csp_directive.cc b/chromium/content/common/content_security_policy/csp_directive.cc
index d518a4b5f91..51a6cb23672 100644
--- a/chromium/content/common/content_security_policy/csp_directive.cc
+++ b/chromium/content/common/content_security_policy/csp_directive.cc
@@ -30,6 +30,8 @@ std::string CSPDirective::NameToString(CSPDirective::Name name) {
       return "form-action";
     case UpgradeInsecureRequests:
       return "upgrade-insecure-requests";
+    case NavigateTo:
+      return "navigate-to";
     case Unknown:
       return "";
   }
@@ -49,6 +51,8 @@ CSPDirective::Name CSPDirective::StringToName(const std::string& name) {
     return CSPDirective::FormAction;
   if (name == "upgrade-insecure-requests")
     return CSPDirective::UpgradeInsecureRequests;
+  if (name == "navigate-to")
+    return CSPDirective::NavigateTo;
   return CSPDirective::Unknown;
 }
 
diff --git a/chromium/content/common/content_security_policy/csp_directive.h b/chromium/content/common/content_security_policy/csp_directive.h
index 914ab181392..289e5fba4c0 100644
--- a/chromium/content/common/content_security_policy/csp_directive.h
+++ b/chromium/content/common/content_security_policy/csp_directive.h
@@ -27,6 +27,7 @@ struct CONTENT_EXPORT CSPDirective {
     FrameSrc,
     FormAction,
     UpgradeInsecureRequests,
+    NavigateTo,
 
     Unknown,
     NameLast = Unknown,
diff --git a/chromium/content/common/content_security_policy/csp_source_list.cc b/chromium/content/common/content_security_policy/csp_source_list.cc
index 905aaae5fdd..4bf358daa1d 100644
--- a/chromium/content/common/content_security_policy/csp_source_list.cc
+++ b/chromium/content/common/content_security_policy/csp_source_list.cc
@@ -22,12 +22,16 @@ bool AllowFromSources(const GURL& url,
 };  // namespace
 
 CSPSourceList::CSPSourceList()
-    : allow_self(false), allow_star(false), sources() {}
+    : allow_self(false), allow_star(false), allow_redirects(false), sources() {}
 
 CSPSourceList::CSPSourceList(bool allow_self,
                              bool allow_star,
+                             bool allow_redirects,
                              std::vector<CSPSource> sources)
-    : allow_self(allow_self), allow_star(allow_star), sources(sources) {}
+    : allow_self(allow_self),
+      allow_star(allow_star),
+      allow_redirects(allow_redirects),
+      sources(sources) {}
 
 CSPSourceList::CSPSourceList(const CSPSourceList&) = default;
 CSPSourceList::~CSPSourceList() = default;
@@ -36,7 +40,23 @@ CSPSourceList::~CSPSourceList() = default;
 bool CSPSourceList::Allow(const CSPSourceList& source_list,
                           const GURL& url,
                           CSPContext* context,
-                          bool is_redirect) {
+                          bool is_redirect,
+                          bool is_response_check) {
+  // If the source list allows all redirects, the decision can't be made until
+  // the response is received.
+  if (source_list.allow_redirects && !is_response_check)
+    return true;
+
+  // If the source list does not allow all redirects, the decision has already
+  // been made when checking the request.
+  if (!source_list.allow_redirects && is_response_check)
+    return true;
+
+  // If the source list allows all redirects, all responses that are a redirect
+  // are allowed.
+  if (source_list.allow_redirects && is_response_check && is_redirect)
+    return true;
+
   // Wildcards match network schemes ('http', 'https', 'ftp', 'ws', 'wss'), and
   // the scheme of the protected resource:
   // https://w3c.github.io/webappsec-csp/#match-url-to-source-expression. Other
diff --git a/chromium/content/common/content_security_policy/csp_source_list.h b/chromium/content/common/content_security_policy/csp_source_list.h
index 4fafb439a0f..94af77554dd 100644
--- a/chromium/content/common/content_security_policy/csp_source_list.h
+++ b/chromium/content/common/content_security_policy/csp_source_list.h
@@ -18,6 +18,7 @@ struct CONTENT_EXPORT CSPSourceList {
   CSPSourceList();
   CSPSourceList(bool allow_self,
                 bool allow_star,
+                bool allow_redirects,
                 std::vector<CSPSource> source_list);
   CSPSourceList(const CSPSourceList&);
   ~CSPSourceList();
@@ -26,6 +27,7 @@ struct CONTENT_EXPORT CSPSourceList {
   // on the source list itself.
   bool allow_self;
   bool allow_star;
+  bool allow_redirects;
   std::vector<CSPSource> sources;
 
   std::string ToString() const;
@@ -37,7 +39,8 @@ struct CONTENT_EXPORT CSPSourceList {
   static bool Allow(const CSPSourceList& source_list,
                     const GURL& url,
                     CSPContext* context,
-                    bool is_redirect = false);
+                    bool is_redirect = false,
+                    bool is_response_check = false);
 };
 
 }  // namespace content
diff --git a/chromium/content/common/content_security_policy/csp_source_list_unittest.cc b/chromium/content/common/content_security_policy/csp_source_list_unittest.cc
index 2e0838d298c..826bf429062 100644
--- a/chromium/content/common/content_security_policy/csp_source_list_unittest.cc
+++ b/chromium/content/common/content_security_policy/csp_source_list_unittest.cc
@@ -15,8 +15,10 @@ namespace {
 bool Allow(const CSPSourceList& source_list,
            const GURL& url,
            CSPContext* context,
-           bool is_redirect = false) {
-  return CSPSourceList::Allow(source_list, url, context, is_redirect);
+           bool is_redirect = false,
+           bool is_response_check = false) {
+  return CSPSourceList::Allow(source_list, url, context, is_redirect,
+                              is_response_check);
 }
 
 }  // namespace
@@ -26,7 +28,8 @@ TEST(CSPSourceList, MultipleSource) {
   context.SetSelf(url::Origin::Create(GURL("http://example.com")));
   CSPSourceList source_list(
       false,  // allow_self
-      false,  // allow_star:
+      false,  // allow_star
+      false,  // allow_redirects
       {CSPSource("", "a.com", false, url::PORT_UNSPECIFIED, false, ""),
        CSPSource("", "b.com", false, url::PORT_UNSPECIFIED, false, "")});
   EXPECT_TRUE(Allow(source_list, GURL("http://a.com"), &context));
@@ -38,7 +41,8 @@ TEST(CSPSourceList, AllowStar) {
   CSPContext context;
   context.SetSelf(url::Origin::Create(GURL("http://example.com")));
   CSPSourceList source_list(false,                      // allow_self
-                            true,                       // allow_star:
+                            true,                       // allow_star
+                            false,                      // allow_redirects
                             std::vector<CSPSource>());  // source_list
   EXPECT_TRUE(Allow(source_list, GURL("http://not-example.com"), &context));
   EXPECT_TRUE(Allow(source_list, GURL("https://not-example.com"), &context));
@@ -59,7 +63,8 @@ TEST(CSPSourceList, AllowSelf) {
   CSPContext context;
   context.SetSelf(url::Origin::Create(GURL("http://example.com")));
   CSPSourceList source_list(true,                       // allow_self
-                            false,                      // allow_star:
+                            false,                      // allow_star
+                            false,                      // allow_redirects
                             std::vector<CSPSource>());  // source_list
   EXPECT_TRUE(Allow(source_list, GURL("http://example.com"), &context));
   EXPECT_FALSE(Allow(source_list, GURL("http://not-example.com"), &context));
@@ -72,6 +77,7 @@ TEST(CSPSourceList, AllowStarAndSelf) {
   context.SetSelf(url::Origin::Create(GURL("https://a.com")));
   CSPSourceList source_list(false,  // allow_self
                             false,  // allow_star
+                            false,  // allow_redirects
                             std::vector<CSPSource>());
 
   // If the request is allowed by {*} and not by {'self'} then it should be
@@ -91,7 +97,8 @@ TEST(CSPSourceList, AllowSelfWithUnspecifiedPort) {
   CSPContext context;
   context.SetSelf(url::Origin::Create(GURL("chrome://print")));
   CSPSourceList source_list(true,                       // allow_self
-                            false,                      // allow_star:
+                            false,                      // allow_star
+                            false,                      // allow_redirects
                             std::vector<CSPSource>());  // source_list
 
   EXPECT_TRUE(
@@ -104,7 +111,8 @@ TEST(CSPSourceList, AllowNone) {
   CSPContext context;
   context.SetSelf(url::Origin::Create(GURL("http://example.com")));
   CSPSourceList source_list(false,                      // allow_self
-                            false,                      // allow_star:
+                            false,                      // allow_star
+                            false,                      // allow_redirects
                             std::vector<CSPSource>());  // source_list
   EXPECT_FALSE(Allow(source_list, GURL("http://example.com"), &context));
   EXPECT_FALSE(Allow(source_list, GURL("https://example.test/"), &context));
@@ -113,7 +121,8 @@ TEST(CSPSourceList, AllowNone) {
 TEST(CSPSourceTest, SelfIsUnique) {
   // Policy: 'self'
   CSPSourceList source_list(true,                       // allow_self
-                            false,                      // allow_star:
+                            false,                      // allow_star
+                            false,                      // allow_redirects
                             std::vector<CSPSource>());  // source_list
   CSPContext context;
 
diff --git a/chromium/content/common/cursors/webcursor_aura.cc b/chromium/content/common/cursors/webcursor_aura.cc
index 9a3939ecfc7..73e110f8823 100644
--- a/chromium/content/common/cursors/webcursor_aura.cc
+++ b/chromium/content/common/cursors/webcursor_aura.cc
@@ -104,6 +104,11 @@ gfx::NativeCursor WebCursor::GetNativeCursor() {
     case WebCursorInfo::kTypeCustom: {
       ui::Cursor cursor(ui::CursorType::kCustom);
       cursor.SetPlatformCursor(GetPlatformCursor());
+      SkBitmap bitmap;
+      gfx::Point hotspot;
+      CreateScaledBitmapAndHotspotFromCustomData(&bitmap, &hotspot);
+      cursor.set_custom_bitmap(bitmap);
+      cursor.set_custom_hotspot(hotspot);
       return cursor;
     }
     default:
diff --git a/chromium/content/common/dom_storage/OWNERS b/chromium/content/common/dom_storage/OWNERS
index 39d46142947..74dc2f93524 100644
--- a/chromium/content/common/dom_storage/OWNERS
+++ b/chromium/content/common/dom_storage/OWNERS
@@ -1,9 +1,6 @@
 dmurph@chromium.org
 mek@chromium.org
 
-# OOO until this comment is removed.
-michaeln@chromium.org
-
 per-file *_messages*.h=set noparent
 per-file *_messages*.h=file://ipc/SECURITY_OWNERS
 
diff --git a/chromium/content/common/external_ipc_dumper.cc b/chromium/content/common/external_ipc_dumper.cc
index 907ebfd9c52..f9ab7e69bd7 100644
--- a/chromium/content/common/external_ipc_dumper.cc
+++ b/chromium/content/common/external_ipc_dumper.cc
@@ -27,10 +27,11 @@ const char kSetDumpDirectoryEntryName[] = "SetDumpDirectory";
 
 namespace content {
 
+NO_SANITIZE("cfi-icall")
 IPC::ChannelProxy::OutgoingMessageFilter* LoadExternalIPCDumper(
     const base::FilePath& dump_directory) {
   base::FilePath module_path;
-  if (!PathService::Get(base::DIR_MODULE, &module_path)) {
+  if (!base::PathService::Get(base::DIR_MODULE, &module_path)) {
     LOG(ERROR) << "Unable to get message dump module directory.";
     return NULL;
   }
diff --git a/chromium/content/common/file_utilities.mojom b/chromium/content/common/file_utilities.mojom
deleted file mode 100644
index 7ab8354141b..00000000000
--- a/chromium/content/common/file_utilities.mojom
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content.mojom;
-
-import "mojo/public/mojom/base/file_info.mojom";
-import "mojo/public/mojom/base/file_path.mojom";
-
-// File utilities messages sent from the renderer to the browser.
-interface FileUtilitiesHost {
-  [Sync]
-  GetFileInfo(mojo_base.mojom.FilePath path) => (
-      mojo_base.mojom.FileInfo? result);
-};
diff --git a/chromium/content/common/fileapi/OWNERS b/chromium/content/common/fileapi/OWNERS
index 77d0e9de90c..3a69eb7de67 100644
--- a/chromium/content/common/fileapi/OWNERS
+++ b/chromium/content/common/fileapi/OWNERS
@@ -1,4 +1,4 @@
-michaeln@chromium.org
+mek@chromium.org
 jianli@chromium.org
 tzik@chromium.org
 nhiroki@chromium.org
diff --git a/chromium/content/common/frame.mojom b/chromium/content/common/frame.mojom
index 99ec7e8d799..09b5766c079 100644
--- a/chromium/content/common/frame.mojom
+++ b/chromium/content/common/frame.mojom
@@ -38,7 +38,8 @@ interface Frame {
   // Extracts the data at the given rect.
   [EnableIf=is_android]
   ExtractSmartClipData(gfx.mojom.Rect rect)
-      => (mojo_base.mojom.String16 text, mojo_base.mojom.String16 html);
+      => (mojo_base.mojom.String16 text, mojo_base.mojom.String16 html,
+              gfx.mojom.Rect clip_rect);
 };
 
 // See src/content/common/navigation_params.h
@@ -54,20 +55,18 @@ struct RequestNavigationParams;
 interface FrameNavigationControl {
   // Tells the renderer that a navigation is ready to commit.
   //
-  // The renderer should request |body_url| to get access to the stream
-  // containing the body of the response. When the Network Service or
-  // NavigationMojoResponse is enabled, |body_url| is not used and instead
-  // |url_loader_client_endpoints| provides a way to continue the navigation.
+  // The renderer should bind the |url_loader_client_endpoints| to an
+  // URLLoaderClient implementation to continue loading the document that will
+  // be the result of the committed navigation.
   //
-  // Note: |body_url| and |url_loader_client_endpoints| will be empty iff the
-  // navigation URL wasn't handled by the network stack (i.e. JavaScript URLs,
-  // renderer debug URLs, same document navigations, about:blank, ...)
+  // Note: |url_loader_client_endpoints| will be empty iff the navigation URL
+  // wasn't handled by the network stack (i.e. JavaScript URLs, renderer debug
+  // URLs, same document navigations, about:blank, ...)
   //
   // When the Network Service is enabled, |subresource_loader_factories| may
   // also be provided by the browser as a a means for the renderer to load
   // subresources where applicable.
   //
-  // When S13nServiceWorker/NavigationMojoResponse is enabled,
   // |controller_service_worker_info| may also be provided by the browser if the
   // frame that is being navigated is supposed to be controlled by a Service
   // Worker.
@@ -84,7 +83,6 @@ interface FrameNavigationControl {
   // navigation token that can be passed from renderer to the browser.
   CommitNavigation(
       network.mojom.URLResponseHead head,
-      url.mojom.Url body_url,
       CommonNavigationParams common_params,
       RequestNavigationParams request_params,
       network.mojom.URLLoaderClientEndpoints? url_loader_client_endpoints,
@@ -327,13 +325,4 @@ interface FrameHost {
   // correctly set the initial size of the frame in case of a cross-process
   // navigation.
   FrameSizeChanged(gfx.mojom.Size size);
-
-  // Sent by the renderer to update Picture-in-Picture with SurfaceId and video
-  // size to be used to show content in the Picture-in-Picture window.
-  OnUpdatePictureInPictureSurfaceId(
-      viz.mojom.SurfaceId surface_id,
-      gfx.mojom.Size natural_size);
-
-  // Sent by the renderer to signal that Picture-in-Picture mode has ended.
-  OnExitPictureInPicture();
 };
diff --git a/chromium/content/common/frame_messages.h b/chromium/content/common/frame_messages.h
index cf96a19a4e0..98bc62f6c93 100644
--- a/chromium/content/common/frame_messages.h
+++ b/chromium/content/common/frame_messages.h
@@ -17,6 +17,8 @@
 
 #include "base/optional.h"
 #include "build/build_config.h"
+#include "cc/input/touch_action.h"
+#include "cc/trees/render_frame_metadata.h"
 #include "components/viz/common/surfaces/surface_id.h"
 #include "components/viz/common/surfaces/surface_info.h"
 #include "content/common/buildflags.h"
@@ -29,7 +31,7 @@
 #include "content/common/frame_message_structs.h"
 #include "content/common/frame_owner_properties.h"
 #include "content/common/frame_replication_state.h"
-#include "content/common/frame_resize_params.h"
+#include "content/common/frame_visual_properties.h"
 #include "content/common/navigation_gesture.h"
 #include "content/common/navigation_params.h"
 #include "content/common/resource_timing_info.h"
@@ -62,10 +64,12 @@
 #include "third_party/blink/public/platform/web_insecure_request_policy.h"
 #include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
 #include "third_party/blink/public/platform/web_scroll_into_view_params.h"
+#include "third_party/blink/public/platform/web_scroll_types.h"
 #include "third_party/blink/public/platform/web_sudden_termination_disabler_type.h"
 #include "third_party/blink/public/web/web_find_options.h"
 #include "third_party/blink/public/web/web_frame_owner_properties.h"
 #include "third_party/blink/public/web/web_frame_serializer_cache_control_policy.h"
+#include "third_party/blink/public/web/web_fullscreen_options.h"
 #include "third_party/blink/public/web/web_tree_scope_type.h"
 #include "third_party/blink/public/web/web_triggering_event_info.h"
 #include "ui/gfx/geometry/rect.h"
@@ -134,6 +138,12 @@ IPC_ENUM_TRAITS_MAX_VALUE(content::CSPDisposition,
                           content::CSPDisposition::LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebTriggeringEventInfo,
                           blink::WebTriggeringEventInfo::kLast)
+IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScrollDirection,
+                              blink::kFirstScrollDirection,
+                              blink::kLastScrollDirection)
+IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScrollGranularity,
+                              blink::kFirstScrollGranularity,
+                              blink::kLastScrollGranularity)
 
 IPC_STRUCT_TRAITS_BEGIN(blink::WebFloatSize)
   IPC_STRUCT_TRAITS_MEMBER(width)
@@ -154,6 +164,10 @@ IPC_STRUCT_TRAITS_BEGIN(blink::WebFindOptions)
   IPC_STRUCT_TRAITS_MEMBER(force)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(blink::WebFullscreenOptions)
+  IPC_STRUCT_TRAITS_MEMBER(prefers_navigation_bar)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(blink::WebScrollIntoViewParams::Alignment)
   IPC_STRUCT_TRAITS_MEMBER(rect_visible)
   IPC_STRUCT_TRAITS_MEMBER(rect_hidden)
@@ -230,14 +244,25 @@ IPC_STRUCT_TRAITS_BEGIN(content::FrameOwnerProperties)
   IPC_STRUCT_TRAITS_MEMBER(required_csp)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::FrameResizeParams)
+IPC_STRUCT_TRAITS_BEGIN(content::FrameVisualProperties)
   IPC_STRUCT_TRAITS_MEMBER(screen_info)
   IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
   IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
   IPC_STRUCT_TRAITS_MEMBER(max_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(auto_resize_sequence_number)
   IPC_STRUCT_TRAITS_MEMBER(screen_space_rect)
   IPC_STRUCT_TRAITS_MEMBER(local_frame_size)
+  IPC_STRUCT_TRAITS_MEMBER(capture_sequence_number)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(cc::RenderFrameMetadata)
+  IPC_STRUCT_TRAITS_MEMBER(is_scroll_offset_at_top)
+  IPC_STRUCT_TRAITS_MEMBER(root_background_color)
+  IPC_STRUCT_TRAITS_MEMBER(root_scroll_offset)
+  IPC_STRUCT_TRAITS_MEMBER(selection)
+  IPC_STRUCT_TRAITS_MEMBER(is_mobile_optimized)
+  IPC_STRUCT_TRAITS_MEMBER(device_scale_factor)
+  IPC_STRUCT_TRAITS_MEMBER(viewport_size_in_pixels)
+  IPC_STRUCT_TRAITS_MEMBER(local_surface_id)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(blink::FramePolicy)
@@ -426,11 +451,6 @@ IPC_STRUCT_BEGIN_WITH_PARENT(FrameHostMsg_DidCommitProvisionalLoad_Params,
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameMsg_PostMessage_Params)
-  // Whether the data format is supplied as serialized script value, or as
-  // a simple string. If it is a raw string, must be converted from string to a
-  // WebSerializedScriptValue in the renderer process.
-  IPC_STRUCT_MEMBER(bool, is_data_raw_string)
-
   // When sent to the browser, this is the routing ID of the source frame in
   // the source process.  The browser replaces it with the routing ID of the
   // equivalent frame proxy in the destination process.
@@ -473,7 +493,8 @@ IPC_STRUCT_TRAITS_BEGIN(content::CommonNavigationParams)
   IPC_STRUCT_TRAITS_MEMBER(should_check_main_world_csp)
   IPC_STRUCT_TRAITS_MEMBER(has_user_gesture)
   IPC_STRUCT_TRAITS_MEMBER(started_from_context_menu)
-  IPC_STRUCT_TRAITS_MEMBER(suggested_filename)
+  IPC_STRUCT_TRAITS_MEMBER(initiator_csp)
+  IPC_STRUCT_TRAITS_MEMBER(initiator_self_source)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::NavigationTiming)
@@ -550,7 +571,7 @@ IPC_STRUCT_BEGIN(FrameHostMsg_OpenURL_Params)
   IPC_STRUCT_MEMBER(bool, user_gesture)
   IPC_STRUCT_MEMBER(bool, is_history_navigation_in_new_child)
   IPC_STRUCT_MEMBER(blink::WebTriggeringEventInfo, triggering_event_info)
-  IPC_STRUCT_MEMBER(base::Optional<std::string>, suggested_filename)
+  IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, blob_url_token)
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameHostMsg_DownloadUrl_Params)
@@ -560,6 +581,7 @@ IPC_STRUCT_BEGIN(FrameHostMsg_DownloadUrl_Params)
   IPC_STRUCT_MEMBER(content::Referrer, referrer)
   IPC_STRUCT_MEMBER(url::Origin, initiator_origin)
   IPC_STRUCT_MEMBER(base::string16, suggested_name)
+  IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, blob_url_token)
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameMsg_TextTrackSettings_Params)
@@ -764,9 +786,6 @@ IPC_MESSAGE_ROUTED4(FrameHostMsg_ShowCreatedWindow,
                     gfx::Rect /* initial_rect */,
                     bool /* opened_by_user_gesture */)
 
-// Let the browser know a StreamHandle has been consumed and can be released.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_StreamHandleConsumed, GURL /* stream_url */)
-
 #if BUILDFLAG(ENABLE_PLUGINS)
 IPC_STRUCT_TRAITS_BEGIN(content::PepperRendererInstanceData)
   IPC_STRUCT_TRAITS_MEMBER(render_process_id)
@@ -990,10 +1009,10 @@ IPC_MESSAGE_ROUTED1(FrameMsg_PostMessageEvent, FrameMsg_PostMessage_Params)
 // Tells the RenderFrame to clear the focused element (if any).
 IPC_MESSAGE_ROUTED0(FrameMsg_ClearFocusedElement)
 
-// Informs the parent renderer that the child would like a new
-// viz::LocalSurfaceId in response to an auto-resize.
-IPC_MESSAGE_ROUTED1(FrameMsg_ResizeDueToAutoResize,
-                    uint64_t /* sequence_number */)
+// Informs the parent renderer that the child has completed an autoresize
+// transaction and should update with the provided viz::LocalSurfaceId.
+IPC_MESSAGE_ROUTED1(FrameMsg_DidUpdateVisualProperties,
+                    cc::RenderFrameMetadata /* metadata */)
 
 // Requests a viz::LocalSurfaceId to enable auto-resize mode from the parent
 // renderer.
@@ -1005,38 +1024,6 @@ IPC_MESSAGE_ROUTED2(FrameMsg_EnableAutoResize,
 // renderer.
 IPC_MESSAGE_ROUTED0(FrameMsg_DisableAutoResize)
 
-#if defined(OS_ANDROID)
-// Request the distance to the nearest find result in a frame from the point at
-// (x, y), defined in fractions of the content document's width and height. The
-// distance will be returned via FrameHostMsg_GetNearestFindResult_Reply.  Note
-// that |nfr_request_id| is a completely seperate ID from the |request_id| used
-// in other find-related IPCs. It is specifically used to uniquely identify a
-// nearest find result request, rather than a find request.
-IPC_MESSAGE_ROUTED3(FrameMsg_GetNearestFindResult,
-                    int /* nfr_request_id */,
-                    float /* x */,
-                    float /* y */)
-
-// Activates a find result. The point (x,y) is in fractions of the content
-// document's width and height.
-IPC_MESSAGE_ROUTED3(FrameMsg_ActivateNearestFindResult,
-                    int /* request_id */,
-                    float /* x */,
-                    float /* y */)
-
-// Sent when the browser wants the bounding boxes of the current find matches.
-//
-// If match rects are already cached on the browser side, |current_version|
-// should be the version number from the FrameHostMsg_FindMatchRects_Reply
-// they came in, so the renderer can tell if it needs to send updated rects.
-// Otherwise just pass -1 to always receive the list of rects.
-//
-// There must be an active search string (it is probably most useful to call
-// this immediately after a FrameHostMsg_Find_Reply message arrives with
-// final_update set to true).
-IPC_MESSAGE_ROUTED1(FrameMsg_FindMatchRects, int /* current_version */)
-#endif
-
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
 #if defined(OS_MACOSX)
 IPC_MESSAGE_ROUTED1(FrameMsg_SelectPopupMenuItem,
@@ -1094,11 +1081,6 @@ IPC_MESSAGE_ROUTED3(FrameMsg_Find,
                     base::string16 /* search_text */,
                     blink::WebFindOptions)
 
-// This message notifies the frame that it is no longer the active frame in the
-// current find session, and so it should clear its active find match (and no
-// longer highlight it with special coloring).
-IPC_MESSAGE_ROUTED0(FrameMsg_ClearActiveFindMatch)
-
 // This message notifies the frame that the user has closed the find-in-page
 // window (and what action to take regarding the selection).
 IPC_MESSAGE_ROUTED1(FrameMsg_StopFinding, content::StopFindAction /* action */)
@@ -1171,6 +1153,12 @@ IPC_MESSAGE_ROUTED2(FrameMsg_ScrollRectToVisible,
                     gfx::Rect /* rect_to_scroll */,
                     blink::WebScrollIntoViewParams /* properties */)
 
+// Sent to the parent process of a cross-process frame to continue bubbling
+// a logical scroll.
+IPC_MESSAGE_ROUTED2(FrameMsg_BubbleLogicalScroll,
+                    blink::WebScrollDirection /* direction */,
+                    blink::WebScrollGranularity /* granularity */)
+
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
@@ -1497,10 +1485,10 @@ IPC_MESSAGE_ROUTED3(FrameHostMsg_BeforeUnload_ACK,
 // Indicates that the current frame has swapped out, after a SwapOut message.
 IPC_MESSAGE_ROUTED0(FrameHostMsg_SwapOut_ACK)
 
-// Tells the browser that a child's resize parameters have changed.
-IPC_MESSAGE_ROUTED2(FrameHostMsg_UpdateResizeParams,
+// Tells the browser that a child's visual properties have changed.
+IPC_MESSAGE_ROUTED2(FrameHostMsg_SynchronizeVisualProperties,
                     viz::SurfaceId /* surface_id */,
-                    content::FrameResizeParams)
+                    content::FrameVisualProperties)
 
 // Sent by a parent frame to update its child's viewport intersection rect for
 // use by the IntersectionObserver API.
@@ -1516,6 +1504,10 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_VisibilityChanged, bool /* visible */)
 // Sets or unsets the inert bit on a remote frame.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_SetIsInert, bool /* inert */)
 
+// Sets the inherited effective touch action on a remote frame.
+IPC_MESSAGE_ROUTED1(FrameHostMsg_SetInheritedEffectiveTouchAction,
+                    cc::TouchAction)
+
 // Toggles render throttling on a remote frame. |is_throttled| indicates
 // whether the current frame should be throttled based on its viewport
 // visibility, and |subtree_throttled| indicates that an ancestor frame has
@@ -1622,7 +1614,11 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_VisualStateResponse, uint64_t /* id */)
 
 // Puts the browser into "tab fullscreen" mode for the sending renderer.
 // See the comment in chrome/browser/ui/browser.h for more details.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_ToggleFullscreen, bool /* enter_fullscreen */)
+IPC_MESSAGE_ROUTED1(FrameHostMsg_EnterFullscreen, blink::WebFullscreenOptions)
+
+// Exits the browser from "tab fullscreen" mode for the sending renderer.
+// See the comment in chrome/browser/ui/browser.h for more details.
+IPC_MESSAGE_ROUTED0(FrameHostMsg_ExitFullscreen)
 
 // Sent when a new sudden termination disabler condition is either introduced or
 // removed.
@@ -1735,8 +1731,7 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_UpdateFaviconURL,
 
 // A message from HTML-based UI.  When (trusted) Javascript calls
 // send(message, args), this message is sent to the browser.
-IPC_MESSAGE_ROUTED3(FrameHostMsg_WebUISend,
-                    GURL /* source_url */,
+IPC_MESSAGE_ROUTED2(FrameHostMsg_WebUISend,
                     std::string /* message */,
                     base::ListValue /* args */)
 
@@ -1745,6 +1740,12 @@ IPC_MESSAGE_ROUTED2(FrameHostMsg_ScrollRectToVisibleInParentFrame,
                     gfx::Rect /* rect_to_scroll */,
                     blink::WebScrollIntoViewParams /* properties */)
 
+// Sent by a local root to continue bubbling a logical scroll in its parent
+// process.
+IPC_MESSAGE_ROUTED2(FrameHostMsg_BubbleLogicalScrollInParentFrame,
+                    blink::WebScrollDirection /* direction */,
+                    blink::WebScrollGranularity /* granularity */)
+
 // Sent to notify that a frame called |window.focus()|.
 IPC_MESSAGE_ROUTED0(FrameHostMsg_FrameDidCallFocus)
 
@@ -1767,34 +1768,6 @@ IPC_MESSAGE_ROUTED0(FrameHostMsg_HidePopup)
 
 #endif
 
-#if defined(OS_ANDROID)
-// Response to FrameMsg_FindMatchRects.
-//
-// |version| will contain the current version number of the renderer's find
-// match list (incremented whenever they change), which should be passed in the
-// next call to FrameMsg_FindMatchRects.
-//
-// |rects| will either contain a list of the enclosing rects of all matches
-// found by the most recent Find operation, or will be empty if |version| is not
-// greater than the |current_version| passed to FrameMsg_FindMatchRects (hence
-// your locally cached rects should still be valid). The rect coords will be
-// custom normalized fractions of the document size. The rects will be sorted by
-// frame traversal order starting in the main frame, then by dom order.
-//
-// |active_rect| will contain the bounding box of the active find-in-page match
-// marker, in similarly normalized coords (or an empty rect if there isn't one).
-IPC_MESSAGE_ROUTED3(FrameHostMsg_FindMatchRects_Reply,
-                    int /* version */,
-                    std::vector<gfx::RectF> /* rects */,
-                    gfx::RectF /* active_rect */)
-
-// Response to FrameMsg_GetNearestFindResult. |distance| is the distance to the
-// nearest find result in the sending frame.
-IPC_MESSAGE_ROUTED2(FrameHostMsg_GetNearestFindResult_Reply,
-                    int /* nfr_request_id */,
-                    float /* distance */)
-#endif
-
 // Adding a new message? Stick to the sort order above: first platform
 // independent FrameMsg, then ifdefs for platform specific FrameMsg, then
 // platform independent FrameHostMsg, then ifdefs for platform specific
diff --git a/chromium/content/common/frame_resize_params.cc b/chromium/content/common/frame_resize_params.cc
deleted file mode 100644
index fc5059d0fc6..00000000000
--- a/chromium/content/common/frame_resize_params.cc
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/frame_resize_params.h"
-
-namespace content {
-
-FrameResizeParams::FrameResizeParams()
-    : auto_resize_enabled(false), auto_resize_sequence_number(0u) {}
-
-FrameResizeParams::FrameResizeParams(const FrameResizeParams& other) = default;
-
-FrameResizeParams::~FrameResizeParams() {}
-
-FrameResizeParams& FrameResizeParams::operator=(
-    const FrameResizeParams& other) = default;
-
-}  // namespace content
diff --git a/chromium/content/common/frame_sink_provider.mojom b/chromium/content/common/frame_sink_provider.mojom
index ad84346d80b..003f761e458 100644
--- a/chromium/content/common/frame_sink_provider.mojom
+++ b/chromium/content/common/frame_sink_provider.mojom
@@ -1,3 +1,7 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
 module content.mojom;
 
 import "content/common/render_frame_metadata.mojom";
@@ -11,7 +15,10 @@ interface FrameSinkProvider {
   CreateForWidget(
       int32 widget_id,
       viz.mojom.CompositorFrameSink& compositor_frame_sink_request,
-      viz.mojom.CompositorFrameSinkClient compositor_frame_sink_client,
+      viz.mojom.CompositorFrameSinkClient compositor_frame_sink_client);
+
+   RegisterRenderFrameMetadataObserver(
+      int32  widget_id,
       RenderFrameMetadataObserverClient&
         render_frame_metadata_observer_client_request,
       RenderFrameMetadataObserver render_frame_metadata_observer);
diff --git a/chromium/content/common/frame_visual_properties.cc b/chromium/content/common/frame_visual_properties.cc
new file mode 100644
index 00000000000..1f1d4f1dbed
--- /dev/null
+++ b/chromium/content/common/frame_visual_properties.cc
@@ -0,0 +1,19 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/frame_visual_properties.h"
+
+namespace content {
+
+FrameVisualProperties::FrameVisualProperties() = default;
+
+FrameVisualProperties::FrameVisualProperties(
+    const FrameVisualProperties& other) = default;
+
+FrameVisualProperties::~FrameVisualProperties() = default;
+
+FrameVisualProperties& FrameVisualProperties::operator=(
+    const FrameVisualProperties& other) = default;
+
+}  // namespace content
diff --git a/chromium/content/common/frame_resize_params.h b/chromium/content/common/frame_visual_properties.h
index 425590722c0..6dc8da06d92 100644
--- a/chromium/content/common/frame_resize_params.h
+++ b/chromium/content/common/frame_visual_properties.h
@@ -2,29 +2,28 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_FRAME_RESIZE_PARAMS_H_
-#define CONTENT_COMMON_FRAME_RESIZE_PARAMS_H_
+#ifndef CONTENT_COMMON_FRAME_VISUAL_PROPERTIES_H_
+#define CONTENT_COMMON_FRAME_VISUAL_PROPERTIES_H_
 
 #include "content/common/content_export.h"
 #include "content/public/common/screen_info.h"
-#include "third_party/blink/public/platform/web_display_mode.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace content {
 
 // TODO(fsamuel): We might want to unify this with content::ResizeParams.
-struct CONTENT_EXPORT FrameResizeParams {
-  FrameResizeParams();
-  FrameResizeParams(const FrameResizeParams& other);
-  ~FrameResizeParams();
+struct CONTENT_EXPORT FrameVisualProperties {
+  FrameVisualProperties();
+  FrameVisualProperties(const FrameVisualProperties& other);
+  ~FrameVisualProperties();
 
-  FrameResizeParams& operator=(const FrameResizeParams& other);
+  FrameVisualProperties& operator=(const FrameVisualProperties& other);
 
   // Information about the screen (dpi, depth, etc..).
   ScreenInfo screen_info;
 
   // Whether or not blink should be in auto-resize mode.
-  bool auto_resize_enabled;
+  bool auto_resize_enabled = false;
 
   // The minimum size for Blink if auto-resize is enabled.
   gfx::Size min_size_for_auto_resize;
@@ -32,16 +31,13 @@ struct CONTENT_EXPORT FrameResizeParams {
   // The maximum size for Blink if auto-resize is enabled.
   gfx::Size max_size_for_auto_resize;
 
-  // This variable is increased after each auto-resize. If the
-  // renderer receives a ResizeParams with stale auto_resize_seqence_number,
-  // then the resize request is dropped.
-  uint64_t auto_resize_sequence_number;
-
   gfx::Rect screen_space_rect;
 
   gfx::Size local_frame_size;
+
+  uint32_t capture_sequence_number = 0u;
 };
 
 }  // namespace content
 
-#endif  // CONTENT_COMMON_FRAME_RESIZE_PARAMS_H_
+#endif  // CONTENT_COMMON_FRAME_VISUAL_PROPERTIES_H_
diff --git a/chromium/content/common/input/event_with_latency_info.h b/chromium/content/common/input/event_with_latency_info.h
index 7dc0e8113ce..0b97bdd35ad 100644
--- a/chromium/content/common/input/event_with_latency_info.h
+++ b/chromium/content/common/input/event_with_latency_info.h
@@ -30,9 +30,9 @@ class EventWithLatencyInfo {
 
   EventWithLatencyInfo(blink::WebInputEvent::Type type,
                        int modifiers,
-                       double timeStampSeconds,
+                       base::TimeTicks time_stamp,
                        const ui::LatencyInfo& l)
-      : event(type, modifiers, timeStampSeconds), latency(l) {}
+      : event(type, modifiers, time_stamp), latency(l) {}
 
   EventWithLatencyInfo() {}
 
@@ -54,9 +54,9 @@ class EventWithLatencyInfo {
 
     // New events get coalesced into older events, and the newer timestamp
     // should always be preserved.
-    const double time_stamp_seconds = other.event.TimeStampSeconds();
+    const base::TimeTicks time_stamp = other.event.TimeStamp();
     ui::Coalesce(other.event, &event);
-    event.SetTimeStampSeconds(time_stamp_seconds);
+    event.SetTimeStamp(time_stamp);
 
     // When coalescing two input events, we keep the oldest LatencyInfo
     // for Telemetry latency tests, since it will represent the longest
diff --git a/chromium/content/common/input/event_with_latency_info_unittest.cc b/chromium/content/common/input/event_with_latency_info_unittest.cc
index 640e42e71fd..2c135593a3e 100644
--- a/chromium/content/common/input/event_with_latency_info_unittest.cc
+++ b/chromium/content/common/input/event_with_latency_info_unittest.cc
@@ -25,16 +25,20 @@ using EventWithLatencyInfoTest = testing::Test;
 TouchEventWithLatencyInfo CreateTouchEvent(WebInputEvent::Type type,
                                            double timestamp,
                                            unsigned touch_count = 1) {
-  TouchEventWithLatencyInfo touch(type, WebInputEvent::kNoModifiers, timestamp,
-                                  ui::LatencyInfo());
+  TouchEventWithLatencyInfo touch(
+      type, WebInputEvent::kNoModifiers,
+      base::TimeTicks() + base::TimeDelta::FromSecondsD(timestamp),
+      ui::LatencyInfo());
   touch.event.touches_length = touch_count;
   return touch;
 }
 
 MouseEventWithLatencyInfo CreateMouseEvent(WebInputEvent::Type type,
                                            double timestamp) {
-  return MouseEventWithLatencyInfo(type, WebInputEvent::kNoModifiers, timestamp,
-                                   ui::LatencyInfo());
+  return MouseEventWithLatencyInfo(
+      type, WebInputEvent::kNoModifiers,
+      base::TimeTicks() + base::TimeDelta::FromSecondsD(timestamp),
+      ui::LatencyInfo());
 }
 
 MouseWheelEventWithLatencyInfo CreateMouseWheelEvent(
@@ -43,7 +47,9 @@ MouseWheelEventWithLatencyInfo CreateMouseWheelEvent(
     float deltaY = 0.0f,
     int modifiers = WebInputEvent::kNoModifiers) {
   MouseWheelEventWithLatencyInfo mouse_wheel(
-      WebInputEvent::kMouseWheel, modifiers, timestamp, ui::LatencyInfo());
+      WebInputEvent::kMouseWheel, modifiers,
+      base::TimeTicks() + base::TimeDelta::FromSecondsD(timestamp),
+      ui::LatencyInfo());
   mouse_wheel.event.delta_x = deltaX;
   mouse_wheel.event.delta_y = deltaY;
   return mouse_wheel;
@@ -53,8 +59,10 @@ GestureEventWithLatencyInfo CreateGestureEvent(WebInputEvent::Type type,
                                                double timestamp,
                                                float x = 0.0f,
                                                float y = 0.0f) {
-  GestureEventWithLatencyInfo gesture(type, WebInputEvent::kNoModifiers,
-                                      timestamp, ui::LatencyInfo());
+  GestureEventWithLatencyInfo gesture(
+      type, WebInputEvent::kNoModifiers,
+      base::TimeTicks() + base::TimeDelta::FromSecondsD(timestamp),
+      ui::LatencyInfo());
   gesture.event.SetPositionInWidget(gfx::PointF(x, y));
   return gesture;
 }
@@ -68,7 +76,7 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForMouseEvent) {
   ASSERT_TRUE(mouse_0.CanCoalesceWith(mouse_1));
   mouse_0.CoalesceWith(mouse_1);
   // Coalescing WebMouseEvent preserves newer timestamp.
-  EXPECT_EQ(10.0, mouse_0.event.TimeStampSeconds());
+  EXPECT_EQ(10.0, mouse_0.event.TimeStamp().since_origin().InSecondsF());
 }
 
 TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForMouseWheelEvent) {
@@ -78,7 +86,7 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForMouseWheelEvent) {
   ASSERT_TRUE(mouse_wheel_0.CanCoalesceWith(mouse_wheel_1));
   mouse_wheel_0.CoalesceWith(mouse_wheel_1);
   // Coalescing WebMouseWheelEvent preserves newer timestamp.
-  EXPECT_EQ(10.0, mouse_wheel_0.event.TimeStampSeconds());
+  EXPECT_EQ(10.0, mouse_wheel_0.event.TimeStamp().since_origin().InSecondsF());
 }
 
 TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForTouchEvent) {
@@ -90,7 +98,7 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForTouchEvent) {
   ASSERT_TRUE(touch_0.CanCoalesceWith(touch_1));
   touch_0.CoalesceWith(touch_1);
   // Coalescing WebTouchEvent preserves newer timestamp.
-  EXPECT_EQ(10.0, touch_0.event.TimeStampSeconds());
+  EXPECT_EQ(10.0, touch_0.event.TimeStamp().since_origin().InSecondsF());
 }
 
 TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForGestureEvent) {
@@ -102,14 +110,14 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForGestureEvent) {
   ASSERT_TRUE(scroll_0.CanCoalesceWith(scroll_1));
   scroll_0.CoalesceWith(scroll_1);
   // Coalescing WebGestureEvent preserves newer timestamp.
-  EXPECT_EQ(10.0, scroll_0.event.TimeStampSeconds());
+  EXPECT_EQ(10.0, scroll_0.event.TimeStamp().since_origin().InSecondsF());
 }
 
 TEST_F(EventWithLatencyInfoTest, LatencyInfoCoalescing) {
   MouseEventWithLatencyInfo mouse_0 =
       CreateMouseEvent(WebInputEvent::kMouseMove, 5.0);
   mouse_0.latency.AddLatencyNumberWithTimestamp(
-      ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, 0, 0, base::TimeTicks(), 1);
+      ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, 0, base::TimeTicks(), 1);
   MouseEventWithLatencyInfo mouse_1 =
       CreateMouseEvent(WebInputEvent::kMouseMove, 10.0);
 
@@ -360,7 +368,7 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescing) {
 
   EXPECT_TRUE(CanCoalesce(mouse_wheel_0, mouse_wheel_1));
   Coalesce(mouse_wheel_1, &mouse_wheel_0);
-  EXPECT_EQ(10.0, mouse_wheel_0.event.TimeStampSeconds());
+  EXPECT_EQ(10.0, mouse_wheel_0.event.TimeStamp().since_origin().InSecondsF());
 }
 
 }  // namespace
diff --git a/chromium/content/common/input/input_event_struct_traits.cc b/chromium/content/common/input/input_event_struct_traits.cc
index c1e18caff8c..afa97f2064f 100644
--- a/chromium/content/common/input/input_event_struct_traits.cc
+++ b/chromium/content/common/input/input_event_struct_traits.cc
@@ -6,6 +6,7 @@
 
 #include "base/i18n/char_iterator.h"
 #include "content/common/input_messages.h"
+#include "mojo/public/cpp/base/time_mojom_traits.h"
 #include "third_party/blink/public/platform/web_keyboard_event.h"
 #include "ui/latency/mojo/latency_info_struct_traits.h"
 
@@ -88,13 +89,17 @@ bool StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::Read(
   if (!event.ReadType(&type))
     return false;
 
+  base::TimeTicks timestamp;
+  if (!event.ReadTimestamp(&timestamp))
+    return false;
+
   if (blink::WebInputEvent::IsKeyboardEventType(type)) {
     content::mojom::KeyDataPtr key_data;
     if (!event.ReadKeyData<content::mojom::KeyDataPtr>(&key_data))
       return false;
 
-    (*out)->web_event.reset(new blink::WebKeyboardEvent(
-        type, event.modifiers(), event.timestamp_seconds()));
+    (*out)->web_event.reset(
+        new blink::WebKeyboardEvent(type, event.modifiers(), timestamp));
 
     blink::WebKeyboardEvent* key_event =
         static_cast<blink::WebKeyboardEvent*>((*out)->web_event.get());
@@ -111,8 +116,7 @@ bool StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::Read(
     if (!event.ReadGestureData<content::mojom::GestureDataPtr>(&gesture_data))
       return false;
     (*out)->web_event.reset(new blink::WebGestureEvent(
-        type, event.modifiers(), event.timestamp_seconds(),
-        gesture_data->source_device));
+        type, event.modifiers(), timestamp, gesture_data->source_device));
 
     blink::WebGestureEvent* gesture_event =
         static_cast<blink::WebGestureEvent*>((*out)->web_event.get());
@@ -258,8 +262,8 @@ bool StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::Read(
     if (!event.ReadTouchData<content::mojom::TouchDataPtr>(&touch_data))
       return false;
 
-    (*out)->web_event.reset(new blink::WebTouchEvent(
-        type, event.modifiers(), event.timestamp_seconds()));
+    (*out)->web_event.reset(
+        new blink::WebTouchEvent(type, event.modifiers(), timestamp));
 
     blink::WebTouchEvent* touch_event =
         static_cast<blink::WebTouchEvent*>((*out)->web_event.get());
@@ -287,11 +291,11 @@ bool StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::Read(
       return false;
 
     if (blink::WebInputEvent::IsMouseEventType(type)) {
-      (*out)->web_event.reset(new blink::WebMouseEvent(
-          type, event.modifiers(), event.timestamp_seconds()));
+      (*out)->web_event.reset(
+          new blink::WebMouseEvent(type, event.modifiers(), timestamp));
     } else {
-      (*out)->web_event.reset(new blink::WebMouseWheelEvent(
-          type, event.modifiers(), event.timestamp_seconds()));
+      (*out)->web_event.reset(
+          new blink::WebMouseWheelEvent(type, event.modifiers(), timestamp));
     }
 
     blink::WebMouseEvent* mouse_event =
diff --git a/chromium/content/common/input/input_event_struct_traits.h b/chromium/content/common/input/input_event_struct_traits.h
index d63ca68bea7..ca8ea062713 100644
--- a/chromium/content/common/input/input_event_struct_traits.h
+++ b/chromium/content/common/input/input_event_struct_traits.h
@@ -25,8 +25,8 @@ struct StructTraits<content::mojom::EventDataView, InputEventUniquePtr> {
     return event->web_event->GetModifiers();
   }
 
-  static double timestamp_seconds(const InputEventUniquePtr& event) {
-    return event->web_event->TimeStampSeconds();
+  static base::TimeTicks timestamp(const InputEventUniquePtr& event) {
+    return event->web_event->TimeStamp();
   }
 
   static const ui::LatencyInfo& latency(const InputEventUniquePtr& event) {
diff --git a/chromium/content/common/input/input_handler.mojom b/chromium/content/common/input/input_handler.mojom
index b5725e1dbf9..9f8a63e8b72 100644
--- a/chromium/content/common/input/input_handler.mojom
+++ b/chromium/content/common/input/input_handler.mojom
@@ -7,6 +7,7 @@ module content.mojom;
 import "content/common/input/synchronous_compositor.mojom";
 import "content/common/native_types.mojom";
 import "mojo/public/mojom/base/string16.mojom";
+import "mojo/public/mojom/base/time.mojom";
 import "services/ui/public/interfaces/ime/ime.mojom";
 import "third_party/blink/public/web/selection_menu_behavior.mojom";
 import "ui/events/mojo/event.mojom";
@@ -139,7 +140,7 @@ struct TouchData {
 struct Event {
   EventType type;
   int32 modifiers;
-  double timestamp_seconds;
+  mojo_base.mojom.TimeTicks timestamp;
   ui.mojom.LatencyInfo latency;
   KeyData? key_data;
   PointerData? pointer_data;
@@ -187,6 +188,13 @@ interface WidgetInputHandlerHost {
   // to always have correct bound info.
   ImeCompositionRangeChanged(gfx.mojom.Range range,
                              array<gfx.mojom.Rect> bounds);
+
+  // Updates the mouse capture state of this widget. While capture is enabled,
+  // all mouse events, including those that don't hittest to this widget, will
+  // be targeted to this widget. This enables Blink to behave correctly when
+  // a scrollbar is being dragged, or text is being drag-highlighted, even
+  // when the mouse passes across different RenderWidget areas.
+  SetMouseCapture(bool capture);
 };
 
 // Interface exposed by the renderer to the browser. This class represents
@@ -234,7 +242,7 @@ interface WidgetInputHandler {
   RequestTextInputStateUpdate();
 
   // Request from browser to update the cursor and composition information which
-  // will be sent through InputHostMsg_ImeCompositionRangeChanged. Setting
+  // will be sent through ImeCompositionRangeChanged. Setting
   // |immediate_request| to true  will lead to an immediate update. If
   // |monitor_updates| is set to true then changes to text selection or regular
   // updates in each compositor frame (when there is a change in composition
diff --git a/chromium/content/common/input/input_param_traits_unittest.cc b/chromium/content/common/input/input_param_traits_unittest.cc
deleted file mode 100644
index 81d1d69cd85..00000000000
--- a/chromium/content/common/input/input_param_traits_unittest.cc
+++ /dev/null
@@ -1,121 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/input/input_param_traits.h"
-
-#include <stddef.h>
-
-#include <memory>
-#include <utility>
-#include <vector>
-
-#include "content/common/input/input_event.h"
-#include "content/common/input_messages.h"
-#include "ipc/ipc_message.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/web_gesture_event.h"
-#include "third_party/blink/public/platform/web_input_event.h"
-#include "third_party/blink/public/platform/web_keyboard_event.h"
-#include "third_party/blink/public/platform/web_mouse_wheel_event.h"
-#include "third_party/blink/public/platform/web_touch_event.h"
-
-namespace content {
-namespace {
-
-typedef std::vector<std::unique_ptr<InputEvent>> InputEvents;
-
-class InputParamTraitsTest : public testing::Test {
- protected:
-  static void Compare(const InputEvent* a, const InputEvent* b) {
-    EXPECT_EQ(!!a->web_event, !!b->web_event);
-    if (a->web_event && b->web_event) {
-      const size_t a_size = a->web_event->size();
-      ASSERT_EQ(a_size, b->web_event->size());
-      EXPECT_EQ(0, memcmp(a->web_event.get(), b->web_event.get(), a_size));
-    }
-    EXPECT_EQ(a->latency_info.latency_components().size(),
-              b->latency_info.latency_components().size());
-  }
-
-  static void Compare(const InputEvents* a, const InputEvents* b) {
-    for (size_t i = 0; i < a->size(); ++i)
-      Compare((*a)[i].get(), (*b)[i].get());
-  }
-
-  static void Verify(const InputEvents& events_in) {
-    IPC::Message msg;
-    IPC::ParamTraits<InputEvents>::Write(&msg, events_in);
-
-    InputEvents events_out;
-    base::PickleIterator iter(msg);
-    EXPECT_TRUE(IPC::ParamTraits<InputEvents>::Read(&msg, &iter, &events_out));
-
-    Compare(&events_in, &events_out);
-
-    // Perform a sanity check that logging doesn't explode.
-    std::string events_in_string;
-    IPC::ParamTraits<InputEvents>::Log(events_in, &events_in_string);
-    std::string events_out_string;
-    IPC::ParamTraits<InputEvents>::Log(events_out, &events_out_string);
-    ASSERT_FALSE(events_in_string.empty());
-    EXPECT_EQ(events_in_string, events_out_string);
-  }
-};
-
-TEST_F(InputParamTraitsTest, UninitializedEvents) {
-  InputEvent event;
-
-  IPC::Message msg;
-  IPC::WriteParam(&msg, event);
-
-  InputEvent event_out;
-  base::PickleIterator iter(msg);
-  EXPECT_FALSE(IPC::ReadParam(&msg, &iter, &event_out));
-}
-
-TEST_F(InputParamTraitsTest, InitializedEvents) {
-  InputEvents events;
-
-  ui::LatencyInfo latency;
-  latency.set_trace_id(5);
-
-  blink::WebKeyboardEvent key_event(
-      blink::WebInputEvent::kRawKeyDown, blink::WebInputEvent::kNoModifiers,
-      blink::WebInputEvent::GetStaticTimeStampForTests());
-  key_event.native_key_code = 5;
-  events.push_back(std::make_unique<InputEvent>(key_event, latency));
-
-  blink::WebMouseWheelEvent wheel_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
-      blink::WebInputEvent::GetStaticTimeStampForTests());
-  wheel_event.delta_x = 10;
-  latency.AddLatencyNumber(ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, 1, 1);
-  events.push_back(std::make_unique<InputEvent>(wheel_event, latency));
-
-  blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
-      blink::WebInputEvent::GetStaticTimeStampForTests());
-  mouse_event.SetPositionInWidget(10, 0);
-  latency.AddLatencyNumber(ui::INPUT_EVENT_LATENCY_UI_COMPONENT, 2, 2);
-  events.push_back(std::make_unique<InputEvent>(mouse_event, latency));
-
-  blink::WebGestureEvent gesture_event(
-      blink::WebInputEvent::kGestureScrollBegin,
-      blink::WebInputEvent::kNoModifiers,
-      blink::WebInputEvent::GetStaticTimeStampForTests());
-  gesture_event.SetPositionInWidget(gfx::PointF(-1, 0));
-  events.push_back(std::make_unique<InputEvent>(gesture_event, latency));
-
-  blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
-      blink::WebInputEvent::GetStaticTimeStampForTests());
-  touch_event.touches_length = 1;
-  touch_event.touches[0].radius_x = 1;
-  events.push_back(std::make_unique<InputEvent>(touch_event, latency));
-
-  Verify(events);
-}
-
-}  // namespace
-}  // namespace content
diff --git a/chromium/content/common/input/sync_compositor_messages.h b/chromium/content/common/input/sync_compositor_messages.h
index fcfd89e58d0..a608f7eb160 100644
--- a/chromium/content/common/input/sync_compositor_messages.h
+++ b/chromium/content/common/input/sync_compositor_messages.h
@@ -8,14 +8,9 @@
 #include <stddef.h>
 
 #include "base/memory/shared_memory_handle.h"
-#include "base/optional.h"
-#include "components/viz/common/frame_sinks/begin_frame_args.h"
-#include "components/viz/common/quads/compositor_frame.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "ipc/ipc_message_macros.h"
-#include "third_party/blink/public/platform/web_input_event.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/scroll_offset.h"
 
@@ -80,10 +75,6 @@ struct SyncCompositorCommonRendererParams {
 
 #endif  // INTERNAL_CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
 
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-#define IPC_MESSAGE_START SyncCompositorMsgStart
-
 IPC_STRUCT_TRAITS_BEGIN(content::SyncCompositorDemandDrawHwParams)
   IPC_STRUCT_TRAITS_MEMBER(viewport_size)
   IPC_STRUCT_TRAITS_MEMBER(viewport_rect_for_tile_priority)
@@ -114,77 +105,4 @@ IPC_STRUCT_TRAITS_BEGIN(content::SyncCompositorCommonRendererParams)
   IPC_STRUCT_TRAITS_MEMBER(did_activate_pending_tree_count)
 IPC_STRUCT_TRAITS_END()
 
-// Messages sent from the browser to the renderer.
-// Synchronous IPCs are allowed here to the renderer compositor thread. See
-// design doc https://goo.gl/Tn81FW and https://crbug.com/526842 for details.
-
-IPC_MESSAGE_ROUTED1(SyncCompositorMsg_ComputeScroll, base::TimeTicks)
-
-IPC_MESSAGE_ROUTED1(SyncCompositorMsg_DemandDrawHwAsync,
-                    content::SyncCompositorDemandDrawHwParams)
-
-IPC_SYNC_MESSAGE_ROUTED1_4(SyncCompositorMsg_DemandDrawHw,
-                           content::SyncCompositorDemandDrawHwParams,
-                           content::SyncCompositorCommonRendererParams,
-                           uint32_t /* layer_tree_frame_sink_id */,
-                           uint32_t /* metadata_version */,
-                           base::Optional<viz::CompositorFrame>)
-
-IPC_SYNC_MESSAGE_ROUTED1_2(SyncCompositorMsg_SetSharedMemory,
-                           content::SyncCompositorSetSharedMemoryParams,
-                           bool /* success */,
-                           content::SyncCompositorCommonRendererParams)
-
-IPC_MESSAGE_ROUTED0(SyncCompositorMsg_ZeroSharedMemory)
-
-IPC_SYNC_MESSAGE_ROUTED1_3(SyncCompositorMsg_DemandDrawSw,
-                           content::SyncCompositorDemandDrawSwParams,
-                           content::SyncCompositorCommonRendererParams,
-                           uint32_t /* metadata_version */,
-                           base::Optional<viz::CompositorFrameMetadata>)
-
-IPC_SYNC_MESSAGE_ROUTED2_1(SyncCompositorMsg_ZoomBy,
-                           float /* delta */,
-                           gfx::Point /* anchor */,
-                           content::SyncCompositorCommonRendererParams)
-
-IPC_MESSAGE_ROUTED1(SyncCompositorMsg_SetMemoryPolicy,
-                    uint32_t /* bytes_limit */)
-
-IPC_MESSAGE_ROUTED2(SyncCompositorMsg_ReclaimResources,
-                    uint32_t /* layer_tree_frame_sink_id */,
-                    std::vector<viz::ReturnedResource> /* resources */)
-
-IPC_MESSAGE_ROUTED1(SyncCompositorMsg_SetScroll, gfx::ScrollOffset)
-
-// Let renderer know begin frame messages won't be sent even if requested.
-IPC_MESSAGE_ROUTED1(SyncCompositorMsg_SetBeginFramePaused, bool /* paused */)
-
-// Sent by the browser when the renderer should generate a new frame.
-IPC_MESSAGE_ROUTED1(SyncCompositorMsg_BeginFrame,
-                    viz::BeginFrameArgs /* args */)
-
-// -----------------------------------------------------------------------------
-// Messages sent from the renderer to the browser.
-
-IPC_MESSAGE_ROUTED0(SyncCompositorHostMsg_LayerTreeFrameSinkCreated)
-
-IPC_MESSAGE_ROUTED1(SyncCompositorHostMsg_UpdateState,
-                    content::SyncCompositorCommonRendererParams)
-
-// Response to a begin frame request.
-IPC_MESSAGE_ROUTED1(SyncCompositorHostMsg_BeginFrameResponse,
-                    content::SyncCompositorCommonRendererParams)
-
-IPC_MESSAGE_ROUTED3(SyncCompositorHostMsg_ReturnFrame,
-                    uint32_t /* layer_tree_frame_sink_id */,
-                    uint32_t /* metadata_version */,
-                    base::Optional<viz::CompositorFrame>)
-
-// Sent by renderer to request a SyncCompositorMsg_BeginFrame message for
-// upcoming display events. If |enabled| is true, the BeginFrame message will
-// continue to be be delivered until the notification is disabled.
-IPC_MESSAGE_ROUTED1(SyncCompositorHostMsg_SetNeedsBeginFrames,
-                    bool /* enabled */)
-
 #endif  // CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
diff --git a/chromium/content/common/input/synchronous_compositor.typemap b/chromium/content/common/input/synchronous_compositor.typemap
index 6adbf1659d1..cb07fb33228 100644
--- a/chromium/content/common/input/synchronous_compositor.typemap
+++ b/chromium/content/common/input/synchronous_compositor.typemap
@@ -6,7 +6,6 @@ mojom = "//content/common/input/synchronous_compositor.mojom"
 public_headers = [ "//content/common/input/sync_compositor_messages.h" ]
 traits_headers = [ "//content/common/input/sync_compositor_messages.h" ]
 deps = [
-  "//cc/ipc",
   "//ui/gfx/ipc",
 ]
 type_mappings = [
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders.cc b/chromium/content/common/input/synthetic_web_input_event_builders.cc
index 617d0ea12b5..5cf6591d784 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders.cc
+++ b/chromium/content/common/input/synthetic_web_input_event_builders.cc
@@ -23,7 +23,7 @@ using blink::WebTouchPoint;
 WebMouseEvent SyntheticWebMouseEventBuilder::Build(
     blink::WebInputEvent::Type type) {
   return WebMouseEvent(type, WebInputEvent::kNoModifiers,
-                       ui::EventTimeStampToSeconds(ui::EventTimeForNow()));
+                       ui::EventTimeForNow());
 }
 
 WebMouseEvent SyntheticWebMouseEventBuilder::Build(
@@ -33,9 +33,9 @@ WebMouseEvent SyntheticWebMouseEventBuilder::Build(
     int modifiers,
     blink::WebPointerProperties::PointerType pointer_type) {
   DCHECK(WebInputEvent::IsMouseEventType(type));
-  WebMouseEvent result(type, modifiers,
-                       ui::EventTimeStampToSeconds(ui::EventTimeForNow()));
+  WebMouseEvent result(type, modifiers, ui::EventTimeForNow());
   result.SetPositionInWidget(window_x, window_y);
+  result.SetPositionInScreen(window_x, window_y);
   result.SetModifiers(modifiers);
   result.pointer_type = pointer_type;
   result.id = ui::MouseEvent::kMousePointerId;
@@ -45,8 +45,7 @@ WebMouseEvent SyntheticWebMouseEventBuilder::Build(
 WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
     WebMouseWheelEvent::Phase phase) {
   WebMouseWheelEvent result(WebInputEvent::kMouseWheel,
-                            WebInputEvent::kNoModifiers,
-                            ui::EventTimeStampToSeconds(ui::EventTimeForNow()));
+                            WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   result.phase = phase;
   return result;
 }
@@ -69,7 +68,7 @@ WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(float x,
                                                              int modifiers,
                                                              bool precise) {
   WebMouseWheelEvent result(WebInputEvent::kMouseWheel, modifiers,
-                            ui::EventTimeStampToSeconds(ui::EventTimeForNow()));
+                            ui::EventTimeForNow());
   result.SetPositionInScreen(global_x, global_y);
   result.SetPositionInWidget(x, y);
   result.delta_x = dx;
@@ -86,7 +85,7 @@ WebKeyboardEvent SyntheticWebKeyboardEventBuilder::Build(
     WebInputEvent::Type type) {
   DCHECK(WebInputEvent::IsKeyboardEventType(type));
   WebKeyboardEvent result(type, WebInputEvent::kNoModifiers,
-                          ui::EventTimeStampToSeconds(ui::EventTimeForNow()));
+                          ui::EventTimeForNow());
   result.windows_key_code = ui::VKEY_L;  // non-null made up value.
   return result;
 }
@@ -96,9 +95,7 @@ WebGestureEvent SyntheticWebGestureEventBuilder::Build(
     blink::WebGestureDevice source_device,
     int modifiers) {
   DCHECK(WebInputEvent::IsGestureEventType(type));
-  WebGestureEvent result(type, modifiers,
-                         ui::EventTimeStampToSeconds(ui::EventTimeForNow()),
-                         source_device);
+  WebGestureEvent result(type, modifiers, ui::EventTimeForNow(), source_device);
   if (type == WebInputEvent::kGestureTap ||
       type == WebInputEvent::kGestureTapUnconfirmed ||
       type == WebInputEvent::kGestureDoubleTap) {
@@ -202,9 +199,9 @@ int SyntheticWebTouchEvent::PressPoint(float x, float y) {
   point.rotation_angle = 1.f;
   point.force = 1.f;
   point.tilt_x = point.tilt_y = 0;
+  point.pointer_type = blink::WebPointerProperties::PointerType::kTouch;
   ++touches_length;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchStart, TimeStampSeconds(),
-                                 this);
+  WebTouchEventTraits::ResetType(WebInputEvent::kTouchStart, TimeStamp(), this);
   return point.id;
 }
 
@@ -218,8 +215,7 @@ void SyntheticWebTouchEvent::MovePoint(int index, float x, float y) {
   point.SetPositionInWidget(x, y);
   point.SetPositionInScreen(x, y);
   touches[index].state = WebTouchPoint::kStateMoved;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchMove, TimeStampSeconds(),
-                                 this);
+  WebTouchEventTraits::ResetType(WebInputEvent::kTouchMove, TimeStamp(), this);
 }
 
 void SyntheticWebTouchEvent::ReleasePoint(int index) {
@@ -227,20 +223,19 @@ void SyntheticWebTouchEvent::ReleasePoint(int index) {
   CHECK_LT(index, kTouchesLengthCap);
   touches[index].state = WebTouchPoint::kStateReleased;
   touches[index].force = 0.f;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchEnd, TimeStampSeconds(),
-                                 this);
+  WebTouchEventTraits::ResetType(WebInputEvent::kTouchEnd, TimeStamp(), this);
 }
 
 void SyntheticWebTouchEvent::CancelPoint(int index) {
   CHECK_GE(index, 0);
   CHECK_LT(index, kTouchesLengthCap);
   touches[index].state = WebTouchPoint::kStateCancelled;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchCancel,
-                                 TimeStampSeconds(), this);
+  WebTouchEventTraits::ResetType(WebInputEvent::kTouchCancel, TimeStamp(),
+                                 this);
 }
 
 void SyntheticWebTouchEvent::SetTimestamp(base::TimeTicks timestamp) {
-  SetTimeStampSeconds(ui::EventTimeStampToSeconds(timestamp));
+  SetTimeStamp(timestamp);
 }
 
 int SyntheticWebTouchEvent::FirstFreeIndex() {
diff --git a/chromium/content/common/input/touch_action_optional_struct_traits.cc b/chromium/content/common/input/touch_action_optional_struct_traits.cc
index b2b4c33e638..3b57659bb1d 100644
--- a/chromium/content/common/input/touch_action_optional_struct_traits.cc
+++ b/chromium/content/common/input/touch_action_optional_struct_traits.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/touch_action_optional_struct_traits.h"
 
-#include "content/common/input_messages.h"
+#include "content/public/common/common_param_traits_macros.h"
 
 namespace mojo {
 bool StructTraits<
diff --git a/chromium/content/common/input/web_touch_event_traits.cc b/chromium/content/common/input/web_touch_event_traits.cc
index 897d78e5b58..06972d03654 100644
--- a/chromium/content/common/input/web_touch_event_traits.cc
+++ b/chromium/content/common/input/web_touch_event_traits.cc
@@ -50,7 +50,7 @@ bool WebTouchEventTraits::IsTouchSequenceEnd(const WebTouchEvent& event) {
 }
 
 void WebTouchEventTraits::ResetType(WebInputEvent::Type type,
-                                    double timestamp_sec,
+                                    base::TimeTicks timestamp,
                                     WebTouchEvent* event) {
   DCHECK(WebInputEvent::IsTouchEventType(type));
   DCHECK(type != WebInputEvent::kTouchScrollStarted);
@@ -59,13 +59,13 @@ void WebTouchEventTraits::ResetType(WebInputEvent::Type type,
   event->dispatch_type = type == WebInputEvent::kTouchCancel
                              ? WebInputEvent::kEventNonBlocking
                              : WebInputEvent::kBlocking;
-  event->SetTimeStampSeconds(timestamp_sec);
+  event->SetTimeStamp(timestamp);
 }
 
 void WebTouchEventTraits::ResetTypeAndTouchStates(WebInputEvent::Type type,
-                                                  double timestamp_sec,
+                                                  base::TimeTicks timestamp,
                                                   WebTouchEvent* event) {
-  ResetType(type, timestamp_sec, event);
+  ResetType(type, timestamp, event);
 
   WebTouchPoint::State newState = WebTouchPoint::kStateUndefined;
   switch (event->GetType()) {
diff --git a/chromium/content/common/input/web_touch_event_traits.h b/chromium/content/common/input/web_touch_event_traits.h
index eac4718d4ff..ff27930e937 100644
--- a/chromium/content/common/input/web_touch_event_traits.h
+++ b/chromium/content/common/input/web_touch_event_traits.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_COMMON_INPUT_WEB_TOUCH_EVENT_TRAITS_H_
 #define CONTENT_COMMON_INPUT_WEB_TOUCH_EVENT_TRAITS_H_
 
+#include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "third_party/blink/public/platform/web_input_event.h"
 
@@ -32,14 +33,14 @@ class CONTENT_EXPORT WebTouchEventTraits {
   // Sets the type of |event| to |type|, resetting any other type-specific
   // properties and updating the timestamp.
   static void ResetType(blink::WebInputEvent::Type type,
-                        double timestamp_sec,
+                        base::TimeTicks timestamp,
                         blink::WebTouchEvent* event);
 
   // Like ResetType but also resets the state of all active touches
   // to match the event type.  This is particularly useful, for example,
   // in sending a touchcancel for all active touches.
   static void ResetTypeAndTouchStates(blink::WebInputEvent::Type type,
-                                      double timestamp_sec,
+                                      base::TimeTicks timestamp,
                                       blink::WebTouchEvent* event);
 };
 
diff --git a/chromium/content/common/input_messages.h b/chromium/content/common/input_messages.h
index 89df9cc4f40..81f0759d605 100644
--- a/chromium/content/common/input_messages.h
+++ b/chromium/content/common/input_messages.h
@@ -11,7 +11,6 @@
 #include "base/strings/string16.h"
 #include "build/build_config.h"
 #include "cc/input/overscroll_behavior.h"
-#include "cc/input/touch_action.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/edit_command.h"
@@ -66,7 +65,6 @@ IPC_ENUM_TRAITS_MAX_VALUE(
     content::SyntheticPointerActionParams::Button::BUTTON_MAX)
 IPC_ENUM_TRAITS_MAX_VALUE(content::InputEventDispatchType,
                           content::InputEventDispatchType::DISPATCH_TYPE_MAX)
-IPC_ENUM_TRAITS_MAX_VALUE(cc::TouchAction, cc::kTouchActionMax)
 IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebPointerProperties::Button,
                               blink::WebPointerProperties::Button::kNoButton,
                               blink::WebPointerProperties::Button::kLastEntry)
@@ -105,11 +103,6 @@ IPC_STRUCT_TRAITS_BEGIN(content::EditCommand)
   IPC_STRUCT_TRAITS_MEMBER(value)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::InputEvent)
-  IPC_STRUCT_TRAITS_MEMBER(web_event)
-  IPC_STRUCT_TRAITS_MEMBER(latency_info)
-IPC_STRUCT_TRAITS_END()
-
 IPC_STRUCT_TRAITS_BEGIN(content::SyntheticGestureParams)
   IPC_STRUCT_TRAITS_MEMBER(gesture_source_type)
 IPC_STRUCT_TRAITS_END()
@@ -154,229 +147,8 @@ IPC_STRUCT_TRAITS_BEGIN(content::SyntheticPointerActionListParams)
   IPC_STRUCT_TRAITS_MEMBER(params)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::InputEventAck)
-  IPC_STRUCT_TRAITS_MEMBER(source)
-  IPC_STRUCT_TRAITS_MEMBER(type)
-  IPC_STRUCT_TRAITS_MEMBER(state)
-  IPC_STRUCT_TRAITS_MEMBER(latency)
-  IPC_STRUCT_TRAITS_MEMBER(overscroll)
-  IPC_STRUCT_TRAITS_MEMBER(unique_touch_event_id)
-  IPC_STRUCT_TRAITS_MEMBER(touch_action)
-IPC_STRUCT_TRAITS_END()
-
-// Sends an input event to the render widget. The input event in general
-// contains a list of coalesced events and one event that is representative of
-// all those events (https://w3c.github.io/pointerevents/extension.html).
-IPC_MESSAGE_ROUTED4(
-    InputMsg_HandleInputEvent,
-    IPC::WebInputEventPointer /* event */,
-    std::vector<IPC::WebInputEventPointer> /* coalesced events */,
-    ui::LatencyInfo /* latency_info */,
-    content::InputEventDispatchType)
-
-// Sends the cursor visibility state to the render widget.
-IPC_MESSAGE_ROUTED1(InputMsg_CursorVisibilityChange,
-                    bool /* is_visible */)
-
-// Sets the text composition to be between the given start and end offsets in
-// the currently focused editable field.
-IPC_MESSAGE_ROUTED3(InputMsg_SetCompositionFromExistingText,
-                    int /* start */,
-                    int /* end */,
-                    std::vector<blink::WebImeTextSpan> /* ime_text_spans */)
-
-// Deletes the current selection plus the specified number of characters before
-// and after the selection or caret.
-IPC_MESSAGE_ROUTED2(InputMsg_ExtendSelectionAndDelete,
-                    int /* before */,
-                    int /* after */)
-
-// Deletes text before and after the current cursor position, excluding the
-// selection. The lengths are supplied in Java chars (UTF-16 Code Unit), not in
-// code points or in glyphs.
-IPC_MESSAGE_ROUTED2(InputMsg_DeleteSurroundingText,
-                    int /* before */,
-                    int /* after */)
-
-// Deletes text before and after the current cursor position, excluding the
-// selection. The lengths are supplied in code points, not in Java chars (UTF-16
-// Code Unit) or in glyphs. Does nothing if there are one or more invalid
-// surrogate pairs in the requested range
-IPC_MESSAGE_ROUTED2(InputMsg_DeleteSurroundingTextInCodePoints,
-                    int /* before */,
-                    int /* after */)
-
-// Selects between the given start and end offsets in the currently focused
-// editable field.
-IPC_MESSAGE_ROUTED2(InputMsg_SetEditableSelectionOffsets,
-                    int /* start */,
-                    int /* end */)
-
-// This message sends a string being composed with an input method.
-IPC_MESSAGE_ROUTED5(InputMsg_ImeSetComposition,
-                    base::string16,                     /* text */
-                    std::vector<blink::WebImeTextSpan>, /* ime_text_spans */
-                    gfx::Range /* replacement_range */,
-                    int, /* selectiont_start */
-                    int /* selection_end */)
-
-// This message deletes the current composition, inserts specified text, and
-// moves the cursor.
-IPC_MESSAGE_ROUTED4(InputMsg_ImeCommitText,
-                    base::string16 /* text */,
-                    std::vector<blink::WebImeTextSpan>, /* ime_text_spans */
-                    gfx::Range /* replacement_range */,
-                    int /* relative_cursor_pos */)
-
-// This message inserts the ongoing composition.
-IPC_MESSAGE_ROUTED1(InputMsg_ImeFinishComposingText, bool /* keep_selection */)
-
-// This message notifies the renderer that the next key event is bound to one
-// or more pre-defined edit commands. If the next key event is not handled
-// by webkit, the specified edit commands shall be executed against current
-// focused frame.
-// Parameters
-// * edit_commands (see chrome/common/edit_command_types.h)
-//   Contains one or more edit commands.
-// See third_party/WebKit/Source/WebCore/editing/EditorCommand.cpp for detailed
-// definition of webkit edit commands.
-//
-// This message must be sent just before sending a key event.
-IPC_MESSAGE_ROUTED1(InputMsg_SetEditCommandsForNextKeyEvent,
-                    std::vector<content::EditCommand> /* edit_commands */)
-
-// Message payload is the name of a WebCore edit command to execute.
-IPC_MESSAGE_ROUTED1(InputMsg_ExecuteNoValueEditCommand, std::string /* name */)
-
-IPC_MESSAGE_ROUTED0(InputMsg_MouseCaptureLost)
-
-// TODO(darin): figure out how this meshes with RestoreFocus
+// TODO(dtapuska): Remove this as only OOPIF uses this
 IPC_MESSAGE_ROUTED1(InputMsg_SetFocus,
                     bool /* enable */)
 
-// Tells the renderer to scroll the currently focused node into rect only if
-// the currently focused node is a Text node (textfield, text area or content
-// editable divs).
-IPC_MESSAGE_ROUTED1(InputMsg_ScrollFocusedEditableNodeIntoRect, gfx::Rect)
-
-// These messages are typically generated from context menus and request the
-// renderer to apply the specified operation to the current selection.
-IPC_MESSAGE_ROUTED0(InputMsg_Undo)
-IPC_MESSAGE_ROUTED0(InputMsg_Redo)
-IPC_MESSAGE_ROUTED0(InputMsg_Cut)
-IPC_MESSAGE_ROUTED0(InputMsg_Copy)
-#if defined(OS_MACOSX)
-IPC_MESSAGE_ROUTED0(InputMsg_CopyToFindPboard)
-#endif
-IPC_MESSAGE_ROUTED0(InputMsg_Paste)
-IPC_MESSAGE_ROUTED0(InputMsg_PasteAndMatchStyle)
-// Replaces the selected region or a word around the cursor with the
-// specified string.
-IPC_MESSAGE_ROUTED1(InputMsg_Replace,
-                    base::string16)
-// Replaces the misspelling in the selected region with the specified string.
-IPC_MESSAGE_ROUTED1(InputMsg_ReplaceMisspelling,
-                    base::string16)
-IPC_MESSAGE_ROUTED0(InputMsg_Delete)
-IPC_MESSAGE_ROUTED0(InputMsg_SelectAll)
-
-IPC_MESSAGE_ROUTED0(InputMsg_CollapseSelection)
-
-// Requests the renderer to select the region between two points.
-// Expects a SelectRange_ACK message when finished.
-IPC_MESSAGE_ROUTED2(InputMsg_SelectRange,
-                    gfx::Point /* base */,
-                    gfx::Point /* extent */)
-
-// Sent by the browser to ask the renderer to adjust the selection start and
-// end points by the given amounts. A negative amount moves the selection
-// towards the beginning of the document, a positive amount moves the selection
-// towards the end of the document. Will send show selection menu event when
-// needed.
-IPC_MESSAGE_ROUTED3(InputMsg_AdjustSelectionByCharacterOffset,
-                    int /* start_adjust*/,
-                    int /* end_adjust */,
-                    bool /* show_selection_menu */)
-
-// Requests the renderer to move the selection extent point to a new position.
-// Expects a MoveRangeSelectionExtent_ACK message when finished.
-IPC_MESSAGE_ROUTED1(InputMsg_MoveRangeSelectionExtent,
-                    gfx::Point /* extent */)
-
-// Requests the renderer to move the caret selection toward the point.
-// Expects a MoveCaret_ACK message when finished.
-IPC_MESSAGE_ROUTED1(InputMsg_MoveCaret,
-                    gfx::Point /* location */)
-
-#if defined(OS_ANDROID)
-// Request from browser to update text input state.
-IPC_MESSAGE_ROUTED0(InputMsg_RequestTextInputStateUpdate)
-#endif
-
-// Request from browser to update the cursor and composition information which
-// will be sent through InputHostMsg_ImeCompositionRangeChanged. Setting
-// |immediate_request| to true  will lead to an immediate update. If
-// |monitor_updates| is set to true then changes to text selection or regular
-// updates in each compositor frame (when there is a change in composition info)
-// will lead to updates being sent to the browser.
-IPC_MESSAGE_ROUTED2(InputMsg_RequestCompositionUpdates,
-                    bool /* immediate_request */,
-                    bool /* monitor_updates */)
-
-// -----------------------------------------------------------------------------
-// Messages sent from the renderer to the browser.
-
-// Acknowledges receipt of a InputMsg_HandleInputEvent message.
-IPC_MESSAGE_ROUTED1(InputHostMsg_HandleInputEvent_ACK,
-                    content::InputEventAck /* ack */)
-
-// Notifies the allowed touch actions for a new touch point.
-IPC_MESSAGE_ROUTED1(InputHostMsg_SetTouchAction,
-                    cc::TouchAction /* touch_action */)
-
-// The whitelisted touch action and the associated unique touch event id
-// for a new touch point sent by the compositor. The unique touch event id is
-// only needed to verify that the whitelisted touch action is being associated
-// with the correct touch event. The input event ack state is needed when
-// the touchstart message was not sent to the renderer and the touch
-// actions need to be reset and the touch ack timeout needs to be started.
-IPC_MESSAGE_ROUTED3(InputHostMsg_SetWhiteListedTouchAction,
-                    cc::TouchAction /* white_listed_touch_action */,
-                    uint32_t /* unique_touch_event_id */,
-                    content::InputEventAckState /* ack_result */)
-
-// Sent by the compositor when input scroll events are dropped due to bounds
-// restrictions on the root scroll offset.
-IPC_MESSAGE_ROUTED1(InputHostMsg_DidOverscroll,
-                    ui::DidOverscrollParams /* params */)
-
-// Sent by the compositor when a fling animation is stopped.
-IPC_MESSAGE_ROUTED0(InputHostMsg_DidStopFlinging)
-
-// Sent by the compositor when a GSB has started scrolling the viewport.
-IPC_MESSAGE_ROUTED0(InputHostMsg_DidStartScrollingViewport)
-
-// Acknowledges receipt of a InputMsg_MoveCaret message.
-IPC_MESSAGE_ROUTED0(InputHostMsg_MoveCaret_ACK)
-
-// Acknowledges receipt of a InputMsg_MoveRangeSelectionExtent message.
-IPC_MESSAGE_ROUTED0(InputHostMsg_MoveRangeSelectionExtent_ACK)
-
-// Acknowledges receipt of a InputMsg_SelectRange message.
-IPC_MESSAGE_ROUTED0(InputHostMsg_SelectRange_ACK)
-
-// Required for cancelling an ongoing input method composition.
-IPC_MESSAGE_ROUTED0(InputHostMsg_ImeCancelComposition)
-
-// This IPC message sends the character bounds after every composition change
-// to always have correct bound info.
-IPC_MESSAGE_ROUTED2(InputHostMsg_ImeCompositionRangeChanged,
-                    gfx::Range /* composition range */,
-                    std::vector<gfx::Rect> /* character bounds */)
-
-// Adding a new message? Stick to the sort order above: first platform
-// independent InputMsg, then ifdefs for platform specific InputMsg, then
-// platform independent InputHostMsg, then ifdefs for platform specific
-// InputHostMsg.
-
 #endif  // CONTENT_COMMON_INPUT_MESSAGES_H_
diff --git a/chromium/content/common/inter_process_time_ticks_converter.cc b/chromium/content/common/inter_process_time_ticks_converter.cc
index be36224a314..128abab37eb 100644
--- a/chromium/content/common/inter_process_time_ticks_converter.cc
+++ b/chromium/content/common/inter_process_time_ticks_converter.cc
@@ -4,84 +4,78 @@
 
 #include "content/common/inter_process_time_ticks_converter.h"
 
+#include <algorithm>
+
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 
 namespace content {
 
 InterProcessTimeTicksConverter::InterProcessTimeTicksConverter(
-    const LocalTimeTicks& local_lower_bound,
-    const LocalTimeTicks& local_upper_bound,
-    const RemoteTimeTicks& remote_lower_bound,
-    const RemoteTimeTicks& remote_upper_bound)
-    : remote_lower_bound_(remote_lower_bound.value_),
-      remote_upper_bound_(remote_upper_bound.value_) {
-  int64_t target_range = local_upper_bound.value_ - local_lower_bound.value_;
-  int64_t source_range = remote_upper_bound.value_ - remote_lower_bound.value_;
-  DCHECK_GE(target_range, 0);
-  DCHECK_GE(source_range, 0);
-  if (source_range <= target_range) {
+    LocalTimeTicks local_lower_bound,
+    LocalTimeTicks local_upper_bound,
+    RemoteTimeTicks remote_lower_bound,
+    RemoteTimeTicks remote_upper_bound)
+    : local_range_(local_upper_bound - local_lower_bound),
+      remote_lower_bound_(remote_lower_bound),
+      remote_upper_bound_(remote_upper_bound) {
+  RemoteTimeDelta remote_range = remote_upper_bound - remote_lower_bound;
+
+  DCHECK_LE(LocalTimeDelta(), local_range_);
+  DCHECK_LE(RemoteTimeDelta(), remote_range);
+
+  if (remote_range.ToTimeDelta() <= local_range_.ToTimeDelta()) {
     // We fit!  Center the source range on the target range.
-    numerator_ = 1;
-    denominator_ = 1;
+    range_conversion_rate_ = 1.0;
+    base::TimeDelta diff =
+        local_range_.ToTimeDelta() - remote_range.ToTimeDelta();
+
     local_base_time_ =
-        local_lower_bound.value_ + (target_range - source_range) / 2;
+        local_lower_bound + LocalTimeDelta::FromTimeDelta(diff / 2);
     // When converting times, remote bounds should fall within local bounds.
-    DCHECK_LE(local_lower_bound.value_,
-              ToLocalTimeTicks(remote_lower_bound).value_);
-    DCHECK_GE(local_upper_bound.value_,
-              ToLocalTimeTicks(remote_upper_bound).value_);
+    DCHECK_LE(local_lower_bound, ToLocalTimeTicks(remote_lower_bound));
+    DCHECK_LE(ToLocalTimeTicks(remote_upper_bound), local_upper_bound);
     return;
   }
 
   // Interpolate values so that remote range will be will exactly fit into the
   // local range, if possible.
-  numerator_ = target_range;
-  denominator_ = source_range;
-  local_base_time_ = local_lower_bound.value_;
-  // When converting times, remote bounds should equal local bounds.
-  DCHECK_EQ(local_lower_bound.value_,
-            ToLocalTimeTicks(remote_lower_bound).value_);
-  DCHECK_EQ(local_upper_bound.value_,
-            ToLocalTimeTicks(remote_upper_bound).value_);
-  DCHECK_EQ(target_range, Convert(source_range));
+  DCHECK_GT(remote_range.ToTimeDelta().InMicroseconds(), 0);
+  range_conversion_rate_ =
+      static_cast<double>(local_range_.ToTimeDelta().InMicroseconds()) /
+      remote_range.ToTimeDelta().InMicroseconds();
+  local_base_time_ = local_lower_bound;
 }
 
 LocalTimeTicks InterProcessTimeTicksConverter::ToLocalTimeTicks(
-    const RemoteTimeTicks& remote_ms) const {
+    RemoteTimeTicks remote_time_ticks) const {
   // If input time is "null", return another "null" time.
-  if (remote_ms.value_ == 0)
-    return LocalTimeTicks(0);
+  if (remote_time_ticks.is_null())
+    return LocalTimeTicks();
 
-  RemoteTimeDelta remote_delta = remote_ms - remote_lower_bound_;
-
-  DCHECK_LE(remote_ms.value_, remote_upper_bound_);
-  // For remote times that come before remote time range, apply just time
-  // offset and ignore scaling, so as to avoid extrapolation error for values
-  // long in the past.
-  if (remote_ms.value_ < remote_lower_bound_)
-    return LocalTimeTicks(local_base_time_ + remote_delta.value_);
+  RemoteTimeDelta remote_delta = remote_time_ticks - remote_lower_bound_;
 
-  return LocalTimeTicks(local_base_time_ +
-                        ToLocalTimeDelta(remote_delta).value_);
+  DCHECK_LE(remote_time_ticks, remote_upper_bound_);
+  return local_base_time_ + ToLocalTimeDelta(remote_delta);
 }
 
 LocalTimeDelta InterProcessTimeTicksConverter::ToLocalTimeDelta(
-    const RemoteTimeDelta& remote_delta) const {
-  DCHECK_GE(remote_upper_bound_, remote_lower_bound_ + remote_delta.value_);
-  return LocalTimeDelta(Convert(remote_delta.value_));
-}
+    RemoteTimeDelta remote_delta) const {
+  DCHECK_LE(remote_lower_bound_ + remote_delta, remote_upper_bound_);
 
-int64_t InterProcessTimeTicksConverter::Convert(int64_t value) const {
-  if (value <= 0) {
-    return value;
-  }
-  return numerator_ * value / denominator_;
+  // For remote times that come before remote time range, apply just time
+  // offset and ignore scaling, so as to avoid extrapolation error for values
+  // long in the past.
+  if (remote_delta <= RemoteTimeDelta())
+    return LocalTimeDelta::FromTimeDelta(remote_delta.ToTimeDelta());
+
+  return std::min(local_range_,
+                  LocalTimeDelta::FromTimeDelta(remote_delta.ToTimeDelta() *
+                                                range_conversion_rate_));
 }
 
 base::TimeDelta InterProcessTimeTicksConverter::GetSkewForMetrics() const {
-  return base::TimeTicks::FromInternalValue(remote_lower_bound_) -
-      base::TimeTicks::FromInternalValue(local_base_time_);
+  return remote_lower_bound_.ToTimeTicks() - local_base_time_.ToTimeTicks();
 }
 
 }  // namespace content
diff --git a/chromium/content/common/inter_process_time_ticks_converter.h b/chromium/content/common/inter_process_time_ticks_converter.h
index bbefaa6aa31..cc2952e4164 100644
--- a/chromium/content/common/inter_process_time_ticks_converter.h
+++ b/chromium/content/common/inter_process_time_ticks_converter.h
@@ -12,10 +12,95 @@
 
 namespace content {
 
-class LocalTimeDelta;
-class LocalTimeTicks;
-class RemoteTimeDelta;
-class RemoteTimeTicks;
+// SiteSpecificTimeDelta<T> is base::TimeDelta with a type tag. It it
+// essentially base::TimeDelta, but SiteSpecificTimeDelta<T> is different from
+// SiteSpecificTimeDelta<U> if T is different from U.
+template <typename T>
+class SiteSpecificTimeDelta final {
+ public:
+  SiteSpecificTimeDelta() = default;
+  static SiteSpecificTimeDelta<T> FromTimeDelta(base::TimeDelta delta) {
+    return SiteSpecificTimeDelta<T>(delta);
+  }
+  static SiteSpecificTimeDelta<T> FromMicroseconds(int64_t usec) {
+    return SiteSpecificTimeDelta<T>(base::TimeDelta::FromMicroseconds(usec));
+  }
+
+  base::TimeDelta ToTimeDelta() const { return delta_; }
+  bool operator==(const SiteSpecificTimeDelta<T> rhs) const {
+    return delta_ == rhs.delta_;
+  }
+  bool operator<(const SiteSpecificTimeDelta<T> rhs) const {
+    return delta_ < rhs.delta_;
+  }
+  bool operator<=(const SiteSpecificTimeDelta<T> rhs) const {
+    return delta_ <= rhs.delta_;
+  }
+
+ private:
+  explicit SiteSpecificTimeDelta(base::TimeDelta delta) : delta_(delta) {}
+
+  base::TimeDelta delta_;
+};
+
+// For logging use only.
+template <typename T>
+std::ostream& operator<<(std::ostream& os, SiteSpecificTimeDelta<T> delta) {
+  return os << delta.ToTimeDelta();
+}
+
+// SiteSpecificTimeTicks<T> is base::TimeTicks with a type tag. It is
+// essentially base::TimeTicks, but SiteSpecificTimeTicks<T> is different from
+// SiteSpecificTimeTicks<U> if T is different from U.
+template <typename T>
+class SiteSpecificTimeTicks final {
+ public:
+  SiteSpecificTimeTicks() = default;
+  static SiteSpecificTimeTicks<T> FromTimeTicks(base::TimeTicks time_ticks) {
+    return SiteSpecificTimeTicks<T>(time_ticks);
+  }
+
+  base::TimeTicks ToTimeTicks() const { return time_ticks_; }
+  bool is_null() const { return time_ticks_.is_null(); }
+
+  SiteSpecificTimeTicks<T> operator+(SiteSpecificTimeDelta<T> delta) const {
+    return SiteSpecificTimeTicks<T>(time_ticks_ + delta.ToTimeDelta());
+  }
+  SiteSpecificTimeDelta<T> operator-(SiteSpecificTimeTicks<T> rhs) const {
+    return SiteSpecificTimeDelta<T>::FromTimeDelta(time_ticks_ -
+                                                   rhs.time_ticks_);
+  }
+  bool operator<(const SiteSpecificTimeTicks<T> rhs) const {
+    return time_ticks_ < rhs.time_ticks_;
+  }
+  bool operator==(const SiteSpecificTimeTicks<T> rhs) const {
+    return time_ticks_ == rhs.time_ticks_;
+  }
+  bool operator<=(const SiteSpecificTimeTicks<T> rhs) const {
+    return time_ticks_ <= rhs.time_ticks_;
+  }
+
+ private:
+  explicit SiteSpecificTimeTicks(base::TimeTicks time_ticks)
+      : time_ticks_(time_ticks) {}
+
+  base::TimeTicks time_ticks_;
+};
+
+// For logging use only.
+template <typename T>
+std::ostream& operator<<(std::ostream& os,
+                         SiteSpecificTimeTicks<T> time_ticks) {
+  return os << time_ticks.ToTimeTicks();
+}
+
+class SiteSpecificTimeLocalTag;
+using LocalTimeTicks = SiteSpecificTimeTicks<SiteSpecificTimeLocalTag>;
+using LocalTimeDelta = SiteSpecificTimeDelta<SiteSpecificTimeLocalTag>;
+
+class SiteSpecificTimeRemoteTag;
+using RemoteTimeTicks = SiteSpecificTimeTicks<SiteSpecificTimeRemoteTag>;
+using RemoteTimeDelta = SiteSpecificTimeDelta<SiteSpecificTimeRemoteTag>;
 
 // On Windows, TimeTicks are not always consistent between processes as
 // indicated by |TimeTicks::IsConsistentAcrossProcesses()|. Often, the values on
@@ -51,18 +136,18 @@ class RemoteTimeTicks;
 //    local's range. Any values converted will be shifted the same amount.
 class CONTENT_EXPORT InterProcessTimeTicksConverter {
  public:
-  InterProcessTimeTicksConverter(const LocalTimeTicks& local_lower_bound,
-                                 const LocalTimeTicks& local_upper_bound,
-                                 const RemoteTimeTicks& remote_lower_bound,
-                                 const RemoteTimeTicks& remote_upper_bound);
+  InterProcessTimeTicksConverter(LocalTimeTicks local_lower_bound,
+                                 LocalTimeTicks local_upper_bound,
+                                 RemoteTimeTicks remote_lower_bound,
+                                 RemoteTimeTicks remote_upper_bound);
 
   // Returns the value within the local's bounds that correlates to
   // |remote_ms|.
-  LocalTimeTicks ToLocalTimeTicks(const RemoteTimeTicks& remote_ms) const;
+  LocalTimeTicks ToLocalTimeTicks(RemoteTimeTicks remote_ms) const;
 
   // Returns the equivalent delta after applying remote-to-local scaling to
   // |remote_delta|.
-  LocalTimeDelta ToLocalTimeDelta(const RemoteTimeDelta& remote_delta) const;
+  LocalTimeDelta ToLocalTimeDelta(RemoteTimeDelta remote_delta) const;
 
   // Returns the (remote time) - (local time) difference estimated by the
   // converter. This is the constant that is subtracted from remote TimeTicks to
@@ -70,84 +155,14 @@ class CONTENT_EXPORT InterProcessTimeTicksConverter {
   base::TimeDelta GetSkewForMetrics() const;
 
  private:
-  int64_t Convert(int64_t value) const;
-
   // The local time which |remote_lower_bound_| is mapped to.
-  int64_t local_base_time_;
-
-  int64_t numerator_;
-  int64_t denominator_;
-
-  int64_t remote_lower_bound_;
-  int64_t remote_upper_bound_;
-};
-
-class CONTENT_EXPORT LocalTimeDelta {
- public:
-  int ToInt32() const { return value_; }
-
- private:
-  friend class InterProcessTimeTicksConverter;
-  friend class LocalTimeTicks;
-
-  LocalTimeDelta(int value) : value_(value) {}
-
-  int value_;
-};
-
-class CONTENT_EXPORT LocalTimeTicks {
- public:
-  static LocalTimeTicks FromTimeTicks(const base::TimeTicks& value) {
-    return LocalTimeTicks(value.ToInternalValue());
-  }
-
-  base::TimeTicks ToTimeTicks() {
-    return base::TimeTicks::FromInternalValue(value_);
-  }
-
-  LocalTimeTicks operator+(const LocalTimeDelta& delta) {
-    return LocalTimeTicks(value_ + delta.value_);
-  }
-
- private:
-  friend class InterProcessTimeTicksConverter;
-
-  LocalTimeTicks(int64_t value) : value_(value) {}
-
-  int64_t value_;
-};
-
-class CONTENT_EXPORT RemoteTimeDelta {
- public:
-  static RemoteTimeDelta FromRawDelta(int delta) {
-    return RemoteTimeDelta(delta);
-  }
-
- private:
-  friend class InterProcessTimeTicksConverter;
-  friend class RemoteTimeTicks;
-
-  RemoteTimeDelta(int value) : value_(value) {}
-
-  int value_;
-};
-
-class CONTENT_EXPORT RemoteTimeTicks {
- public:
-  static RemoteTimeTicks FromTimeTicks(const base::TimeTicks& ticks) {
-    return RemoteTimeTicks(ticks.ToInternalValue());
-  }
-
-  RemoteTimeDelta operator-(const RemoteTimeTicks& rhs) const {
-    return RemoteTimeDelta(value_ - rhs.value_);
-  }
-
- private:
-  friend class InterProcessTimeTicksConverter;
+  LocalTimeTicks local_base_time_;
+  LocalTimeDelta local_range_;
 
-  RemoteTimeTicks(int64_t value) : value_(value) {}
+  double range_conversion_rate_;
 
-  int64_t value_;
+  RemoteTimeTicks remote_lower_bound_;
+  RemoteTimeTicks remote_upper_bound_;
 };
 
 }  // namespace content
diff --git a/chromium/content/common/inter_process_time_ticks_converter_unittest.cc b/chromium/content/common/inter_process_time_ticks_converter_unittest.cc
index 0a555e02214..8b8d72157b6 100644
--- a/chromium/content/common/inter_process_time_ticks_converter_unittest.cc
+++ b/chromium/content/common/inter_process_time_ticks_converter_unittest.cc
@@ -16,43 +16,38 @@ namespace content {
 namespace {
 
 struct TestParams {
-  int64_t local_lower_bound;
-  int64_t remote_lower_bound;
-  int64_t remote_upper_bound;
-  int64_t local_upper_bound;
-  int64_t test_time;
-  int64_t test_delta;
+  LocalTimeTicks local_lower_bound;
+  RemoteTimeTicks remote_lower_bound;
+  RemoteTimeTicks remote_upper_bound;
+  LocalTimeTicks local_upper_bound;
+  RemoteTimeTicks test_time;
+  RemoteTimeDelta test_delta;
 };
 
 struct TestResults {
-  int64_t result_time;
-  int32_t result_delta;
+  LocalTimeTicks result_time;
+  LocalTimeDelta result_delta;
   int64_t skew;
 };
 
-TestResults RunTest(const TestParams& params) {
-  TimeTicks local_lower_bound = TimeTicks::FromInternalValue(
-      params.local_lower_bound);
-  TimeTicks local_upper_bound = TimeTicks::FromInternalValue(
-      params.local_upper_bound);
-  TimeTicks remote_lower_bound = TimeTicks::FromInternalValue(
-      params.remote_lower_bound);
-  TimeTicks remote_upper_bound = TimeTicks::FromInternalValue(
-      params.remote_upper_bound);
-  TimeTicks test_time = TimeTicks::FromInternalValue(params.test_time);
+LocalTimeTicks GetLocalTimeTicks(int64_t value) {
+  return LocalTimeTicks::FromTimeTicks(
+      base::TimeTicks() + base::TimeDelta::FromMicroseconds(value));
+}
+
+RemoteTimeTicks GetRemoteTimeTicks(int64_t value) {
+  return RemoteTimeTicks::FromTimeTicks(
+      base::TimeTicks() + base::TimeDelta::FromMicroseconds(value));
+}
 
+TestResults RunTest(const TestParams& params) {
   InterProcessTimeTicksConverter converter(
-      LocalTimeTicks::FromTimeTicks(local_lower_bound),
-      LocalTimeTicks::FromTimeTicks(local_upper_bound),
-      RemoteTimeTicks::FromTimeTicks(remote_lower_bound),
-      RemoteTimeTicks::FromTimeTicks(remote_upper_bound));
+      params.local_lower_bound, params.local_upper_bound,
+      params.remote_lower_bound, params.remote_upper_bound);
 
   TestResults results;
-  results.result_time = converter.ToLocalTimeTicks(
-      RemoteTimeTicks::FromTimeTicks(
-          test_time)).ToTimeTicks().ToInternalValue();
-  results.result_delta = converter.ToLocalTimeDelta(
-      RemoteTimeDelta::FromRawDelta(params.test_delta)).ToInt32();
+  results.result_time = converter.ToLocalTimeTicks(params.test_time);
+  results.result_delta = converter.ToLocalTimeDelta(params.test_delta);
   results.skew = converter.GetSkewForMetrics().ToInternalValue();
   return results;
 }
@@ -60,29 +55,29 @@ TestResults RunTest(const TestParams& params) {
 TEST(InterProcessTimeTicksConverterTest, NullTime) {
   // Null / zero times should remain null.
   TestParams p;
-  p.local_lower_bound = 1;
-  p.remote_lower_bound = 2;
-  p.remote_upper_bound = 5;
-  p.local_upper_bound = 6;
-  p.test_time = 0;
-  p.test_delta = 0;
+  p.local_lower_bound = GetLocalTimeTicks(1);
+  p.remote_lower_bound = GetRemoteTimeTicks(2);
+  p.remote_upper_bound = GetRemoteTimeTicks(5);
+  p.local_upper_bound = GetLocalTimeTicks(6);
+  p.test_time = GetRemoteTimeTicks(0);
+  p.test_delta = RemoteTimeDelta();
   TestResults results = RunTest(p);
-  EXPECT_EQ(0, results.result_time);
-  EXPECT_EQ(0, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(0), results.result_time);
+  EXPECT_EQ(LocalTimeDelta(), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, NoSkew) {
   // All times are monotonic and centered, so no adjustment should occur.
   TestParams p;
-  p.local_lower_bound = 1;
-  p.remote_lower_bound = 2;
-  p.remote_upper_bound = 5;
-  p.local_upper_bound = 6;
-  p.test_time = 3;
-  p.test_delta = 1;
+  p.local_lower_bound = GetLocalTimeTicks(1);
+  p.remote_lower_bound = GetRemoteTimeTicks(2);
+  p.remote_upper_bound = GetRemoteTimeTicks(5);
+  p.local_upper_bound = GetLocalTimeTicks(6);
+  p.test_time = GetRemoteTimeTicks(3);
+  p.test_delta = RemoteTimeDelta::FromMicroseconds(1);
   TestResults results = RunTest(p);
-  EXPECT_EQ(3, results.result_time);
-  EXPECT_EQ(1, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(3), results.result_time);
+  EXPECT_EQ(LocalTimeDelta::FromMicroseconds(1), results.result_delta);
   EXPECT_EQ(0, results.skew);
 }
 
@@ -90,15 +85,15 @@ TEST(InterProcessTimeTicksConverterTest, OffsetMidpoints) {
   // All times are monotonic, but not centered. Adjust the |remote_*| times so
   // they are centered within the |local_*| times.
   TestParams p;
-  p.local_lower_bound = 1;
-  p.remote_lower_bound = 3;
-  p.remote_upper_bound = 6;
-  p.local_upper_bound = 6;
-  p.test_time = 4;
-  p.test_delta = 1;
+  p.local_lower_bound = GetLocalTimeTicks(1);
+  p.remote_lower_bound = GetRemoteTimeTicks(3);
+  p.remote_upper_bound = GetRemoteTimeTicks(6);
+  p.local_upper_bound = GetLocalTimeTicks(6);
+  p.test_time = GetRemoteTimeTicks(4);
+  p.test_delta = RemoteTimeDelta::FromMicroseconds(1);
   TestResults results = RunTest(p);
-  EXPECT_EQ(3, results.result_time);
-  EXPECT_EQ(1, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(3), results.result_time);
+  EXPECT_EQ(LocalTimeDelta::FromMicroseconds(1), results.result_delta);
   EXPECT_EQ(1, results.skew);
 }
 
@@ -109,15 +104,15 @@ TEST(InterProcessTimeTicksConverterTest, DoubleEndedSkew) {
   // doesn't change. The ratio of local time to network time is 1:2, so we scale
   // |test_delta| to half.
   TestParams p;
-  p.local_lower_bound = 3;
-  p.remote_lower_bound = 1;
-  p.remote_upper_bound = 9;
-  p.local_upper_bound = 7;
-  p.test_time = 5;
-  p.test_delta = 2;
+  p.local_lower_bound = GetLocalTimeTicks(3);
+  p.remote_lower_bound = GetRemoteTimeTicks(1);
+  p.remote_upper_bound = GetRemoteTimeTicks(9);
+  p.local_upper_bound = GetLocalTimeTicks(7);
+  p.test_time = GetRemoteTimeTicks(5);
+  p.test_delta = RemoteTimeDelta::FromMicroseconds(2);
   TestResults results = RunTest(p);
-  EXPECT_EQ(5, results.result_time);
-  EXPECT_EQ(1, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(5), results.result_time);
+  EXPECT_EQ(LocalTimeDelta::FromMicroseconds(1), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, FrontEndSkew) {
@@ -126,30 +121,30 @@ TEST(InterProcessTimeTicksConverterTest, FrontEndSkew) {
   // but since we use integers, the numbers truncate from 3.33 to 3 and 1.33
   // to 1.
   TestParams p;
-  p.local_lower_bound = 3;
-  p.remote_lower_bound = 1;
-  p.remote_upper_bound = 7;
-  p.local_upper_bound = 7;
-  p.test_time = 3;
-  p.test_delta = 2;
+  p.local_lower_bound = GetLocalTimeTicks(3);
+  p.remote_lower_bound = GetRemoteTimeTicks(1);
+  p.remote_upper_bound = GetRemoteTimeTicks(7);
+  p.local_upper_bound = GetLocalTimeTicks(7);
+  p.test_time = GetRemoteTimeTicks(3);
+  p.test_delta = RemoteTimeDelta::FromMicroseconds(2);
   TestResults results = RunTest(p);
-  EXPECT_EQ(4, results.result_time);
-  EXPECT_EQ(1, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(4), results.result_time);
+  EXPECT_EQ(LocalTimeDelta::FromMicroseconds(1), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, BackEndSkew) {
   // Like the previous test, but |remote_lower_bound| is coherent and
   // |remote_upper_bound| is skewed.
   TestParams p;
-  p.local_lower_bound = 1;
-  p.remote_lower_bound = 1;
-  p.remote_upper_bound = 7;
-  p.local_upper_bound = 5;
-  p.test_time = 3;
-  p.test_delta = 2;
+  p.local_lower_bound = GetLocalTimeTicks(1);
+  p.remote_lower_bound = GetRemoteTimeTicks(1);
+  p.remote_upper_bound = GetRemoteTimeTicks(7);
+  p.local_upper_bound = GetLocalTimeTicks(5);
+  p.test_time = GetRemoteTimeTicks(3);
+  p.test_delta = RemoteTimeDelta::FromMicroseconds(2);
   TestResults results = RunTest(p);
-  EXPECT_EQ(2, results.result_time);
-  EXPECT_EQ(1, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(2), results.result_time);
+  EXPECT_EQ(LocalTimeDelta::FromMicroseconds(1), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, Instantaneous) {
@@ -157,15 +152,15 @@ TEST(InterProcessTimeTicksConverterTest, Instantaneous) {
   // |remote_upper_bound| have the same value. No adjustments should be made and
   // no divide-by-zero errors should occur.
   TestParams p;
-  p.local_lower_bound = 1;
-  p.remote_lower_bound = 2;
-  p.remote_upper_bound = 2;
-  p.local_upper_bound = 3;
-  p.test_time = 2;
-  p.test_delta = 0;
+  p.local_lower_bound = GetLocalTimeTicks(1);
+  p.remote_lower_bound = GetRemoteTimeTicks(2);
+  p.remote_upper_bound = GetRemoteTimeTicks(2);
+  p.local_upper_bound = GetLocalTimeTicks(3);
+  p.test_time = GetRemoteTimeTicks(2);
+  p.test_delta = RemoteTimeDelta();
   TestResults results = RunTest(p);
-  EXPECT_EQ(2, results.result_time);
-  EXPECT_EQ(0, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(2), results.result_time);
+  EXPECT_EQ(LocalTimeDelta(), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, OffsetInstantaneous) {
@@ -174,15 +169,15 @@ TEST(InterProcessTimeTicksConverterTest, OffsetInstantaneous) {
   // of |local_lower_bound| and |local_upper_bound|. An offset should be applied
   // to make the midpoints line up.
   TestParams p;
-  p.local_lower_bound = 1;
-  p.remote_lower_bound = 3;
-  p.remote_upper_bound = 3;
-  p.local_upper_bound = 3;
-  p.test_time = 3;
-  p.test_delta = 0;
+  p.local_lower_bound = GetLocalTimeTicks(1);
+  p.remote_lower_bound = GetRemoteTimeTicks(3);
+  p.remote_upper_bound = GetRemoteTimeTicks(3);
+  p.local_upper_bound = GetLocalTimeTicks(3);
+  p.test_time = GetRemoteTimeTicks(3);
+  p.test_delta = RemoteTimeDelta();
   TestResults results = RunTest(p);
-  EXPECT_EQ(2, results.result_time);
-  EXPECT_EQ(0, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(2), results.result_time);
+  EXPECT_EQ(LocalTimeDelta(), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, DisjointInstantaneous) {
@@ -191,15 +186,15 @@ TEST(InterProcessTimeTicksConverterTest, DisjointInstantaneous) {
   // local_upper_bound].  So, all of the values should be adjusted so they are
   // exactly that value.
   TestParams p;
-  p.local_lower_bound = 1;
-  p.remote_lower_bound = 2;
-  p.remote_upper_bound = 2;
-  p.local_upper_bound = 1;
-  p.test_time = 2;
-  p.test_delta = 0;
+  p.local_lower_bound = GetLocalTimeTicks(1);
+  p.remote_lower_bound = GetRemoteTimeTicks(2);
+  p.remote_upper_bound = GetRemoteTimeTicks(2);
+  p.local_upper_bound = GetLocalTimeTicks(1);
+  p.test_time = GetRemoteTimeTicks(2);
+  p.test_delta = RemoteTimeDelta();
   TestResults results = RunTest(p);
-  EXPECT_EQ(1, results.result_time);
-  EXPECT_EQ(0, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(1), results.result_time);
+  EXPECT_EQ(LocalTimeDelta(), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, RoundingNearEdges) {
@@ -209,37 +204,69 @@ TEST(InterProcessTimeTicksConverterTest, RoundingNearEdges) {
   for (int i = 1; i < kMaxRange; ++i) {
     for (int j = 1; j < kMaxRange; ++j) {
       TestParams p;
-      p.local_lower_bound = 1;
-      p.remote_lower_bound = 1;
-      p.remote_upper_bound = j;
-      p.local_upper_bound = i;
+      p.local_lower_bound = GetLocalTimeTicks(1);
+      p.remote_lower_bound = GetRemoteTimeTicks(1);
+      p.remote_upper_bound = GetRemoteTimeTicks(j);
+      p.local_upper_bound = GetLocalTimeTicks(i);
 
-      p.test_time = 1;
-      p.test_delta = 0;
+      p.test_time = GetRemoteTimeTicks(1);
+      p.test_delta = RemoteTimeDelta();
       TestResults results = RunTest(p);
-      EXPECT_LE(1, results.result_time);
-      EXPECT_EQ(0, results.result_delta);
+      EXPECT_LE(GetLocalTimeTicks(1), results.result_time);
+      EXPECT_EQ(LocalTimeDelta(), results.result_delta);
 
-      p.test_time = j;
-      p.test_delta = j - 1;
+      p.test_time = GetRemoteTimeTicks(j);
+      p.test_delta = RemoteTimeDelta::FromMicroseconds(j - 1);
       results = RunTest(p);
-      EXPECT_GE(i, results.result_time);
-      EXPECT_GE(i - 1, results.result_delta);
+      EXPECT_LE(results.result_time, GetLocalTimeTicks(i));
+      EXPECT_LE(results.result_delta, LocalTimeDelta::FromMicroseconds(i - 1));
     }
   }
 }
 
 TEST(InterProcessTimeTicksConverterTest, DisjointRanges) {
   TestParams p;
-  p.local_lower_bound = 10;
-  p.remote_lower_bound = 30;
-  p.remote_upper_bound = 41;
-  p.local_upper_bound = 20;
-  p.test_time = 41;
-  p.test_delta = 0;
+  p.local_lower_bound = GetLocalTimeTicks(10);
+  p.remote_lower_bound = GetRemoteTimeTicks(30);
+  p.remote_upper_bound = GetRemoteTimeTicks(41);
+  p.local_upper_bound = GetLocalTimeTicks(20);
+  p.test_time = GetRemoteTimeTicks(41);
+  p.test_delta = RemoteTimeDelta();
+  TestResults results = RunTest(p);
+  EXPECT_EQ(GetLocalTimeTicks(20), results.result_time);
+  EXPECT_EQ(LocalTimeDelta(), results.result_delta);
+}
+
+TEST(InterProcessTimeTicksConverterTest, LargeValue_LocalIsLargetThanRemote) {
+  constexpr auto kWeek = base::TimeTicks::kMicrosecondsPerWeek;
+  constexpr auto kHour = base::TimeTicks::kMicrosecondsPerHour;
+  TestParams p;
+  p.local_lower_bound = GetLocalTimeTicks(4 * kWeek);
+  p.remote_lower_bound = GetRemoteTimeTicks(4 * kWeek + 2 * kHour);
+  p.remote_upper_bound = GetRemoteTimeTicks(4 * kWeek + 4 * kHour);
+  p.local_upper_bound = GetLocalTimeTicks(4 * kWeek + 8 * kHour);
+
+  p.test_time = GetRemoteTimeTicks(4 * kWeek + 3 * kHour);
+  p.test_delta = RemoteTimeDelta();
+  TestResults results = RunTest(p);
+  EXPECT_EQ(GetLocalTimeTicks(4 * kWeek + 4 * kHour), results.result_time);
+  EXPECT_EQ(LocalTimeDelta(), results.result_delta);
+}
+
+TEST(InterProcessTimeTicksConverterTest, LargeValue_RemoteIsLargetThanLocal) {
+  constexpr auto kWeek = base::TimeTicks::kMicrosecondsPerWeek;
+  constexpr auto kHour = base::TimeTicks::kMicrosecondsPerHour;
+  TestParams p;
+  p.local_lower_bound = GetLocalTimeTicks(4 * kWeek);
+  p.remote_lower_bound = GetRemoteTimeTicks(5 * kWeek);
+  p.remote_upper_bound = GetRemoteTimeTicks(5 * kWeek + 2 * kHour);
+  p.local_upper_bound = GetLocalTimeTicks(4 * kWeek + kHour);
+
+  p.test_time = GetRemoteTimeTicks(5 * kWeek + kHour);
+  p.test_delta = RemoteTimeDelta();
   TestResults results = RunTest(p);
-  EXPECT_EQ(20, results.result_time);
-  EXPECT_EQ(0, results.result_delta);
+  EXPECT_EQ(GetLocalTimeTicks(4 * kWeek + kHour / 2), results.result_time);
+  EXPECT_EQ(LocalTimeDelta(), results.result_delta);
 }
 
 TEST(InterProcessTimeTicksConverterTest, ValuesOutsideOfRange) {
diff --git a/chromium/content/common/manifest_share_target_util_unittest.cc b/chromium/content/common/manifest_share_target_util_unittest.cc
deleted file mode 100644
index edfc6767ea7..00000000000
--- a/chromium/content/common/manifest_share_target_util_unittest.cc
+++ /dev/null
@@ -1,266 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <map>
-#include <utility>
-
-#include "content/public/common/manifest_share_target_util.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "url/gurl.h"
-
-namespace content {
-namespace {
-
-constexpr char kTitle[] = "My title";
-constexpr char kText[] = "My text";
-constexpr char kUrlSpec[] = "https://www.google.com/";
-
-}  // namespace
-
-TEST(ManifestShareTargetUtilTest, ReplaceUrlPlaceholdersInvalidTemplate) {
-  // Badly nested placeholders.
-  GURL url_template = GURL("http://example.com/?q={");
-  EXPECT_FALSE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_FALSE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  url_template = GURL("http://example.com/?q={title");
-  EXPECT_FALSE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_FALSE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  url_template = GURL("http://example.com/?q={title{text}}");
-  EXPECT_FALSE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_FALSE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  url_template = GURL("http://example.com/?q={title{}");
-  EXPECT_FALSE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_FALSE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  url_template = GURL("http://example.com/?q={{title}}");
-  EXPECT_FALSE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_FALSE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  // Placeholder with non-identifier character.
-  url_template = GURL("http://example.com/?q={title?}");
-  EXPECT_FALSE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_FALSE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  // Placeholder with digit character.
-  url_template = GURL("http://example.com/?q={title1}");
-  EXPECT_TRUE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_TRUE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  // Empty placeholder.
-  url_template = GURL("http://example.com/?q={}");
-  EXPECT_TRUE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_TRUE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  // Invalid placeholder in URL fragment.
-  url_template = GURL("http://example.com/#{title?}");
-  EXPECT_FALSE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_FALSE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  // { in path.
-  url_template = GURL("http://example.com/subpath{/");
-  EXPECT_TRUE(ValidateWebShareUrlTemplate(url_template));
-  EXPECT_TRUE(
-      ReplaceWebShareUrlPlaceholders(url_template, "", "", GURL(), nullptr));
-
-  // Invalid placeholder. Non-empty title, text, share URL and non-empty output
-  // parameter.
-  GURL url_template_filled;
-  url_template = GURL("http://example.com/?q={");
-  EXPECT_FALSE(ReplaceWebShareUrlPlaceholders(url_template, "text", "title",
-                                              GURL("http://www.google.com"),
-                                              &url_template_filled));
-}
-
-TEST(ManifestShareTargetUtilTest, ReplaceWebShareUrlPlaceholders) {
-  const GURL kUrl(kUrlSpec);
-
-  // No placeholders.
-  GURL url_template = GURL("http://example.com/?q=a#a");
-  GURL url_template_filled;
-  bool succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText,
-                                                  kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ(url_template, url_template_filled);
-
-  // One title placeholder.
-  url_template = GURL("http://example.com/#{title}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#My%20title", url_template_filled.spec());
-
-  // One text placeholder.
-  url_template = GURL("http://example.com/#{text}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#My%20text", url_template_filled.spec());
-
-  // One url placeholder.
-  url_template = GURL("http://example.com/#{url}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#https%3A%2F%2Fwww.google.com%2F",
-            url_template_filled.spec());
-
-  // One of each placeholder, in title, text, url order.
-  url_template = GURL("http://example.com/#{title}{text}{url}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ(
-      "http://example.com/#My%20titleMy%20texthttps%3A%2F%2Fwww.google.com%2F",
-      url_template_filled.spec());
-
-  // One of each placeholder, in url, text, title order.
-  url_template = GURL("http://example.com/#{url}{text}{title}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ(
-      "http://example.com/#https%3A%2F%2Fwww.google.com%2FMy%20textMy%20title",
-      url_template_filled.spec());
-
-  // Two of each placeholder, some next to each other, others not.
-  url_template =
-      GURL("http://example.com/#{title}{url}{text}{text}{title}{url}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ(
-      "http://example.com/"
-      "#My%20titlehttps%3A%2F%2Fwww.google.com%2FMy%20textMy%20textMy%"
-      "20titlehttps%3A%2F%2Fwww.google.com%2F",
-      url_template_filled.spec());
-
-  // Placeholders are in a query string, as values. The expected use case.
-  // Two of each placeholder, some next to each other, others not.
-  url_template = GURL(
-      "http://example.com?title={title}&url={url}&text={text}&text={text}&"
-      "title={title}&url={url}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ(
-      "http://"
-      "example.com/?title=My%20title&url=https%3A%2F%2Fwww.google.com%2F&"
-      "text=My%20text&"
-      "text=My%20text&title=My%20title&url=https%3A%2F%2Fwww.google.com%2F",
-      url_template_filled.spec());
-
-  // Empty placeholder.
-  url_template = GURL("http://example.com/#{}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#", url_template_filled.spec());
-
-  // Unexpected placeholders.
-  url_template = GURL("http://example.com/#{nonexistentplaceholder}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#", url_template_filled.spec());
-
-  // Placeholders should only be replaced in query and fragment.
-  url_template = GURL("http://example.com/subpath{title}/?q={title}#{title}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/subpath%7Btitle%7D/?q=My%20title#My%20title",
-            url_template_filled.spec());
-
-  // Braces in the path, which would be invalid, but should parse fine as they
-  // are escaped.
-  url_template = GURL("http://example.com/subpath{/?q={title}");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/subpath%7B/?q=My%20title",
-            url_template_filled.spec());
-
-  // |url_template| with % escapes.
-  url_template = GURL("http://example.com#%20{title}%20");
-  succeeded = ReplaceWebShareUrlPlaceholders(url_template, kTitle, kText, kUrl,
-                                             &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#%20My%20title%20", url_template_filled.spec());
-}
-
-// Test URL escaping done by ReplaceWebShareUrlPlaceholders().
-TEST(ManifestShareTargetUtilTest, ReplaceWebShareUrlPlaceholders_Escaping) {
-  const GURL kUrl(kUrlSpec);
-  const GURL kUrlTemplate("http://example.com/#{title}");
-
-  // Share data that contains percent escapes.
-  GURL url_template_filled;
-  bool succeeded = ReplaceWebShareUrlPlaceholders(
-      kUrlTemplate, "My%20title", kText, kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#My%2520title", url_template_filled.spec());
-
-  // Share data that contains placeholders. These should not be replaced.
-  succeeded = ReplaceWebShareUrlPlaceholders(kUrlTemplate, "{title}", kText,
-                                             kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#%7Btitle%7D", url_template_filled.spec());
-
-  // All characters that shouldn't be escaped.
-  succeeded = ReplaceWebShareUrlPlaceholders(kUrlTemplate,
-                                             "-_.!~*'()0123456789"
-                                             "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-                                             "abcdefghijklmnopqrstuvwxyz",
-                                             kText, kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ(
-      "http://example.com/#-_.!~*'()0123456789"
-      "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-      "abcdefghijklmnopqrstuvwxyz",
-      url_template_filled.spec());
-
-  // All characters that should be escaped.
-  succeeded =
-      ReplaceWebShareUrlPlaceholders(kUrlTemplate, " \"#$%&+,/:;<=>?@[\\]^`{|}",
-                                     kText, kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ(
-      "http://example.com/"
-      "#%20%22%23%24%25%26%2B%2C%2F%3A%3B%3C%3D%3E%3F%40%5B%5C%5D%5E%60%7B%7C%"
-      "7D",
-      url_template_filled.spec());
-
-  // Unicode chars.
-  // U+263B
-  succeeded = ReplaceWebShareUrlPlaceholders(kUrlTemplate, "\xe2\x98\xbb",
-                                             kText, kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#%E2%98%BB", url_template_filled.spec());
-
-  // U+00E9
-  succeeded = ReplaceWebShareUrlPlaceholders(kUrlTemplate, "\xc3\xa9", kText,
-                                             kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#%C3%A9", url_template_filled.spec());
-
-  // U+1F4A9
-  succeeded = ReplaceWebShareUrlPlaceholders(kUrlTemplate, "\xf0\x9f\x92\xa9",
-                                             kText, kUrl, &url_template_filled);
-  EXPECT_TRUE(succeeded);
-  EXPECT_EQ("http://example.com/#%F0%9F%92%A9", url_template_filled.spec());
-}
-
-}  // namespace content
diff --git a/chromium/content/common/media/audio_messages.h b/chromium/content/common/media/audio_messages.h
deleted file mode 100644
index c4c2f3535af..00000000000
--- a/chromium/content/common/media/audio_messages.h
+++ /dev/null
@@ -1,136 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MEDIA_AUDIO_MESSAGES_H_
-#define CONTENT_COMMON_MEDIA_AUDIO_MESSAGES_H_
-
-// IPC messages for the audio.
-
-#include <stdint.h>
-
-#include <string>
-
-#include "base/memory/shared_memory.h"
-#include "base/sync_socket.h"
-#include "content/common/content_export.h"
-#include "ipc/ipc_message_macros.h"
-#include "media/audio/audio_input_ipc.h"
-#include "media/audio/audio_output_ipc.h"
-#include "media/base/ipc/media_param_traits.h"
-#include "media/base/ipc/media_param_traits_macros.h"
-#include "media/gpu/ipc/common/media_param_traits.h"
-#include "url/origin.h"
-
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-#define IPC_MESSAGE_START AudioMsgStart
-
-IPC_STRUCT_BEGIN(AudioInputHostMsg_CreateStream_Config)
-  IPC_STRUCT_MEMBER(media::AudioParameters, params)
-  IPC_STRUCT_MEMBER(bool, automatic_gain_control)
-  IPC_STRUCT_MEMBER(uint32_t, shared_memory_count)
-IPC_STRUCT_END()
-
-// Messages sent from the browser to the renderer.
-
-// Tell the renderer process that an audio output device has been authorized
-// for a given stream. The renderer is given the output parameters for the
-// authorized device.
-IPC_MESSAGE_CONTROL4(AudioMsg_NotifyDeviceAuthorized,
-                     int /* stream id */,
-                     media::OutputDeviceStatus /* device_status */,
-                     media::AudioParameters /* output parameters */,
-                     std::string /* matched_device_id */)
-
-// Tell the renderer process that an audio stream has been created.
-// The renderer process is given a shared memory handle for the audio data
-// buffer it shares with the browser process. It is also given a SyncSocket that
-// it uses to communicate with the browser process about the state of the
-// buffered audio data.
-IPC_MESSAGE_CONTROL(AudioMsg_NotifyStreamCreated,
-                    int /* stream id */,
-                    base::SharedMemoryHandle /* handle */,
-                    base::SyncSocket::TransitDescriptor /* socket descriptor */)
-
-// Tell the renderer process that an audio input stream has been created.
-// The renderer process would be given a SyncSocket that it should read from
-// from then on. It is also given whether the stream initially is muted.
-IPC_MESSAGE_CONTROL(AudioInputMsg_NotifyStreamCreated,
-                    int /* stream id */,
-                    base::SharedMemoryHandle /* handle */,
-                    base::SyncSocket::TransitDescriptor /* socket descriptor */,
-                    bool /* initially muted */)
-
-// Notification message sent from AudioRendererHost to renderer for state
-// update on error.
-IPC_MESSAGE_CONTROL1(AudioMsg_NotifyStreamError, int /* stream id */)
-
-// Notification message sent from browser to renderer for state update.
-IPC_MESSAGE_CONTROL1(AudioInputMsg_NotifyStreamError, int /* stream id */)
-
-// Notification message sent from browser to renderer when stream mutes or
-// unmutes.
-IPC_MESSAGE_CONTROL2(AudioInputMsg_NotifyStreamMuted,
-                     int /* stream id */,
-                     bool /* is muted? */)
-
-// Messages sent from the renderer to the browser.
-
-// Message sent to the browser to request the use of an audio output
-// device. |render_frame_id| is the routing ID for the RenderFrame producing
-// the audio data.
-IPC_MESSAGE_CONTROL5(AudioHostMsg_RequestDeviceAuthorization,
-                     int /* stream_id */,
-                     int /* render_frame_id */,
-                     int /* session_id */,
-                     std::string /* device_id */,
-                     url::Origin /* security_origin */)
-
-// Request that is sent to the browser for creating an audio output stream.
-IPC_MESSAGE_CONTROL3(AudioHostMsg_CreateStream,
-                     int /* stream_id */,
-                     int /* render_frame_id */,
-                     media::AudioParameters /* params */)
-
-// Request that is sent to the browser for creating an audio input stream.
-// |render_frame_id| is the routing ID for the RenderFrame consuming the audio
-// data.
-IPC_MESSAGE_CONTROL4(AudioInputHostMsg_CreateStream,
-                     int /* stream_id */,
-                     int /* render_frame_id */,
-                     int /* session_id */,
-                     AudioInputHostMsg_CreateStream_Config)
-
-// Start buffering and play the audio stream specified by stream_id.
-IPC_MESSAGE_CONTROL1(AudioHostMsg_PlayStream,
-                     int /* stream_id */)
-
-// Start recording the audio input stream specified by stream_id.
-IPC_MESSAGE_CONTROL1(AudioInputHostMsg_RecordStream,
-                     int /* stream_id */)
-
-// Pause the audio stream specified by stream_id.
-IPC_MESSAGE_CONTROL1(AudioHostMsg_PauseStream,
-                     int /* stream_id */)
-
-// Close an audio stream specified by stream_id.
-IPC_MESSAGE_CONTROL1(AudioHostMsg_CloseStream,
-                     int /* stream_id */)
-
-// Close an audio input stream specified by stream_id.
-IPC_MESSAGE_CONTROL1(AudioInputHostMsg_CloseStream,
-                     int /* stream_id */)
-
-// Set audio volume of the stream specified by stream_id.
-// TODO(hclam): change this to vector if we have channel numbers other than 2.
-IPC_MESSAGE_CONTROL2(AudioHostMsg_SetVolume,
-                     int /* stream_id */,
-                     double /* volume */)
-
-// Set audio volume of the input stream specified by stream_id.
-IPC_MESSAGE_CONTROL2(AudioInputHostMsg_SetVolume,
-                     int /* stream_id */,
-                     double /* volume */)
-
-#endif  // CONTENT_COMMON_MEDIA_AUDIO_MESSAGES_H_
diff --git a/chromium/content/common/media/cdm_info.cc b/chromium/content/common/media/cdm_info.cc
index 12b98dc56d1..4e3dbbc1e71 100644
--- a/chromium/content/common/media/cdm_info.cc
+++ b/chromium/content/common/media/cdm_info.cc
@@ -9,15 +9,17 @@
 
 namespace content {
 
-CdmInfo::CdmInfo(const std::string& name,
-                 const std::string& guid,
-                 const base::Version& version,
-                 const base::FilePath& path,
-                 const std::string& file_system_id,
-                 const std::vector<media::VideoCodec>& supported_video_codecs,
-                 bool supports_persistent_license,
-                 const std::string& supported_key_system,
-                 bool supports_sub_key_systems)
+CdmInfo::CdmInfo(
+    const std::string& name,
+    const std::string& guid,
+    const base::Version& version,
+    const base::FilePath& path,
+    const std::string& file_system_id,
+    const std::vector<media::VideoCodec>& supported_video_codecs,
+    bool supports_persistent_license,
+    const base::flat_set<media::EncryptionMode>& supported_encryption_schemes,
+    const std::string& supported_key_system,
+    bool supports_sub_key_systems)
     : name(name),
       guid(guid),
       version(version),
@@ -25,13 +27,15 @@ CdmInfo::CdmInfo(const std::string& name,
       file_system_id(file_system_id),
       supported_video_codecs(supported_video_codecs),
       supports_persistent_license(supports_persistent_license),
+      supported_encryption_schemes(supported_encryption_schemes),
       supported_key_system(supported_key_system),
       supports_sub_key_systems(supports_sub_key_systems) {
   DCHECK(base::IsValidGUID(guid));
+  DCHECK(!supported_encryption_schemes.empty());
 }
 
 CdmInfo::CdmInfo(const CdmInfo& other) = default;
 
-CdmInfo::~CdmInfo() {}
+CdmInfo::~CdmInfo() = default;
 
 }  // namespace content
diff --git a/chromium/content/common/media/media_devices.cc b/chromium/content/common/media/media_devices.cc
index 90488d037ad..b2ed9e4e016 100644
--- a/chromium/content/common/media/media_devices.cc
+++ b/chromium/content/common/media/media_devices.cc
@@ -17,11 +17,12 @@ MediaDeviceInfo::MediaDeviceInfo(MediaDeviceInfo&& other) = default;
 
 MediaDeviceInfo::MediaDeviceInfo(const std::string& device_id,
                                  const std::string& label,
-                                 const std::string& group_id)
+                                 const std::string& group_id,
+                                 media::VideoFacingMode video_facing)
     : device_id(device_id),
       label(label),
       group_id(group_id),
-      video_facing(media::VideoFacingMode::MEDIA_VIDEO_FACING_NONE) {}
+      video_facing(video_facing) {}
 
 MediaDeviceInfo::MediaDeviceInfo(
     const media::AudioDeviceDescription& device_description)
@@ -44,9 +45,11 @@ MediaDeviceInfo& MediaDeviceInfo::operator=(const MediaDeviceInfo& other) =
 MediaDeviceInfo& MediaDeviceInfo::operator=(MediaDeviceInfo&& other) = default;
 
 bool operator==(const MediaDeviceInfo& first, const MediaDeviceInfo& second) {
-  return first.device_id == second.device_id && first.label == second.label &&
-         first.group_id == second.group_id &&
-         first.video_facing == second.video_facing;
+  // Do not use the |group_id| and |video_facing| fields for equality comparison
+  // since they are currently not fully supported by the video-capture layer.
+  // The modification of those fields by heuristics in upper layers does not
+  // result in a different device.
+  return first.device_id == second.device_id && first.label == second.label;
 }
 
 }  // namespace content
diff --git a/chromium/content/common/media/media_devices.h b/chromium/content/common/media/media_devices.h
index c0cd354d258..0e3de71288f 100644
--- a/chromium/content/common/media/media_devices.h
+++ b/chromium/content/common/media/media_devices.h
@@ -14,7 +14,7 @@
 namespace media {
 struct AudioDeviceDescription;
 struct VideoCaptureDeviceDescriptor;
-}
+}  // namespace media
 
 namespace content {
 
@@ -29,9 +29,11 @@ struct CONTENT_EXPORT MediaDeviceInfo {
   MediaDeviceInfo();
   MediaDeviceInfo(const MediaDeviceInfo& other);
   MediaDeviceInfo(MediaDeviceInfo&& other);
-  MediaDeviceInfo(const std::string& device_id,
-                  const std::string& label,
-                  const std::string& group_id);
+  MediaDeviceInfo(
+      const std::string& device_id,
+      const std::string& label,
+      const std::string& group_id,
+      media::VideoFacingMode video_facing = media::MEDIA_VIDEO_FACING_NONE);
   explicit MediaDeviceInfo(const media::AudioDeviceDescription& description);
   explicit MediaDeviceInfo(
       const media::VideoCaptureDeviceDescriptor& descriptor);
diff --git a/chromium/content/common/media/media_player_delegate_messages.h b/chromium/content/common/media/media_player_delegate_messages.h
index 7fd75b9430d..451ecbd4fbb 100644
--- a/chromium/content/common/media/media_player_delegate_messages.h
+++ b/chromium/content/common/media/media_player_delegate_messages.h
@@ -13,6 +13,7 @@
 
 #include <stdint.h>
 
+#include "components/viz/common/surfaces/surface_id.h"
 #include "content/common/content_export.h"
 #include "ipc/ipc_message_macros.h"
 #include "media/base/media_content_type.h"
@@ -55,6 +56,26 @@ IPC_MESSAGE_ROUTED2(MediaPlayerDelegateMsg_BecamePersistentVideo,
                     int /* delegate_id, distinguishes instances */,
                     double /* is_persistent */)
 
+IPC_MESSAGE_ROUTED1(MediaPlayerDelegateMsg_EndPictureInPictureMode,
+                    int /* delegate_id, distinguishes instances */)
+
+IPC_MESSAGE_ROUTED2(MediaPlayerDelegateMsg_OnPictureInPictureWindowResize,
+                    int /* delegate_id, distinguishes instances */,
+                    gfx::Size /* window_size */)
+
+// ----------------------------------------------------------------------------
+// Messages from the browser to the renderer acknowledging changes happened.
+// ----------------------------------------------------------------------------
+
+IPC_MESSAGE_ROUTED3(MediaPlayerDelegateMsg_OnPictureInPictureModeStarted_ACK,
+                    int /* delegate id */,
+                    int /* request_id */,
+                    gfx::Size /* window_size */)
+
+IPC_MESSAGE_ROUTED2(MediaPlayerDelegateMsg_OnPictureInPictureModeEnded_ACK,
+                    int /* delegate id */,
+                    int /* request_id */)
+
 // ----------------------------------------------------------------------------
 // Messages from the renderer notifying the browser of playback state changes.
 // ----------------------------------------------------------------------------
@@ -86,10 +107,19 @@ IPC_MESSAGE_ROUTED2(MediaPlayerDelegateHostMsg_OnMediaSizeChanged,
                     int /* delegate_id, distinguishes instances */,
                     gfx::Size /* new size of video */)
 
-IPC_MESSAGE_ROUTED1(MediaPlayerDelegateHostMsg_OnPictureInPictureSourceChanged,
-                    int /* delegate id */)
+IPC_MESSAGE_ROUTED4(MediaPlayerDelegateHostMsg_OnPictureInPictureModeStarted,
+                    int /* delegate id */,
+                    viz::SurfaceId /* surface_id */,
+                    gfx::Size /* natural_size */,
+                    int /* request_id */)
+
+IPC_MESSAGE_ROUTED2(MediaPlayerDelegateHostMsg_OnPictureInPictureModeEnded,
+                    int /* delegate id */,
+                    int /* request_id */)
 
-IPC_MESSAGE_ROUTED1(MediaPlayerDelegateHostMsg_OnPictureInPictureModeEnded,
-                    int /* delegate id */)
+IPC_MESSAGE_ROUTED3(MediaPlayerDelegateHostMsg_OnPictureInPictureSurfaceChanged,
+                    int /* delegate id */,
+                    viz::SurfaceId /* surface_id */,
+                    gfx::Size /* natural_size */)
 
 #endif  // CONTENT_COMMON_MEDIA_MEDIA_PLAYER_DELEGATE_MESSAGES_H_
diff --git a/chromium/content/common/media/media_stream_param_traits.h b/chromium/content/common/media/media_stream_param_traits.h
index 146f5ceca9f..3b58a31792e 100644
--- a/chromium/content/common/media/media_stream_param_traits.h
+++ b/chromium/content/common/media/media_stream_param_traits.h
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // IPC messages for the media streaming.
-// Multiply-included message file, hence no include guard.
+// no-include-guard-because-multiply-included
 
 #include "content/common/content_export.h"
 #include "content/public/common/media_stream_request.h"
@@ -23,6 +23,7 @@ IPC_ENUM_TRAITS_MAX_VALUE(media::VideoFacingMode,
 IPC_STRUCT_TRAITS_BEGIN(content::MediaStreamDevice)
   IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(id)
+  IPC_STRUCT_TRAITS_MEMBER(group_id)
   IPC_STRUCT_TRAITS_MEMBER(video_facing)
   IPC_STRUCT_TRAITS_MEMBER(matched_output_device_id)
   IPC_STRUCT_TRAITS_MEMBER(name)
diff --git a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
index 01a060ff526..63594e29fa6 100644
--- a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
+++ b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
@@ -8,6 +8,7 @@ import "media/mojo/interfaces/audio_data_pipe.mojom";
 import "media/mojo/interfaces/audio_input_stream.mojom";
 import "media/mojo/interfaces/audio_parameters.mojom";
 import "media/mojo/interfaces/media_types.mojom";
+import "mojo/public/mojom/base/unguessable_token.mojom";
 
 // This interface is used by the renderer to ask the browser to create input
 // streams. The renderer supplies the desired audio parameters, and a client
@@ -20,11 +21,22 @@ interface RendererAudioInputStreamFactory {
       media.mojom.AudioParameters params,
       bool automatic_gain_control,
       uint32 shared_memory_count);
+
+  // Associates an output device with an input stream, so that the input knows
+  // which output device to cancel echo from. |input_stream_id| is the id
+  // returned when the stream was created. |output_device_id| is a device
+  // id HMAC. In case either of the parameters are invalid, the operation will
+  // silently fail.
+  AssociateInputAndOutputForAec(
+      mojo_base.mojom.UnguessableToken input_stream_id,
+      string output_device_id);
 };
 
 interface RendererAudioInputStreamFactoryClient {
   // Called when a stream has been created. Will only be called once for every
-  // CreateStream call.
+  // CreateStream call. |stream_id| is a handle used to refer to the stream,
+  // specifically to be able to associate it with an output device for echo
+  // cancellation. Loopback streams don't have ids.
   // TODO(crbug.com/787806): There are plans to allow this function to be called
   // serveral times in the future. If the stream is terminated e.g. due to the
   // process hosting it crashing, this function should be called again with a
@@ -33,5 +45,6 @@ interface RendererAudioInputStreamFactoryClient {
       media.mojom.AudioInputStream stream,
       media.mojom.AudioInputStreamClient& client_request,
       media.mojom.AudioDataPipe data_pipe,
-      bool initially_muted);
+      bool initially_muted,
+      mojo_base.mojom.UnguessableToken? stream_id);
 };
diff --git a/chromium/content/common/native_types.mojom b/chromium/content/common/native_types.mojom
index 59aa3bf9d0f..08151055452 100644
--- a/chromium/content/common/native_types.mojom
+++ b/chromium/content/common/native_types.mojom
@@ -18,7 +18,7 @@ struct FrameReplicationState;
 struct RendererPreferences;
 
 [Native]
-struct ResizeParams;
+struct VisualProperties;
 
 // NOTE: This type is only mapped and usable on Mac.
 [Native]
diff --git a/chromium/content/common/native_types.typemap b/chromium/content/common/native_types.typemap
index 780ba7aa63b..35e7fbb50f7 100644
--- a/chromium/content/common/native_types.typemap
+++ b/chromium/content/common/native_types.typemap
@@ -8,8 +8,8 @@ public_headers = [
   "//content/common/edit_command.h",
   "//content/common/frame_owner_properties.h",
   "//content/common/frame_replication_state.h",
-  "//content/common/resize_params.h",
   "//content/common/input/input_event.h",
+  "//content/common/visual_properties.h",
   "//content/public/common/input_event_ack_source.h",
   "//content/public/common/input_event_ack_state.h",
   "//content/common/input/synthetic_pinch_gesture_params.h",
@@ -46,7 +46,6 @@ public_deps = [
   # includes from //content/common and //content/public/common, this isn't a
   # transitive allowance, so those targets' own public_deps aren't included in
   # the set of implied dependencies.
-  "//cc/ipc",
   "//content/common:buildflags",
   "//media",
   "//media/base/ipc",
@@ -78,7 +77,7 @@ type_mappings = [
   "content.mojom.DidOverscrollParams=ui::DidOverscrollParams",
   "content.mojom.PointerType=blink::WebPointerProperties::PointerType",
   "content.mojom.RendererPreferences=content::RendererPreferences",
-  "content.mojom.ResizeParams=content::ResizeParams",
+  "content.mojom.VisualProperties=content::VisualProperties",
   "content.mojom.ScrollUnits=blink::WebGestureEvent::ScrollUnits",
   "content.mojom.SyntheticSmoothDrag=content::SyntheticSmoothDragGestureParams",
   "content.mojom.SyntheticSmoothScroll=content::SyntheticSmoothScrollGestureParams",
diff --git a/chromium/content/common/native_types_mac.typemap b/chromium/content/common/native_types_mac.typemap
index c162fc14e21..c35085535e7 100644
--- a/chromium/content/common/native_types_mac.typemap
+++ b/chromium/content/common/native_types_mac.typemap
@@ -16,7 +16,6 @@ deps = [
   # includes from //content/common and //content/public/common, this isn't a
   # transitive allowance, so those targets' own public_deps aren't included in
   # the set of implied dependencies.
-  "//cc/ipc",
   "//media",
   "//media/base/ipc",
   "//net",
diff --git a/chromium/content/common/navigation_params.cc b/chromium/content/common/navigation_params.cc
index 6d18f9fefd8..e11e92e86c9 100644
--- a/chromium/content/common/navigation_params.cc
+++ b/chromium/content/common/navigation_params.cc
@@ -45,7 +45,8 @@ CommonNavigationParams::CommonNavigationParams(
     CSPDisposition should_check_main_world_csp,
     bool started_from_context_menu,
     bool has_user_gesture,
-    const base::Optional<std::string>& suggested_filename)
+    const std::vector<ContentSecurityPolicy>& initiator_csp,
+    const base::Optional<CSPSource>& initiator_self_source)
     : url(url),
       referrer(referrer),
       transition(transition),
@@ -64,7 +65,8 @@ CommonNavigationParams::CommonNavigationParams(
       should_check_main_world_csp(should_check_main_world_csp),
       started_from_context_menu(started_from_context_menu),
       has_user_gesture(has_user_gesture),
-      suggested_filename(suggested_filename) {
+      initiator_csp(initiator_csp),
+      initiator_self_source(initiator_self_source) {
   // |method != "POST"| should imply absence of |post_data|.
   if (method != "POST" && post_data) {
     NOTREACHED();
diff --git a/chromium/content/common/navigation_params.h b/chromium/content/common/navigation_params.h
index 806969a8e25..e571195b1cb 100644
--- a/chromium/content/common/navigation_params.h
+++ b/chromium/content/common/navigation_params.h
@@ -15,6 +15,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "content/common/content_security_policy/content_security_policy.h"
 #include "content/common/content_security_policy/csp_disposition_enum.h"
 #include "content/common/frame_message_enums.h"
 #include "content/common/service_worker/service_worker_types.h"
@@ -25,6 +26,7 @@
 #include "content/public/common/request_context_type.h"
 #include "net/url_request/redirect_info.h"
 #include "services/network/public/cpp/resource_request_body.h"
+#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/resource_response_info.h"
 #include "third_party/blink/public/platform/web_mixed_content_context_type.h"
 #include "ui/base/page_transition_types.h"
@@ -76,7 +78,8 @@ struct CONTENT_EXPORT CommonNavigationParams {
       CSPDisposition should_check_main_world_csp,
       bool started_from_context_menu,
       bool has_user_gesture,
-      const base::Optional<std::string>& suggested_filename);
+      const std::vector<ContentSecurityPolicy>& initiator_csp,
+      const base::Optional<CSPSource>& initiator_self_source);
   CommonNavigationParams(const CommonNavigationParams& other);
   ~CommonNavigationParams();
 
@@ -161,10 +164,9 @@ struct CONTENT_EXPORT CommonNavigationParams {
   // True if the request was user initiated.
   bool has_user_gesture = false;
 
-  // If the navigation started in response to a HTML anchor element with a
-  // download attribute, this is the (possible empty) value of the download
-  // attribute.
-  base::Optional<std::string> suggested_filename;
+  // We require a copy of the relevant CSP to perform navigation checks.
+  std::vector<ContentSecurityPolicy> initiator_csp;
+  base::Optional<CSPSource> initiator_self_source;
 };
 
 // Provided by the browser -----------------------------------------------------
@@ -211,7 +213,7 @@ struct CONTENT_EXPORT RequestNavigationParams {
   std::vector<GURL> redirects;
 
   // The ResourceResponseInfos received during redirects.
-  std::vector<network::ResourceResponseInfo> redirect_response;
+  std::vector<network::ResourceResponseHead> redirect_response;
 
   // PlzNavigate
   // The RedirectInfos received during redirects.
diff --git a/chromium/content/common/navigation_subresource_loader_params.cc b/chromium/content/common/navigation_subresource_loader_params.cc
index b465c0f73f8..7c08e6bdda4 100644
--- a/chromium/content/common/navigation_subresource_loader_params.cc
+++ b/chromium/content/common/navigation_subresource_loader_params.cc
@@ -19,6 +19,7 @@ SubresourceLoaderParams& SubresourceLoaderParams::operator=(
   loader_factory_info = std::move(other.loader_factory_info);
   controller_service_worker_info =
       std::move(other.controller_service_worker_info);
+  controller_service_worker_handle = other.controller_service_worker_handle;
   return *this;
 }
 
diff --git a/chromium/content/common/navigation_subresource_loader_params.h b/chromium/content/common/navigation_subresource_loader_params.h
index 2ffa1287594..bb3407579f7 100644
--- a/chromium/content/common/navigation_subresource_loader_params.h
+++ b/chromium/content/common/navigation_subresource_loader_params.h
@@ -5,11 +5,14 @@
 #ifndef CONTENT_COMMON_NAVIGATION_SUBRESOURCE_LOADER_PARAMS_H_
 #define CONTENT_COMMON_NAVIGATION_SUBRESOURCE_LOADER_PARAMS_H_
 
+#include "base/memory/weak_ptr.h"
 #include "content/common/service_worker/controller_service_worker.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace content {
 
+class ServiceWorkerHandle;
+
 // For NetworkService glues:
 // Navigation parameters that are necessary to set-up a subresource loader
 // for the frame that is going to be created by the navigation.
@@ -28,7 +31,13 @@ struct CONTENT_EXPORT SubresourceLoaderParams {
 
   // The controller service worker, non-null if the frame is to be
   // controlled by the service worker.
+  //
+  // |controller_service_worker_info->object_info| is "incomplete". It must be
+  // updated before being sent over Mojo and then registered with
+  // |controller_service_worker_handle|. See
+  // ServiceWorkerHandle::CreateIncompleteObjectInfo() for details.
   mojom::ControllerServiceWorkerInfoPtr controller_service_worker_info;
+  base::WeakPtr<ServiceWorkerHandle> controller_service_worker_handle;
 };
 
 }  // namespace content
diff --git a/chromium/content/common/notifications/notification_struct_traits.cc b/chromium/content/common/notifications/notification_struct_traits.cc
index 3e639b63f1d..6c8fa6bb2b7 100644
--- a/chromium/content/common/notifications/notification_struct_traits.cc
+++ b/chromium/content/common/notifications/notification_struct_traits.cc
@@ -35,7 +35,7 @@ bool ValidateActions(
 
 bool ValidateData(const std::vector<char>& data) {
   return data.size() <=
-         content::PlatformNotificationData::kMaximumDeveloperDataSize;
+         blink::mojom::NotificationData::kMaximumDeveloperDataSize;
 }
 
 bool ValidateImage(const SkBitmap& image) {
diff --git a/chromium/content/common/origin_trials/OWNERS b/chromium/content/common/origin_trials/OWNERS
deleted file mode 100644
index 47b509bfe3e..00000000000
--- a/chromium/content/common/origin_trials/OWNERS
+++ /dev/null
@@ -1,13 +0,0 @@
-# This file also covers ownership of the following directories:
-#   //chrome/common/origin_trials/
-#   //content/renderer/origin_trials/
-#   //third_party/blink/common/origin_trials/
-#   //third_party/blink/public/common/origin_trials/
-#   //tools/origin_trials/
-
-chasej@chromium.org
-iclelland@chromium.org
-mek@chromium.org
-
-# TEAM: experimentation-dev@chromium.org
-# COMPONENT: Internals>OriginTrials
diff --git a/chromium/content/common/origin_trials/trial_policy_impl.cc b/chromium/content/common/origin_trials/trial_policy_impl.cc
deleted file mode 100644
index e85ee25b245..00000000000
--- a/chromium/content/common/origin_trials/trial_policy_impl.cc
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/origin_trials/trial_policy_impl.h"
-
-#include "base/feature_list.h"
-#include "content/public/common/content_client.h"
-#include "content/public/common/content_features.h"
-#include "content/public/common/origin_trial_policy.h"
-#include "content/public/common/origin_util.h"
-#include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
-
-namespace content {
-
-bool TrialPolicyImpl::IsOriginTrialsSupported() const {
-  // In order for the validator to work these are all required.
-  return base::FeatureList::IsEnabled(features::kOriginTrials) && policy() &&
-         !GetPublicKey().empty();
-}
-base::StringPiece TrialPolicyImpl::GetPublicKey() const {
-  return policy()->GetPublicKey();
-}
-bool TrialPolicyImpl::IsFeatureDisabled(base::StringPiece feature) const {
-  return policy()->IsFeatureDisabled(feature);
-}
-bool TrialPolicyImpl::IsTokenDisabled(base::StringPiece token_signature) const {
-  return policy()->IsTokenDisabled(token_signature);
-}
-bool TrialPolicyImpl::IsOriginSecure(const GURL& url) const {
-  return ::content::IsOriginSecure(url);
-}
-
-const OriginTrialPolicy* TrialPolicyImpl::policy() const {
-  return GetContentClient()->GetOriginTrialPolicy();
-}
-
-std::unique_ptr<blink::TrialTokenValidator>
-TrialPolicyImpl::CreateValidatorForPolicy() {
-  return std::make_unique<blink::TrialTokenValidator>(
-      std::make_unique<TrialPolicyImpl>());
-}
-
-}  // namespace content
diff --git a/chromium/content/common/origin_trials/trial_policy_impl.h b/chromium/content/common/origin_trials/trial_policy_impl.h
deleted file mode 100644
index 370c5067b31..00000000000
--- a/chromium/content/common/origin_trials/trial_policy_impl.h
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_POLICY_IMPL_H_
-#define CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_POLICY_IMPL_H_
-
-#include "base/strings/string_piece.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/common/origin_trials/trial_policy.h"
-
-namespace blink {
-class TrialTokenValidator;
-}  // namespace blink
-
-namespace content {
-
-class OriginTrialPolicy;
-
-// TrialPolicyImpl is an adaptor to fit the policy provided by the content
-// embedder via ContentClient to the interface allowed by the DEPS rules of
-// third_party/WebKit/public/common
-// TODO(avallee, kinuko): Plumb the the content embedder policy straight through
-// to the users in third_party/WebKit/public/common/origin_trials.
-class CONTENT_EXPORT TrialPolicyImpl : public blink::TrialPolicy {
- public:
-  bool IsOriginTrialsSupported() const override;
-
-  base::StringPiece GetPublicKey() const override;
-  bool IsFeatureDisabled(base::StringPiece feature) const override;
-  bool IsTokenDisabled(base::StringPiece token_signature) const override;
-  bool IsOriginSecure(const GURL& url) const override;
-
-  static std::unique_ptr<blink::TrialTokenValidator> CreateValidatorForPolicy();
-
- private:
-  const OriginTrialPolicy* policy() const;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_POLICY_IMPL_H_
diff --git a/chromium/content/common/origin_util.cc b/chromium/content/common/origin_util.cc
index 66516d0fed2..6cac476bd4b 100644
--- a/chromium/content/common/origin_util.cc
+++ b/chromium/content/common/origin_util.cc
@@ -7,6 +7,7 @@
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/stl_util.h"
+#include "base/strings/pattern.h"
 #include "content/common/url_schemes.h"
 #include "net/base/url_util.h"
 #include "url/gurl.h"
@@ -23,6 +24,17 @@ bool IsOriginUnique(const url::Origin& origin) {
          base::ContainsValue(url::GetNoAccessSchemes(), origin.scheme());
 }
 
+bool IsWhitelistedSecureOrigin(const url::Origin& origin) {
+  if (base::ContainsValue(content::GetSecureOriginsAndPatterns(),
+                          origin.Serialize()))
+    return true;
+  for (const auto& origin_or_pattern : content::GetSecureOriginsAndPatterns()) {
+    if (base::MatchPattern(origin.host(), origin_or_pattern))
+      return true;
+  }
+  return false;
+}
+
 }  // namespace
 
 namespace content {
@@ -42,10 +54,7 @@ bool IsOriginSecure(const GURL& url) {
   if (base::ContainsValue(url::GetSecureSchemes(), url.scheme()))
     return true;
 
-  if (base::ContainsValue(GetSecureOrigins(), url::Origin::Create(url)))
-    return true;
-
-  return false;
+  return IsWhitelistedSecureOrigin(url::Origin::Create(url));
 }
 
 bool OriginCanAccessServiceWorkers(const GURL& url) {
@@ -74,10 +83,7 @@ bool IsPotentiallyTrustworthyOrigin(const url::Origin& origin) {
     return true;
   }
 
-  if (base::ContainsValue(GetSecureOrigins(), origin))
-    return true;
-
-  return false;
+  return IsWhitelistedSecureOrigin(origin);
 }
 
 }  // namespace content
diff --git a/chromium/content/common/page_state_serialization_unittest.cc b/chromium/content/common/page_state_serialization_unittest.cc
index ffd1a65d0f8..79251f47f77 100644
--- a/chromium/content/common/page_state_serialization_unittest.cc
+++ b/chromium/content/common/page_state_serialization_unittest.cc
@@ -203,7 +203,7 @@ class PageStateSerializationTest : public testing::Test {
                                     int version,
                                     ExplodedPageState* page_state) {
     base::FilePath path;
-    PathService::Get(content::DIR_TEST_DATA, &path);
+    base::PathService::Get(content::DIR_TEST_DATA, &path);
     path = path.AppendASCII("page_state")
                .AppendASCII(
                    base::StringPrintf("serialized_%s.dat", suffix.c_str()));
@@ -396,7 +396,7 @@ TEST_F(PageStateSerializationTest, LegacyEncodePageStateFrozen) {
   LegacyEncodePageStateForTesting(actual_state, 25, &actual_encoded_state);
 
   base::FilePath path;
-  PathService::Get(content::DIR_TEST_DATA, &path);
+  base::PathService::Get(content::DIR_TEST_DATA, &path);
   path = path.AppendASCII("page_state").AppendASCII("serialized_v25.dat");
 
   std::string file_contents;
@@ -459,7 +459,7 @@ TEST_F(PageStateSerializationTest, DumpExpectedPageStateForBackwardsCompat) {
   base::Base64Encode(encoded, &base64);
 
   base::FilePath path;
-  PathService::Get(base::DIR_TEMP, &path);
+  base::PathService::Get(base::DIR_TEMP, &path);
   path = path.AppendASCII("expected.dat");
 
   FILE* fp = base::OpenFile(path, "wb");
diff --git a/chromium/content/common/platform_notification_messages.h b/chromium/content/common/platform_notification_messages.h
index 507b4fb0061..b925cdcd4fd 100644
--- a/chromium/content/common/platform_notification_messages.h
+++ b/chromium/content/common/platform_notification_messages.h
@@ -17,19 +17,10 @@
 #include "content/public/common/platform_notification_data.h"
 #include "ipc/ipc_message_macros.h"
 
-// Singly-included section for type definitions.
-#ifndef INTERNAL_CONTENT_COMMON_PLATFORM_NOTIFICATION_MESSAGES_H_
-#define INTERNAL_CONTENT_COMMON_PLATFORM_NOTIFICATION_MESSAGES_H_
-
-// Defines the pair of [notification id] => [notification data] used when
-// getting the notifications for a given Service Worker registration.
-using PersistentNotificationInfo =
-    std::pair<std::string, content::PlatformNotificationData>;
-
-#endif  // INTERNAL_CONTENT_COMMON_PLATFORM_NOTIFICATION_MESSAGES_H_
-
 #define IPC_MESSAGE_START PlatformNotificationMsgStart
 
+// TODO(https://crbug.com/841329): Delete this legacy IPC code, use a pure
+// mojo struct instead from ServiceWorkerEventDispatcher mojo interface.
 IPC_ENUM_TRAITS_MAX_VALUE(
     content::PlatformNotificationData::Direction,
     content::PlatformNotificationData::DIRECTION_LAST)
@@ -63,48 +54,4 @@ IPC_STRUCT_TRAITS_BEGIN(content::PlatformNotificationData)
   IPC_STRUCT_TRAITS_MEMBER(actions)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::NotificationResources)
-  IPC_STRUCT_TRAITS_MEMBER(image)
-  IPC_STRUCT_TRAITS_MEMBER(notification_icon)
-  IPC_STRUCT_TRAITS_MEMBER(badge)
-  IPC_STRUCT_TRAITS_MEMBER(action_icons)
-IPC_STRUCT_TRAITS_END()
-
-// Messages sent from the browser to the renderer.
-
-// Reply to PlatformNotificationHostMsg_ShowPersistent indicating that a
-// persistent notification has been shown on the platform (if |success| is
-// true), or that an unspecified error occurred.
-IPC_MESSAGE_CONTROL2(PlatformNotificationMsg_DidShowPersistent,
-                     int /* request_id */,
-                     bool /* success */)
-
-// Reply to PlatformNotificationHostMsg_GetNotifications sharing a vector of
-// available notifications per the request's constraints.
-IPC_MESSAGE_CONTROL2(PlatformNotificationMsg_DidGetNotifications,
-                     int /* request_id */,
-                     std::vector<PersistentNotificationInfo>
-                         /* notifications */)
-
-// Messages sent from the renderer to the browser.
-
-IPC_MESSAGE_CONTROL5(
-    PlatformNotificationHostMsg_ShowPersistent,
-    int /* request_id */,
-    int64_t /* service_worker_registration_id */,
-    GURL /* origin */,
-    content::PlatformNotificationData /* notification_data */,
-    content::NotificationResources /* notification_resources */)
-
-IPC_MESSAGE_CONTROL4(PlatformNotificationHostMsg_GetNotifications,
-                     int /* request_id */,
-                     int64_t /* service_worker_registration_id */,
-                     GURL /* origin */,
-                     std::string /* filter_tag */)
-
-IPC_MESSAGE_CONTROL3(PlatformNotificationHostMsg_ClosePersistent,
-                     GURL /* origin */,
-                     std::string /* tag */,
-                     std::string /* notification_id */)
-
 #endif  // CONTENT_COMMON_PLATFORM_NOTIFICATION_MESSAGES_H_
diff --git a/chromium/content/common/possibly_associated_interface_ptr.h b/chromium/content/common/possibly_associated_interface_ptr.h
index f49afcef703..5c70a46e086 100644
--- a/chromium/content/common/possibly_associated_interface_ptr.h
+++ b/chromium/content/common/possibly_associated_interface_ptr.h
@@ -6,6 +6,7 @@
 #define CONTENT_COMMON_POSSIBLY_ASSOCIATED_INTERFACE_PTR_H_
 
 #include "base/macros.h"
+#include "base/single_thread_task_runner.h"
 #include "content/common/possibly_associated_interface_ptr_info.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "mojo/public/cpp/bindings/interface_ptr.h"
diff --git a/chromium/content/common/possibly_associated_wrapper_shared_url_loader_factory.h b/chromium/content/common/possibly_associated_wrapper_shared_url_loader_factory.h
new file mode 100644
index 00000000000..d162a359c0d
--- /dev/null
+++ b/chromium/content/common/possibly_associated_wrapper_shared_url_loader_factory.h
@@ -0,0 +1,18 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_POSSIBLY_ASSOCIATED_WRAPPER_SHARED_URL_LOADER_FACTORY_H_
+#define CONTENT_COMMON_POSSIBLY_ASSOCIATED_WRAPPER_SHARED_URL_LOADER_FACTORY_H_
+
+#include "content/common/possibly_associated_interface_ptr.h"
+#include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
+
+namespace content {
+
+using PossiblyAssociatedWrapperSharedURLLoaderFactory =
+    network::WrapperSharedURLLoaderFactoryBase<PossiblyAssociatedInterfacePtr>;
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_POSSIBLY_ASSOCIATED_WRAPPER_SHARED_URL_LOADER_FACTORY_H_
diff --git a/chromium/content/common/presentation/presentation.typemap b/chromium/content/common/presentation/presentation.typemap
index e6d6a8c0f1e..f69f4453021 100644
--- a/chromium/content/common/presentation/presentation.typemap
+++ b/chromium/content/common/presentation/presentation.typemap
@@ -3,20 +3,10 @@
 # found in the LICENSE file.
 
 mojom = "//third_party/blink/public/platform/modules/presentation/presentation.mojom"
-public_headers = [
-  "//content/public/common/presentation_connection_message.h",
-  "//content/public/common/presentation_info.h",
-]
+public_headers = [ "//content/public/common/presentation_connection_message.h" ]
 traits_headers =
     [ "//content/common/presentation/presentation_struct_traits.h" ]
 deps = [
   "//url",
 ]
-type_mappings = [
-  "blink.mojom.PresentationConnectionCloseReason=content::PresentationConnectionCloseReason",
-  "blink.mojom.PresentationConnectionMessage=content::PresentationConnectionMessage[move_only]",
-  "blink.mojom.PresentationConnectionState=content::PresentationConnectionState",
-  "blink.mojom.PresentationError=content::PresentationError",
-  "blink.mojom.PresentationErrorType=content::PresentationErrorType",
-  "blink.mojom.PresentationInfo=content::PresentationInfo",
-]
+type_mappings = [ "blink.mojom.PresentationConnectionMessage=content::PresentationConnectionMessage[move_only]" ]
diff --git a/chromium/content/common/presentation/presentation_struct_traits.cc b/chromium/content/common/presentation/presentation_struct_traits.cc
index 1db986d74c4..484a772a84e 100644
--- a/chromium/content/common/presentation/presentation_struct_traits.cc
+++ b/chromium/content/common/presentation/presentation_struct_traits.cc
@@ -8,40 +8,6 @@
 
 namespace mojo {
 
-bool StructTraits<blink::mojom::PresentationInfoDataView,
-                  content::PresentationInfo>::
-    Read(blink::mojom::PresentationInfoDataView data,
-         content::PresentationInfo* out) {
-  if (!data.ReadUrl(&(out->presentation_url)) ||
-      !data.ReadId(&(out->presentation_id))) {
-    return false;
-  }
-
-  if (out->presentation_id.empty() ||
-      !base::IsStringASCII(out->presentation_id) ||
-      out->presentation_id.length() > content::PresentationInfo::kMaxIdLength) {
-    return false;
-  }
-  return true;
-}
-
-bool StructTraits<blink::mojom::PresentationErrorDataView,
-                  content::PresentationError>::
-    Read(blink::mojom::PresentationErrorDataView data,
-         content::PresentationError* out) {
-  if (!data.ReadErrorType(&(out->error_type)) ||
-      !data.ReadMessage(&(out->message))) {
-    return false;
-  }
-
-  if (!base::IsStringUTF8(out->message) ||
-      out->message.length() > content::PresentationError::kMaxMessageLength) {
-    return false;
-  }
-
-  return true;
-}
-
 bool UnionTraits<blink::mojom::PresentationConnectionMessageDataView,
                  content::PresentationConnectionMessage>::
     Read(blink::mojom::PresentationConnectionMessageDataView data,
diff --git a/chromium/content/common/presentation/presentation_struct_traits.h b/chromium/content/common/presentation/presentation_struct_traits.h
index 13d406efedf..01e5e1ab535 100644
--- a/chromium/content/common/presentation/presentation_struct_traits.h
+++ b/chromium/content/common/presentation/presentation_struct_traits.h
@@ -12,168 +12,12 @@
 #include "base/optional.h"
 #include "base/strings/string_util.h"
 #include "content/public/common/presentation_connection_message.h"
-#include "content/public/common/presentation_info.h"
 #include "third_party/blink/public/platform/modules/presentation/presentation.mojom.h"
 #include "url/mojom/url.mojom.h"
 
 namespace mojo {
 
 template <>
-struct EnumTraits<blink::mojom::PresentationErrorType,
-                  content::PresentationErrorType> {
-  static blink::mojom::PresentationErrorType ToMojom(
-      content::PresentationErrorType input) {
-    switch (input) {
-      case content::PRESENTATION_ERROR_NO_AVAILABLE_SCREENS:
-        return blink::mojom::PresentationErrorType::NO_AVAILABLE_SCREENS;
-      case content::PRESENTATION_ERROR_PRESENTATION_REQUEST_CANCELLED:
-        return blink::mojom::PresentationErrorType::
-            PRESENTATION_REQUEST_CANCELLED;
-      case content::PRESENTATION_ERROR_NO_PRESENTATION_FOUND:
-        return blink::mojom::PresentationErrorType::NO_PRESENTATION_FOUND;
-      case content::PRESENTATION_ERROR_PREVIOUS_START_IN_PROGRESS:
-        return blink::mojom::PresentationErrorType::PREVIOUS_START_IN_PROGRESS;
-      case content::PRESENTATION_ERROR_UNKNOWN:
-        return blink::mojom::PresentationErrorType::UNKNOWN;
-    }
-    NOTREACHED() << "Unknown content::PresentationErrorType "
-                 << static_cast<int>(input);
-    return blink::mojom::PresentationErrorType::UNKNOWN;
-  }
-
-  static bool FromMojom(blink::mojom::PresentationErrorType input,
-                        content::PresentationErrorType* output) {
-    switch (input) {
-      case blink::mojom::PresentationErrorType::NO_AVAILABLE_SCREENS:
-        *output = content::PRESENTATION_ERROR_NO_AVAILABLE_SCREENS;
-        return true;
-      case blink::mojom::PresentationErrorType::PRESENTATION_REQUEST_CANCELLED:
-        *output = content::PRESENTATION_ERROR_PRESENTATION_REQUEST_CANCELLED;
-        return true;
-      case blink::mojom::PresentationErrorType::NO_PRESENTATION_FOUND:
-        *output = content::PRESENTATION_ERROR_NO_PRESENTATION_FOUND;
-        return true;
-      case blink::mojom::PresentationErrorType::PREVIOUS_START_IN_PROGRESS:
-        *output = content::PRESENTATION_ERROR_PREVIOUS_START_IN_PROGRESS;
-        return true;
-      case blink::mojom::PresentationErrorType::UNKNOWN:
-        *output = content::PRESENTATION_ERROR_UNKNOWN;
-        return true;
-    }
-    return false;
-  }
-};
-
-template <>
-struct EnumTraits<blink::mojom::PresentationConnectionState,
-                  content::PresentationConnectionState> {
-  static blink::mojom::PresentationConnectionState ToMojom(
-      content::PresentationConnectionState input) {
-    switch (input) {
-      case content::PRESENTATION_CONNECTION_STATE_CONNECTING:
-        return blink::mojom::PresentationConnectionState::CONNECTING;
-      case content::PRESENTATION_CONNECTION_STATE_CONNECTED:
-        return blink::mojom::PresentationConnectionState::CONNECTED;
-      case content::PRESENTATION_CONNECTION_STATE_CLOSED:
-        return blink::mojom::PresentationConnectionState::CLOSED;
-      case content::PRESENTATION_CONNECTION_STATE_TERMINATED:
-        return blink::mojom::PresentationConnectionState::TERMINATED;
-    }
-    NOTREACHED() << "Unknown content::PresentationConnectionState "
-                 << static_cast<int>(input);
-    return blink::mojom::PresentationConnectionState::TERMINATED;
-  }
-
-  static bool FromMojom(blink::mojom::PresentationConnectionState input,
-                        content::PresentationConnectionState* output) {
-    switch (input) {
-      case blink::mojom::PresentationConnectionState::CONNECTING:
-        *output = content::PRESENTATION_CONNECTION_STATE_CONNECTING;
-        return true;
-      case blink::mojom::PresentationConnectionState::CONNECTED:
-        *output = content::PRESENTATION_CONNECTION_STATE_CONNECTED;
-        return true;
-      case blink::mojom::PresentationConnectionState::CLOSED:
-        *output = content::PRESENTATION_CONNECTION_STATE_CLOSED;
-        return true;
-      case blink::mojom::PresentationConnectionState::TERMINATED:
-        *output = content::PRESENTATION_CONNECTION_STATE_TERMINATED;
-        return true;
-    }
-    return false;
-  }
-};
-
-template <>
-struct EnumTraits<blink::mojom::PresentationConnectionCloseReason,
-                  content::PresentationConnectionCloseReason> {
-  static blink::mojom::PresentationConnectionCloseReason ToMojom(
-      content::PresentationConnectionCloseReason input) {
-    switch (input) {
-      case content::PRESENTATION_CONNECTION_CLOSE_REASON_CONNECTION_ERROR:
-        return blink::mojom::PresentationConnectionCloseReason::
-            CONNECTION_ERROR;
-      case content::PRESENTATION_CONNECTION_CLOSE_REASON_CLOSED:
-        return blink::mojom::PresentationConnectionCloseReason::CLOSED;
-      case content::PRESENTATION_CONNECTION_CLOSE_REASON_WENT_AWAY:
-        return blink::mojom::PresentationConnectionCloseReason::WENT_AWAY;
-    }
-    NOTREACHED() << "Unknown content::PresentationConnectionCloseReason "
-                 << static_cast<int>(input);
-    return blink::mojom::PresentationConnectionCloseReason::CONNECTION_ERROR;
-  }
-
-  static bool FromMojom(blink::mojom::PresentationConnectionCloseReason input,
-                        content::PresentationConnectionCloseReason* output) {
-    switch (input) {
-      case blink::mojom::PresentationConnectionCloseReason::CONNECTION_ERROR:
-        *output =
-            content::PRESENTATION_CONNECTION_CLOSE_REASON_CONNECTION_ERROR;
-        return true;
-      case blink::mojom::PresentationConnectionCloseReason::CLOSED:
-        *output = content::PRESENTATION_CONNECTION_CLOSE_REASON_CLOSED;
-        return true;
-      case blink::mojom::PresentationConnectionCloseReason::WENT_AWAY:
-        *output = content::PRESENTATION_CONNECTION_CLOSE_REASON_WENT_AWAY;
-        return true;
-    }
-    return false;
-  }
-};
-
-template <>
-struct StructTraits<blink::mojom::PresentationInfoDataView,
-                    content::PresentationInfo> {
-  static const GURL& url(const content::PresentationInfo& presentation_info) {
-    return presentation_info.presentation_url;
-  }
-
-  static const std::string& id(
-      const content::PresentationInfo& presentation_info) {
-    return presentation_info.presentation_id;
-  }
-
-  static bool Read(blink::mojom::PresentationInfoDataView data,
-                   content::PresentationInfo* out);
-};
-
-template <>
-struct StructTraits<blink::mojom::PresentationErrorDataView,
-                    content::PresentationError> {
-  static content::PresentationErrorType error_type(
-      const content::PresentationError& error) {
-    return error.error_type;
-  }
-
-  static const std::string& message(const content::PresentationError& error) {
-    return error.message;
-  }
-
-  static bool Read(blink::mojom::PresentationErrorDataView data,
-                   content::PresentationError* out);
-};
-
-template <>
 struct UnionTraits<blink::mojom::PresentationConnectionMessageDataView,
                    content::PresentationConnectionMessage> {
   static blink::mojom::PresentationConnectionMessageDataView::Tag GetTag(
diff --git a/chromium/content/common/render_frame_metadata.mojom b/chromium/content/common/render_frame_metadata.mojom
index a2283f9d152..28573c16b7b 100644
--- a/chromium/content/common/render_frame_metadata.mojom
+++ b/chromium/content/common/render_frame_metadata.mojom
@@ -4,6 +4,7 @@
 
 module content.mojom;
 
+import "services/viz/public/interfaces/compositing/local_surface_id.mojom";
 import "services/viz/public/interfaces/compositing/selection.mojom";
 import "ui/gfx/geometry/mojo/geometry.mojom";
 
@@ -25,6 +26,32 @@ struct RenderFrameMetadata {
   // Selection region relative to the current viewport. If the selection is
   // empty or otherwise unused, the bound types will indicate such.
   viz.mojom.Selection selection;
+
+  // Determines whether the page is mobile optimized or not, which means at
+  // least one of the following has to be true:
+  // - page has a width=device-width or narrower viewport.
+  // - page prevents zooming in or out (i.e. min and max page scale factors
+  // are the same).
+  bool is_mobile_optimized;
+
+  // The device scale factor used to generate CompositorFrame.
+  float device_scale_factor;
+
+  // The size of the viewport used to generate a CompositorFrame.
+  gfx.mojom.Size viewport_size_in_pixels;
+
+  // The last viz::LocalSurfaceId used to submit a CompositorFrame.
+  viz.mojom.LocalSurfaceId? local_surface_id;
+
+  // Used to position the Android location top bar and page content, whose
+  // precise position is computed by the renderer compositor.
+  float top_controls_height;
+  float top_controls_shown_ratio;
+
+  // Used to position Android bottom bar, whose position is computed by the
+  // renderer compositor.
+  float bottom_controls_height;
+  float bottom_controls_shown_ratio;
 };
 
 // This interface is provided by the renderer. It can optionally enable
diff --git a/chromium/content/common/render_frame_metadata_struct_traits.cc b/chromium/content/common/render_frame_metadata_struct_traits.cc
index e6129ebf056..f17bfdf991d 100644
--- a/chromium/content/common/render_frame_metadata_struct_traits.cc
+++ b/chromium/content/common/render_frame_metadata_struct_traits.cc
@@ -17,8 +17,16 @@ bool StructTraits<content::mojom::RenderFrameMetadataDataView,
          cc::RenderFrameMetadata* out) {
   out->root_background_color = data.root_background_color();
   out->is_scroll_offset_at_top = data.is_scroll_offset_at_top();
+  out->is_mobile_optimized = data.is_mobile_optimized();
+  out->device_scale_factor = data.device_scale_factor();
+  out->top_controls_height = data.top_controls_height();
+  out->top_controls_shown_ratio = data.top_controls_shown_ratio();
+  out->bottom_controls_height = data.bottom_controls_height();
+  out->bottom_controls_shown_ratio = data.bottom_controls_shown_ratio();
   return data.ReadRootScrollOffset(&out->root_scroll_offset) &&
-         data.ReadSelection(&out->selection);
+         data.ReadSelection(&out->selection) &&
+         data.ReadViewportSizeInPixels(&out->viewport_size_in_pixels) &&
+         data.ReadLocalSurfaceId(&out->local_surface_id);
 }
 
 }  // namespace mojo
diff --git a/chromium/content/common/render_frame_metadata_struct_traits.h b/chromium/content/common/render_frame_metadata_struct_traits.h
index de13e7a88c9..fbf17edfa65 100644
--- a/chromium/content/common/render_frame_metadata_struct_traits.h
+++ b/chromium/content/common/render_frame_metadata_struct_traits.h
@@ -8,6 +8,7 @@
 #include "base/optional.h"
 #include "cc/trees/render_frame_metadata.h"
 #include "content/common/render_frame_metadata.mojom-shared.h"
+#include "services/viz/public/cpp/compositing/local_surface_id_struct_traits.h"
 
 namespace mojo {
 
@@ -33,6 +34,42 @@ struct StructTraits<content::mojom::RenderFrameMetadataDataView,
     return metadata.selection;
   }
 
+  static bool is_mobile_optimized(const cc::RenderFrameMetadata& metadata) {
+    return metadata.is_mobile_optimized;
+  }
+
+  static float device_scale_factor(const cc::RenderFrameMetadata& metadata) {
+    return metadata.device_scale_factor;
+  }
+
+  static const gfx::Size& viewport_size_in_pixels(
+      const cc::RenderFrameMetadata& metadata) {
+    return metadata.viewport_size_in_pixels;
+  }
+
+  static const base::Optional<viz::LocalSurfaceId>& local_surface_id(
+      const cc::RenderFrameMetadata& metadata) {
+    return metadata.local_surface_id;
+  }
+
+  static float top_controls_height(const cc::RenderFrameMetadata& metadata) {
+    return metadata.top_controls_height;
+  }
+
+  static float top_controls_shown_ratio(
+      const cc::RenderFrameMetadata& metadata) {
+    return metadata.top_controls_shown_ratio;
+  }
+
+  static float bottom_controls_height(const cc::RenderFrameMetadata& metadata) {
+    return metadata.bottom_controls_height;
+  }
+
+  static float bottom_controls_shown_ratio(
+      const cc::RenderFrameMetadata& metadata) {
+    return metadata.bottom_controls_shown_ratio;
+  }
+
   static bool Read(content::mojom::RenderFrameMetadataDataView data,
                    cc::RenderFrameMetadata* out);
 };
diff --git a/chromium/content/common/renderer.mojom b/chromium/content/common/renderer.mojom
index 05886a72fce..2405622dde3 100644
--- a/chromium/content/common/renderer.mojom
+++ b/chromium/content/common/renderer.mojom
@@ -80,16 +80,7 @@ struct CreateViewParams {
   bool has_committed_real_load;
 
   // The initial renderer size.
-  ResizeParams initial_size;
-
-  // Whether to enable auto-resize.
-  bool enable_auto_resize;
-
-  // The minimum size to layout the page if auto-resize is enabled.
-  gfx.mojom.Size min_size;
-
-  // The maximum size to layout the page if auto-resize is enabled.
-  gfx.mojom.Size max_size;
+  VisualProperties visual_properties;
 
   // The page zoom level.
   double page_zoom_level;
@@ -190,13 +181,6 @@ interface Renderer {
   // Tells the renderer to create a new RenderFrame.
   CreateFrame(CreateFrameParams params);
 
-  // Tells the renderer to create an EmbeddedWorkerInstanceClient, which is what
-  // manages service worker startup and shutdown.
-  // TODO(shimazu): Create a service worker's execution context by this method
-  // instead of just creating an instance of EmbeddedWorkerInstanceClient.
-  SetUpEmbeddedWorkerChannelForServiceWorker(
-      associated EmbeddedWorkerInstanceClient& client_request);
-
   // Tells the renderer to create a new RenderFrameProxy object with
   // |routing_id|.  |render_view_routing_id| identifies the
   // RenderView to be associated with this proxy.  The new proxy's opener should
@@ -212,6 +196,13 @@ interface Renderer {
                    FrameReplicationState replication_state,
                    mojo_base.mojom.UnguessableToken devtools_frame_token);
 
+  // Tells the renderer to create an EmbeddedWorkerInstanceClient, which is what
+  // manages service worker startup and shutdown.
+  // TODO(shimazu): Send all params for starting service worker to reduce the
+  // number of IPCs.
+  SetUpEmbeddedWorkerChannelForServiceWorker(
+      EmbeddedWorkerInstanceClient& client_request);
+
   // Tells the renderer that the network type has changed so that
   // navigator.onLine and navigator.connection can be updated.
   OnNetworkConnectionChanged(NetworkConnectionType connection_type,
@@ -234,6 +225,12 @@ interface Renderer {
   // Android.
   SetWebKitSharedTimersSuspended(bool suspend);
 
+  // Sets the user-agent string. This is needed because getting the value in the
+  // renderer from the system leads to a wrong value due to sandboxing. This
+  // must be called as early as possible, during the renderer process
+  // initialization.
+  SetUserAgent(string user_agent);
+
   // Tells the renderer about a scrollbar appearance change. Only for use on
   // OS X.
   UpdateScrollbarTheme(UpdateScrollbarThemeParams params);
diff --git a/chromium/content/common/resize_params.cc b/chromium/content/common/resize_params.cc
deleted file mode 100644
index 5e1fd102f66..00000000000
--- a/chromium/content/common/resize_params.cc
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/resize_params.h"
-
-namespace content {
-
-ResizeParams::ResizeParams()
-    : auto_resize_enabled(false),
-      auto_resize_sequence_number(0u),
-      browser_controls_shrink_blink_size(false),
-      scroll_focused_node_into_view(false),
-      top_controls_height(0.f),
-      bottom_controls_height(0.f),
-      is_fullscreen_granted(false),
-      display_mode(blink::kWebDisplayModeUndefined),
-      needs_resize_ack(false),
-      content_source_id(0u) {}
-
-ResizeParams::ResizeParams(const ResizeParams& other) = default;
-
-ResizeParams::~ResizeParams() {}
-
-}  // namespace content
diff --git a/chromium/content/common/resource_messages.h b/chromium/content/common/resource_messages.h
index edcf425d7ea..c31444de9a6 100644
--- a/chromium/content/common/resource_messages.h
+++ b/chromium/content/common/resource_messages.h
@@ -21,7 +21,7 @@
 #include "net/base/request_priority.h"
 #include "net/http/http_response_info.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "services/network/public/cpp/network_param_ipc_traits.h"
+#include "services/network/public/cpp/network_ipc_param_traits.h"
 #include "third_party/blink/public/platform/web_mixed_content_context_type.h"
 
 #ifndef INTERNAL_CONTENT_COMMON_RESOURCE_MESSAGES_H_
diff --git a/chromium/content/common/resource_timing_info.h b/chromium/content/common/resource_timing_info.h
index 78b9a61316f..ccac0850564 100644
--- a/chromium/content/common/resource_timing_info.h
+++ b/chromium/content/common/resource_timing_info.h
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/optional.h"
+#include "base/time/time.h"
 
 namespace content {
 
@@ -36,22 +37,22 @@ struct ResourceLoadTiming {
   ResourceLoadTiming(const ResourceLoadTiming&);
   ~ResourceLoadTiming();
 
-  double request_time = 0.0;
-  double proxy_start = 0.0;
-  double proxy_end = 0.0;
-  double dns_start = 0.0;
-  double dns_end = 0.0;
-  double connect_start = 0.0;
-  double connect_end = 0.0;
-  double worker_start = 0.0;
-  double worker_ready = 0.0;
-  double send_start = 0.0;
-  double send_end = 0.0;
-  double receive_headers_end = 0.0;
-  double ssl_start = 0.0;
-  double ssl_end = 0.0;
-  double push_start = 0.0;
-  double push_end = 0.0;
+  base::TimeTicks request_time;
+  base::TimeTicks proxy_start;
+  base::TimeTicks proxy_end;
+  base::TimeTicks dns_start;
+  base::TimeTicks dns_end;
+  base::TimeTicks connect_start;
+  base::TimeTicks connect_end;
+  base::TimeTicks worker_start;
+  base::TimeTicks worker_ready;
+  base::TimeTicks send_start;
+  base::TimeTicks send_end;
+  base::TimeTicks receive_headers_end;
+  base::TimeTicks ssl_start;
+  base::TimeTicks ssl_end;
+  base::TimeTicks push_start;
+  base::TimeTicks push_end;
 };
 
 // TODO(dcheng): Migrate this struct over to Mojo so it doesn't need to be
@@ -64,13 +65,13 @@ struct ResourceTimingInfo {
   ~ResourceTimingInfo();
 
   std::string name;
-  double start_time = 0.0;
+  base::TimeTicks start_time;
   std::string initiator_type;
   std::string alpn_negotiated_protocol;
   std::string connection_info;
   base::Optional<ResourceLoadTiming> timing;
-  double last_redirect_end_time = 0.0;
-  double finish_time = 0.0;
+  base::TimeTicks last_redirect_end_time;
+  base::TimeTicks finish_time;
   uint64_t transfer_size = 0;
   uint64_t encoded_body_size = 0;
   uint64_t decoded_body_size = 0;
diff --git a/chromium/content/common/sandbox_init_mac.cc b/chromium/content/common/sandbox_init_mac.cc
index 583e283f276..ee6202e3178 100644
--- a/chromium/content/common/sandbox_init_mac.cc
+++ b/chromium/content/common/sandbox_init_mac.cc
@@ -51,16 +51,22 @@ base::OnceClosure MaybeWrapWithGPUSandboxHook(
               gpu::SwitchValueToGpuPreferences(value, &gpu_preferences);
           CHECK(success);
         }
+        bool needs_more_info = false;
         gpu::GpuFeatureInfo gpu_feature_info = gpu::ComputeGpuFeatureInfo(
             gpu_info, gpu_preferences.ignore_gpu_blacklist,
             gpu_preferences.disable_gpu_driver_bug_workarounds,
             gpu_preferences.log_gpu_control_list_decisions, command_line,
-            nullptr);
+            &needs_more_info);
         gpu::CacheGpuFeatureInfo(gpu_feature_info);
         if (gpu::SwitchableGPUsSupported(gpu_info, *command_line)) {
           gpu::InitializeSwitchableGPUs(
               gpu_feature_info.enabled_gpu_driver_bug_workarounds);
         }
+        // Calling ShouldEnableSwiftShader will append the proper command line
+        // switch in order to enable SwiftShader if required.
+        gpu::ShouldEnableSwiftShader(
+            command_line, gpu_feature_info,
+            gpu_preferences.disable_software_rasterizer, needs_more_info);
         // Preload either the desktop GL or the osmesa so, depending on the
         // --use-gl flag.
         gl::init::InitializeGLOneOff();
diff --git a/chromium/content/common/sandbox_policy_fuchsia.cc b/chromium/content/common/sandbox_policy_fuchsia.cc
index acfbbfd12d9..26a202b648c 100644
--- a/chromium/content/common/sandbox_policy_fuchsia.cc
+++ b/chromium/content/common/sandbox_policy_fuchsia.cc
@@ -13,41 +13,32 @@
 #include "base/process/launch.h"
 #include "base/process/process.h"
 #include "content/public/common/content_switches.h"
+#include "services/service_manager/sandbox/switches.h"
 
 namespace content {
 
 void UpdateLaunchOptionsForSandbox(service_manager::SandboxType type,
                                    base::LaunchOptions* options) {
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kNoSandbox)) {
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          service_manager::switches::kNoSandbox)) {
     type = service_manager::SANDBOX_TYPE_NO_SANDBOX;
   }
 
   if (type != service_manager::SANDBOX_TYPE_NO_SANDBOX) {
-    auto package_root = base::GetPackageRoot();
-    if (!package_root.empty()) {
-      // TODO(kmarshall): Build path mappings for each sandbox type.
-
-      // Map /pkg (read-only files deployed from the package) and /tmp into the
-      // child's namespace.
-      options->paths_to_map.push_back(package_root.AsUTF8Unsafe());
-      base::FilePath temp_dir;
-      base::GetTempDir(&temp_dir);
-      options->paths_to_map.push_back(temp_dir.AsUTF8Unsafe());
-
-      // Clear environmental variables to better isolate the child from
-      // this process.
-      options->clear_environ = true;
-
-      // Propagate stdout/stderr/stdin to the child.
-      options->clone_flags = LP_CLONE_FDIO_STDIO;
-      return;
-    }
-
-    // TODO(crbug.com/750938): Remove this once package deployments become
-    //                         mandatory.
-    LOG(ERROR) << "Sandboxing was requested but is not available because"
-               << "the parent process is not hosted within a package.";
-    type = service_manager::SANDBOX_TYPE_NO_SANDBOX;
+    // Map /pkg (read-only files deployed from the package) and /tmp into the
+    // child's namespace.
+    options->paths_to_map.push_back(base::GetPackageRoot());
+    base::FilePath temp_dir;
+    base::GetTempDir(&temp_dir);
+    options->paths_to_map.push_back(temp_dir);
+
+    // Clear environmental variables to better isolate the child from
+    // this process.
+    options->clear_environ = true;
+
+    // Propagate stdout/stderr/stdin to the child.
+    options->clone_flags = LP_CLONE_FDIO_STDIO;
+    return;
   }
 
   DCHECK_EQ(type, service_manager::SANDBOX_TYPE_NO_SANDBOX);
diff --git a/chromium/content/common/send_zygote_child_ping_linux.cc b/chromium/content/common/send_zygote_child_ping_linux.cc
deleted file mode 100644
index f7f1685834b..00000000000
--- a/chromium/content/common/send_zygote_child_ping_linux.cc
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/common/send_zygote_child_ping_linux.h"
-
-#include <vector>
-
-#include "base/posix/unix_domain_socket.h"
-#include "content/common/zygote_commands_linux.h"
-
-namespace content {
-
-bool SendZygoteChildPing(int fd) {
-  return base::UnixDomainSocket::SendMsg(fd,
-                                         kZygoteChildPingMessage,
-                                         sizeof(kZygoteChildPingMessage),
-                                         std::vector<int>());
-}
-
-}  // namespace content
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl.cc b/chromium/content/common/service_manager/service_manager_connection_impl.cc
index 49f0da67e49..dac316d7662 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl.cc
+++ b/chromium/content/common/service_manager/service_manager_connection_impl.cc
@@ -13,9 +13,10 @@
 #include "base/callback_helpers.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
-#include "base/message_loop/message_loop.h"
+#include "base/message_loop/message_loop_current.h"
 #include "base/threading/thread_checker.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "build/build_config.h"
 #include "content/common/child.mojom.h"
 #include "content/public/common/connection_filter.h"
 #include "content/public/common/service_names.mojom.h"
@@ -28,6 +29,13 @@
 #include "services/service_manager/public/mojom/service_factory.mojom.h"
 #include "services/service_manager/runner/common/client_util.h"
 
+#if defined(OS_ANDROID)
+#include "base/android/jni_android.h"
+#include "jni/ServiceManagerConnectionImpl_jni.h"
+#include "services/service_manager/public/cpp/connector.h"
+#include "services/service_manager/public/mojom/connector.mojom.h"
+#endif
+
 namespace content {
 namespace {
 
@@ -133,15 +141,16 @@ class ServiceManagerConnectionImpl::IOThreadContext
  private:
   friend class base::RefCountedThreadSafe<IOThreadContext>;
 
-  class MessageLoopObserver : public base::MessageLoop::DestructionObserver {
+  class MessageLoopObserver
+      : public base::MessageLoopCurrent::DestructionObserver {
    public:
     explicit MessageLoopObserver(base::WeakPtr<IOThreadContext> context)
         : context_(context) {
-      base::MessageLoop::current()->AddDestructionObserver(this);
+      base::MessageLoopCurrent::Get()->AddDestructionObserver(this);
     }
 
     ~MessageLoopObserver() override {
-      base::MessageLoop::current()->RemoveDestructionObserver(this);
+      base::MessageLoopCurrent::Get()->RemoveDestructionObserver(this);
     }
 
     void ShutDown() {
@@ -350,6 +359,23 @@ class ServiceManagerConnectionImpl::IOThreadContext
   DISALLOW_COPY_AND_ASSIGN(IOThreadContext);
 };
 
+#if defined(OS_ANDROID)
+// static
+jint JNI_ServiceManagerConnectionImpl_GetConnectorMessagePipeHandle(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jclass>& jcaller) {
+  DCHECK(ServiceManagerConnection::GetForProcess());
+
+  service_manager::mojom::ConnectorPtrInfo connector_info;
+  ServiceManagerConnection::GetForProcess()
+      ->GetConnector()
+      ->BindConnectorRequest(mojo::MakeRequest(&connector_info));
+
+  return connector_info.PassHandle().release().value();
+}
+
+#endif
+
 ////////////////////////////////////////////////////////////////////////////////
 // ServiceManagerConnection, public:
 
diff --git a/chromium/content/common/service_worker/BUILD.gn b/chromium/content/common/service_worker/BUILD.gn
new file mode 100644
index 00000000000..65c27c138fc
--- /dev/null
+++ b/chromium/content/common/service_worker/BUILD.gn
@@ -0,0 +1,11 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//third_party/protobuf/proto_library.gni")
+
+proto_library("service_worker_types_proto") {
+  sources = [
+    "service_worker_types.proto",
+  ]
+}
diff --git a/chromium/content/common/service_worker/dispatch_fetch_event_params.mojom b/chromium/content/common/service_worker/dispatch_fetch_event_params.mojom
index 05d50cc0893..785d219b776 100644
--- a/chromium/content/common/service_worker/dispatch_fetch_event_params.mojom
+++ b/chromium/content/common/service_worker/dispatch_fetch_event_params.mojom
@@ -19,9 +19,23 @@ struct DispatchFetchEventParams {
   // FetchEvent#request.
   network.mojom.URLRequest request;
 
-  // For Non-S13nServiceWorker these |request_body_*| fields are used to create
-  // FetchEvent#request#body.  For S13nServiceWorker, the body is provided in
-  // |request.request_body|, and these fields are not used.
+  // The following fields are used to create FetchEvent#request#body, depending
+  // on whether S13nServiceWorker/NetworkService are enabled.
+
+  // (A) S13nServiceWorker with NetworkService on:
+  // All information about the request body is provided in
+  // |request.request_body|.
+
+  // (B) S13nServiceWorker with NetworkService off:
+  // All information about the request body except for BlobPtrs is provided in
+  // |request.request_body|. These BlobPtrs need to be passed separately.
+  // Once the NetworkService is enabled, this will be no longer used since all
+  // Blobs are passed as data pipes which can live in |request.request_body|.
+  array<blink.mojom.Blob> request_body_blob_ptrs;
+
+  // (C) non-S13nServiceWorker:
+  // All information to create the request body are packed into a blob. These
+  // params are for passing the blob.
   string request_body_blob_uuid;
   uint64 request_body_blob_size;
   blink.mojom.Blob? request_body_blob;
diff --git a/chromium/content/common/service_worker/embedded_worker.mojom b/chromium/content/common/service_worker/embedded_worker.mojom
index 1dbda4e6cbc..a9c5333ade0 100644
--- a/chromium/content/common/service_worker/embedded_worker.mojom
+++ b/chromium/content/common/service_worker/embedded_worker.mojom
@@ -12,7 +12,6 @@ import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/time.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "services/service_manager/public/mojom/interface_provider.mojom";
-import "third_party/blink/public/mojom/service_worker/service_worker.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_installed_scripts_manager.mojom";
 import "third_party/blink/public/platform/web_feature.mojom";
 import "third_party/blink/public/web/console_message.mojom";
@@ -58,9 +57,6 @@ struct EmbeddedWorkerStartParams {
   ControllerServiceWorker& controller_request;
   // Information to transfer installed scripts from the browser to the renderer.
   blink.mojom.ServiceWorkerInstalledScriptsInfo? installed_scripts_info;
-  // Interface for the renderer to ask the browser to do operations needed for
-  // ServiceWorkerGlobalScope functionalities.
-  associated blink.mojom.ServiceWorkerHost service_worker_host;
   // Interface for the renderer to send the status updates to the browser.
   associated EmbeddedWorkerInstanceHost instance_host;
   // Information for creating ServiceWorkerNetworkProvider on the renderer.
diff --git a/chromium/content/common/service_worker/service_worker_container.mojom b/chromium/content/common/service_worker/service_worker_container.mojom
index 07dc0255a65..ef8136d3e89 100644
--- a/chromium/content/common/service_worker/service_worker_container.mojom
+++ b/chromium/content/common/service_worker/service_worker_container.mojom
@@ -99,7 +99,7 @@ interface ServiceWorkerContainerHost {
 // to use this name.
 interface ServiceWorkerContainer {
   // Corresponds to setting ServiceWorkerContainer#controller.
-  // If |controller_info| is invalid (its |handle_id| is invalid), then
+  // If |controller_info| is invalid (its |object_info| is null), then
   // ServiceWorkerContainer#controller is cleared.
   // If |controller_info| is valid, |used_features| is the set of
   // features the controller has used, for UseCounter purposes.
diff --git a/chromium/content/common/service_worker/service_worker_event_dispatcher.mojom b/chromium/content/common/service_worker/service_worker_event_dispatcher.mojom
index 2d97943541e..dc52bf442f0 100644
--- a/chromium/content/common/service_worker/service_worker_event_dispatcher.mojom
+++ b/chromium/content/common/service_worker/service_worker_event_dispatcher.mojom
@@ -8,12 +8,15 @@ import "content/common/service_worker/dispatch_fetch_event_params.mojom";
 import "content/common/service_worker/service_worker_fetch_response_callback.mojom";
 import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/time.mojom";
+import "services/network/public/mojom/cookie_manager.mojom";
 import "third_party/blink/public/platform/modules/fetch/fetch_api_request.mojom";
 import "third_party/blink/public/platform/modules/payments/payment_app.mojom";
 import "third_party/blink/public/mojom/message_port/message_port.mojom";
+import "third_party/blink/public/mojom/service_worker/service_worker.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_client.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_event_status.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_object.mojom";
+import "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom";
 import "url/mojom/origin.mojom";
 import "url/mojom/url.mojom";
 
@@ -63,6 +66,17 @@ const int32 kPushEventTimeoutSeconds = 90;
 // 'simple events'. ServiceWorkerVersion::CreateSimpleEventCallback can be used
 // to create the callback for these.
 interface ServiceWorkerEventDispatcher {
+  // The first message sent on this interface. It is used to associate service
+  // worker-related interfaces together on the service worker thread, as
+  // ServiceWorkerEventDispatcher is the first interface available on the
+  // service worker thread. It establishes the |service_worker_host| connection
+  // and passes information used to populate
+  // ServiceWorkerGlobalScope#registration object. JavaScript execution of the
+  // service worker does not start until this message is received.
+  InitializeGlobalScope(
+      associated blink.mojom.ServiceWorkerHost service_worker_host,
+      blink.mojom.ServiceWorkerRegistrationObjectInfo registration_info);
+
   DispatchInstallEvent()
       => (blink.mojom.ServiceWorkerEventStatus status,
           bool has_fetch_handler,
@@ -76,7 +90,9 @@ interface ServiceWorkerEventDispatcher {
   // The callbacks are called once the event handler has run and waitUntil()
   // promise has settled. |developer_id| and |unique_id| are documented in
   // content::BackgroundFetchRegistrationId.
-  DispatchBackgroundFetchAbortEvent(string developer_id)
+  DispatchBackgroundFetchAbortEvent(string developer_id,
+                                    string unique_id,
+                                    array<BackgroundFetchSettledFetch> fetches)
       => (blink.mojom.ServiceWorkerEventStatus status,
           mojo_base.mojom.Time dispatch_event_time);
   DispatchBackgroundFetchClickEvent(string developer_id,
@@ -84,6 +100,7 @@ interface ServiceWorkerEventDispatcher {
       => (blink.mojom.ServiceWorkerEventStatus status,
           mojo_base.mojom.Time dispatch_event_time);
   DispatchBackgroundFetchFailEvent(string developer_id,
+                                   string unique_id,
                                    array<BackgroundFetchSettledFetch> fetches)
       => (blink.mojom.ServiceWorkerEventStatus status,
           mojo_base.mojom.Time dispatch_event_time);
@@ -93,6 +110,16 @@ interface ServiceWorkerEventDispatcher {
       => (blink.mojom.ServiceWorkerEventStatus status,
           mojo_base.mojom.Time dispatch_event_time);
 
+  // Dispatches the cookie change events in the Async Cookie API specification.
+  // https://github.com/WICG/cookie-store/
+  // The callback is called once the event handler has run and the waitUntil()
+  // promise has settled.
+  DispatchCookieChangeEvent(
+      network.mojom.CanonicalCookie cookie,
+      network.mojom.CookieChangeCause cause)
+      => (blink.mojom.ServiceWorkerEventStatus status,
+          mojo_base.mojom.Time dispatch_event_time);
+
   // The Dispatch*FetchEvent() callback is called once the event finishes,
   // which means the event handler ran and all outstanding respondWith() and
   // waitUntil() promises have settled. |response_callback| is called once the
diff --git a/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.cc b/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.cc
index 28378abbaf7..a6b3557e7e3 100644
--- a/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.cc
+++ b/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.cc
@@ -207,10 +207,12 @@ bool StructTraits<blink::mojom::FetchAPIRequestDataView,
     Read(blink::mojom::FetchAPIRequestDataView data,
          content::ServiceWorkerFetchRequest* out) {
   std::unordered_map<std::string, std::string> headers;
+  blink::mojom::SerializedBlobPtr serialized_blob_ptr;
   if (!data.ReadMode(&out->mode) ||
       !data.ReadRequestContextType(&out->request_context_type) ||
       !data.ReadFrameType(&out->frame_type) || !data.ReadUrl(&out->url) ||
       !data.ReadMethod(&out->method) || !data.ReadHeaders(&headers) ||
+      !data.ReadBlob(&serialized_blob_ptr) ||
       !data.ReadReferrer(&out->referrer) ||
       !data.ReadCredentialsMode(&out->credentials_mode) ||
       !data.ReadRedirectMode(&out->redirect_mode) ||
@@ -220,11 +222,7 @@ bool StructTraits<blink::mojom::FetchAPIRequestDataView,
   }
 
   // content::ServiceWorkerFetchRequest doesn't support request body.
-  base::Optional<std::string> blob_uuid;
-  if (data.ReadBlobUuid(&blob_uuid) && blob_uuid && !blob_uuid->empty())
-    return false;
-  blink::mojom::BlobPtr blob = data.TakeBlob<blink::mojom::BlobPtr>();
-  if (blob)
+  if (serialized_blob_ptr)
     return false;
 
   out->is_main_resource_load = data.is_main_resource_load();
diff --git a/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.h b/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.h
index 55862700585..fe8cc4e2e27 100644
--- a/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.h
+++ b/chromium/content/common/service_worker/service_worker_fetch_request_mojom_traits.h
@@ -63,18 +63,7 @@ struct StructTraits<blink::mojom::FetchAPIRequestDataView,
   }
 
   // content::ServiceWorkerFetchRequest does not support the request body.
-  static const std::string& blob_uuid(
-      const content::ServiceWorkerFetchRequest& request) {
-    return base::EmptyString();
-  }
-
-  // content::ServiceWorkerFetchRequest does not support the request body.
-  static uint64_t blob_size(const content::ServiceWorkerFetchRequest& request) {
-    return 0;
-  }
-
-  // content::ServiceWorkerFetchRequest does not support the request body.
-  static blink::mojom::BlobPtr blob(
+  static blink::mojom::SerializedBlobPtr blob(
       const content::ServiceWorkerFetchRequest& request) {
     return nullptr;
   }
diff --git a/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.cc b/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.cc
index 4d615363d26..64a9ed1b85f 100644
--- a/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.cc
+++ b/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.cc
@@ -23,24 +23,38 @@ bool StructTraits<blink::mojom::FetchAPIResponseDataView,
                   content::ServiceWorkerResponse>::
     Read(blink::mojom::FetchAPIResponseDataView data,
          content::ServiceWorkerResponse* out) {
+  blink::mojom::SerializedBlobPtr serialized_blob_ptr;
+  blink::mojom::SerializedBlobPtr serialized_side_data_blob_ptr;
   if (!data.ReadUrlList(&out->url_list) ||
       !data.ReadStatusText(&out->status_text) ||
       !data.ReadResponseType(&out->response_type) ||
-      !data.ReadHeaders(&out->headers) || !data.ReadBlobUuid(&out->blob_uuid) ||
-      !data.ReadError(&out->error) ||
+      !data.ReadHeaders(&out->headers) ||
+      !data.ReadBlob(&serialized_blob_ptr) || !data.ReadError(&out->error) ||
       !data.ReadResponseTime(&out->response_time) ||
       !data.ReadCacheStorageCacheName(&out->cache_storage_cache_name) ||
-      !data.ReadCorsExposedHeaderNames(&out->cors_exposed_header_names)) {
+      !data.ReadCorsExposedHeaderNames(&out->cors_exposed_header_names) ||
+      !data.ReadSideDataBlob(&serialized_side_data_blob_ptr)) {
     return false;
   }
 
   out->status_code = data.status_code();
-  out->blob_size = data.blob_size();
   out->is_in_cache_storage = data.is_in_cache_storage();
 
-  if (!out->blob_uuid.empty()) {
-    blink::mojom::BlobPtr blob = data.TakeBlob<blink::mojom::BlobPtr>();
-    out->blob = base::MakeRefCounted<storage::BlobHandle>(std::move(blob));
+  if (serialized_blob_ptr) {
+    out->blob_uuid = serialized_blob_ptr->uuid;
+    out->blob_size = serialized_blob_ptr->size;
+    blink::mojom::BlobPtr blob_ptr;
+    blob_ptr.Bind(std::move(serialized_blob_ptr->blob));
+    out->blob = base::MakeRefCounted<storage::BlobHandle>(std::move(blob_ptr));
+  }
+
+  if (serialized_side_data_blob_ptr) {
+    out->side_data_blob_uuid = serialized_side_data_blob_ptr->uuid;
+    out->side_data_blob_size = serialized_side_data_blob_ptr->size;
+    blink::mojom::BlobPtr blob_ptr;
+    blob_ptr.Bind(std::move(serialized_side_data_blob_ptr->blob));
+    out->side_data_blob =
+        base::MakeRefCounted<storage::BlobHandle>(std::move(blob_ptr));
   }
 
   return true;
diff --git a/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.h b/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.h
index 51d7d859813..287ac17b670 100644
--- a/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.h
+++ b/chromium/content/common/service_worker/service_worker_fetch_response_mojom_traits.h
@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/numerics/safe_conversions.h"
+#include "content/common/content_export.h"
 #include "content/common/service_worker/service_worker_types.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
 #include "third_party/blink/public/platform/modules/fetch/fetch_api_response.mojom.h"
@@ -16,8 +17,8 @@
 namespace mojo {
 
 template <>
-struct StructTraits<blink::mojom::FetchAPIResponseDataView,
-                    content::ServiceWorkerResponse> {
+struct CONTENT_EXPORT StructTraits<blink::mojom::FetchAPIResponseDataView,
+                                   content::ServiceWorkerResponse> {
   static const std::vector<GURL>& url_list(
       const content::ServiceWorkerResponse& response) {
     return response.url_list;
@@ -29,10 +30,15 @@ struct StructTraits<blink::mojom::FetchAPIResponseDataView,
       const content::ServiceWorkerResponse& response) {
     return response.is_in_cache_storage;
   }
-  static blink::mojom::BlobPtr blob(
+  static blink::mojom::SerializedBlobPtr blob(
       const content::ServiceWorkerResponse& response) {
     if (response.blob) {
-      return response.blob->Clone();
+      blink::mojom::SerializedBlobPtr serialized_blob_ptr =
+          blink::mojom::SerializedBlob::New();
+      serialized_blob_ptr->uuid = response.blob_uuid;
+      serialized_blob_ptr->size = response.blob_size;
+      serialized_blob_ptr->blob = response.blob->Clone().PassInterface();
+      return serialized_blob_ptr;
     }
     return nullptr;
   }
@@ -50,12 +56,6 @@ struct StructTraits<blink::mojom::FetchAPIResponseDataView,
   headers(const content::ServiceWorkerResponse& response) {
     return response.headers;
   }
-  static std::string blob_uuid(const content::ServiceWorkerResponse& response) {
-    return response.blob_uuid;
-  }
-  static uint64_t blob_size(const content::ServiceWorkerResponse& response) {
-    return response.blob_size;
-  }
   static blink::mojom::ServiceWorkerResponseError error(
       const content::ServiceWorkerResponse& response) {
     return response.error;
@@ -72,6 +72,19 @@ struct StructTraits<blink::mojom::FetchAPIResponseDataView,
       const content::ServiceWorkerResponse& response) {
     return response.cors_exposed_header_names;
   }
+  static blink::mojom::SerializedBlobPtr side_data_blob(
+      const content::ServiceWorkerResponse& response) {
+    if (response.side_data_blob) {
+      blink::mojom::SerializedBlobPtr serialized_blob_ptr =
+          blink::mojom::SerializedBlob::New();
+      serialized_blob_ptr->uuid = response.side_data_blob_uuid;
+      serialized_blob_ptr->size = response.side_data_blob_size;
+      serialized_blob_ptr->blob =
+          response.side_data_blob->Clone().PassInterface();
+      return serialized_blob_ptr;
+    }
+    return nullptr;
+  }
   static bool Read(blink::mojom::FetchAPIResponseDataView,
                    content::ServiceWorkerResponse* output);
 };
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.cc b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
index 0b4912c8982..738ed311a07 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.cc
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
@@ -156,47 +156,4 @@ int ServiceWorkerLoaderHelpers::ReadBlobResponseBody(
   return net::OK;
 }
 
-// static
-scoped_refptr<network::ResourceRequestBody>
-ServiceWorkerLoaderHelpers::CloneResourceRequestBody(
-    const network::ResourceRequestBody* body) {
-  auto clone = base::MakeRefCounted<network::ResourceRequestBody>();
-
-  clone->set_identifier(body->identifier());
-  clone->set_contains_sensitive_info(body->contains_sensitive_info());
-  for (const network::DataElement& element : *body->elements()) {
-    switch (element.type()) {
-      case network::DataElement::TYPE_UNKNOWN:
-        NOTREACHED();
-        break;
-      case network::DataElement::TYPE_DATA_PIPE: {
-        clone->AppendDataPipe(element.CloneDataPipeGetter());
-        break;
-      }
-      case network::DataElement::TYPE_RAW_FILE:
-        clone->AppendRawFileRange(element.file().Duplicate(), element.path(),
-                                  element.offset(), element.length(),
-                                  element.expected_modification_time());
-        break;
-      case network::DataElement::TYPE_CHUNKED_DATA_PIPE:
-        NOTREACHED() << "There should be no chunked data pipes going through "
-                        "ServiceWorker";
-        break;
-      case network::DataElement::TYPE_BLOB:
-        NOTREACHED() << "There should be no blob elements in NetworkService";
-        break;
-      case network::DataElement::TYPE_FILE:
-        clone->AppendFileRange(element.path(), element.offset(),
-                               element.length(),
-                               element.expected_modification_time());
-        break;
-      case network::DataElement::TYPE_BYTES:
-        clone->AppendBytes(element.bytes(), element.length());
-        break;
-    }
-  }
-
-  return clone;
-}
-
 }  // namespace content
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.h b/chromium/content/common/service_worker/service_worker_loader_helpers.h
index 3654e07fcfe..a709385b4f2 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.h
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.h
@@ -12,7 +12,6 @@
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
 
 namespace network {
-class ResourceRequestBody;
 struct ResourceRequest;
 struct ResourceResponseHead;
 }
@@ -49,15 +48,6 @@ class ServiceWorkerLoaderHelpers {
       const net::HttpRequestHeaders& headers,
       base::OnceCallback<void(int net_error)> on_blob_read_complete,
       mojo::ScopedDataPipeConsumerHandle* handle_out);
-
-  // Returns a new copy of the given body. This is useful for service worker
-  // with NetworkService because it sends the ResourceRequestBody over Mojo IPC,
-  // which moves out the DataPipeGetter elements in the Pickle code in
-  // resources_messages.cc. We can't change the Pickle code to call
-  // DataPipeGetter's Clone method because that code can run on different thread
-  // than the DataPipeGetter.
-  static scoped_refptr<network::ResourceRequestBody> CloneResourceRequestBody(
-      const network::ResourceRequestBody* body);
 };
 
 }  // namespace content
diff --git a/chromium/content/common/service_worker/service_worker_messages.h b/chromium/content/common/service_worker/service_worker_messages.h
index 9c6dd91051c..8cba139aba4 100644
--- a/chromium/content/common/service_worker/service_worker_messages.h
+++ b/chromium/content/common/service_worker/service_worker_messages.h
@@ -26,12 +26,8 @@
 
 #define IPC_MESSAGE_START ServiceWorkerMsgStart
 
-IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::ServiceWorkerErrorType,
-                          blink::mojom::ServiceWorkerErrorType::kMaxValue)
-
-IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::ServiceWorkerState,
-                          blink::mojom::ServiceWorkerState::kMaxValue)
-
+// TODO(leonhsl): Figure out what's the purpose of all these traits then
+// eliminate this file finally.
 IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::ServiceWorkerResponseError,
                           blink::mojom::ServiceWorkerResponseError::kMaxValue)
 
@@ -76,18 +72,4 @@ IPC_STRUCT_TRAITS_BEGIN(content::PushEventPayload)
   IPC_STRUCT_TRAITS_MEMBER(is_null)
 IPC_STRUCT_TRAITS_END()
 
-//---------------------------------------------------------------------------
-// Messages sent from the browser to the child process.
-//
-// NOTE: All ServiceWorkerMsg messages not sent via EmbeddedWorker must have
-// a thread_id as their first field so that ServiceWorkerMessageFilter can
-// extract it and dispatch the message to the correct ServiceWorkerDispatcher
-// on the correct thread.
-
-// Informs the child process that the ServiceWorker's state has changed.
-IPC_MESSAGE_CONTROL3(ServiceWorkerMsg_ServiceWorkerStateChanged,
-                     int /* thread_id */,
-                     int /* handle_id */,
-                     blink::mojom::ServiceWorkerState)
-
 #endif  // CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_MESSAGES_H_
diff --git a/chromium/content/common/service_worker/service_worker_provider.mojom b/chromium/content/common/service_worker/service_worker_provider.mojom
index de8bda5821d..17fdfada95a 100644
--- a/chromium/content/common/service_worker/service_worker_provider.mojom
+++ b/chromium/content/common/service_worker/service_worker_provider.mojom
@@ -9,6 +9,7 @@ import "services/network/public/mojom/url_loader_factory.mojom";
 import "services/service_manager/public/mojom/interface_provider.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_provider_type.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom";
+import "third_party/blink/public/platform/modules/cache_storage/cache_storage.mojom";
 
 // The name of the InterfaceProviderSpec in service manifests used by the
 // frame tree to expose service-worker-specific interfaces between renderer
@@ -30,9 +31,6 @@ struct ServiceWorkerProviderInfoForSharedWorker {
 // worker.
 struct ServiceWorkerProviderInfoForStartWorker {
   int32 provider_id;
-  // |registration| is information about the service worker's
-  // registration used to populate ServiceWorkerGlobalScope#registration.
-  blink.mojom.ServiceWorkerRegistrationObjectInfo registration;
 
   associated ServiceWorkerContainerHost host_ptr_info;
   associated ServiceWorkerContainer& client_request;
@@ -42,6 +40,13 @@ struct ServiceWorkerProviderInfoForStartWorker {
   // importScripts().
   associated network.mojom.URLLoaderFactory? script_loader_factory_ptr_info;
 
+  // |cache_storage| is an optional optimization so the service worker can use
+  // the Cache Storage API immediately without using InterfaceProvider. May be
+  // null for service workers created for update checks, as the optimization
+  // would be wasteful because these workers usually are aborted after the
+  // byte-to-byte update check before running.
+  blink.mojom.CacheStorage? cache_storage;
+
   service_manager.mojom.InterfaceProvider interface_provider;
 };
 
diff --git a/chromium/content/common/service_worker/service_worker_types.cc b/chromium/content/common/service_worker/service_worker_types.cc
index 4f93a652e54..97f523803f3 100644
--- a/chromium/content/common/service_worker/service_worker_types.cc
+++ b/chromium/content/common/service_worker/service_worker_types.cc
@@ -4,6 +4,7 @@
 
 #include "content/common/service_worker/service_worker_types.h"
 
+#include "content/common/service_worker/service_worker_types.pb.h"
 #include "net/base/load_flags.h"
 #include "storage/common/blob_storage/blob_handle.h"
 
@@ -55,6 +56,28 @@ ServiceWorkerFetchRequest& ServiceWorkerFetchRequest::operator=(
 
 ServiceWorkerFetchRequest::~ServiceWorkerFetchRequest() {}
 
+std::string ServiceWorkerFetchRequest::Serialize() const {
+  proto::internal::ServiceWorkerFetchRequest request_proto;
+
+  request_proto.set_url(url.spec());
+  request_proto.set_method(method);
+  request_proto.mutable_headers()->insert(headers.begin(), headers.end());
+  request_proto.mutable_referrer()->set_url(referrer.url.spec());
+  request_proto.mutable_referrer()->set_policy(referrer.policy);
+  request_proto.set_is_reload(is_reload);
+  request_proto.set_mode(static_cast<int>(mode));
+  request_proto.set_is_main_resource_load(is_main_resource_load);
+  request_proto.set_request_context_type(request_context_type);
+  request_proto.set_credentials_mode(static_cast<int>(credentials_mode));
+  request_proto.set_cache_mode(static_cast<int>(cache_mode));
+  request_proto.set_redirect_mode(static_cast<int>(redirect_mode));
+  request_proto.set_integrity(integrity);
+  request_proto.set_keepalive(keepalive);
+  request_proto.set_client_id(client_id);
+
+  return request_proto.SerializeAsString();
+}
+
 size_t ServiceWorkerFetchRequest::EstimatedStructSize() {
   size_t size = sizeof(ServiceWorkerFetchRequest);
   size += url.spec().size();
@@ -69,6 +92,40 @@ size_t ServiceWorkerFetchRequest::EstimatedStructSize() {
 }
 
 // static
+ServiceWorkerFetchRequest ServiceWorkerFetchRequest::ParseFromString(
+    const std::string& serialized) {
+  proto::internal::ServiceWorkerFetchRequest request_proto;
+  if (!request_proto.ParseFromString(serialized)) {
+    return ServiceWorkerFetchRequest();
+  }
+
+  ServiceWorkerFetchRequest request(
+      GURL(request_proto.url()), request_proto.method(),
+      ServiceWorkerHeaderMap(request_proto.headers().begin(),
+                             request_proto.headers().end()),
+      Referrer(GURL(request_proto.referrer().url()),
+               static_cast<blink::WebReferrerPolicy>(
+                   request_proto.referrer().policy())),
+      request_proto.is_reload());
+  request.mode =
+      static_cast<network::mojom::FetchRequestMode>(request_proto.mode());
+  request.is_main_resource_load = request_proto.is_main_resource_load();
+  request.request_context_type =
+      static_cast<RequestContextType>(request_proto.request_context_type());
+  request.credentials_mode = static_cast<network::mojom::FetchCredentialsMode>(
+      request_proto.credentials_mode());
+  request.cache_mode =
+      static_cast<blink::mojom::FetchCacheMode>(request_proto.cache_mode());
+  request.redirect_mode = static_cast<network::mojom::FetchRedirectMode>(
+      request_proto.redirect_mode());
+  request.integrity = request_proto.integrity();
+  request.keepalive = request_proto.keepalive();
+  request.client_id = request_proto.client_id();
+
+  return request;
+}
+
+// static
 blink::mojom::FetchCacheMode
 ServiceWorkerFetchRequest::GetCacheModeFromLoadFlags(int load_flags) {
   if (load_flags & net::LOAD_DISABLE_CACHE)
diff --git a/chromium/content/common/service_worker/service_worker_types.h b/chromium/content/common/service_worker/service_worker_types.h
index bf4983a15ce..15b83155507 100644
--- a/chromium/content/common/service_worker/service_worker_types.h
+++ b/chromium/content/common/service_worker/service_worker_types.h
@@ -90,10 +90,14 @@ struct CONTENT_EXPORT ServiceWorkerFetchRequest {
   ServiceWorkerFetchRequest& operator=(const ServiceWorkerFetchRequest& other);
   ~ServiceWorkerFetchRequest();
   size_t EstimatedStructSize();
+  std::string Serialize() const;
 
   static blink::mojom::FetchCacheMode GetCacheModeFromLoadFlags(int load_flags);
+  static ServiceWorkerFetchRequest ParseFromString(
+      const std::string& serialized);
 
-  // Be sure to update EstimatedStructSize() when adding members.
+  // Be sure to update EstimatedStructSize(), Serialize(), and ParseFromString()
+  // when adding members.
   network::mojom::FetchRequestMode mode =
       network::mojom::FetchRequestMode::kNoCORS;
   bool is_main_resource_load = false;
diff --git a/chromium/content/common/service_worker/service_worker_types.proto b/chromium/content/common/service_worker/service_worker_types.proto
new file mode 100644
index 00000000000..f4470b521f7
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker_types.proto
@@ -0,0 +1,41 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+syntax = "proto2";
+
+option optimize_for = LITE_RUNTIME;
+
+package content.proto.internal;
+
+// Serializable version of ServiceWorkerFetchRequest.
+//
+// Next Tag: 15
+message ServiceWorkerFetchRequest {
+  // Serializable version of the Referrer struct defined in
+  // https://cs.chromium.org/chromium/src/content/public/common/referrer.h
+  //
+  // Next Tag: 3
+  message Referrer {
+    optional string url = 1;
+    optional int32 policy = 2;  // blink::WebReferrerPolicy.
+  }
+
+  // Constructor params.
+  optional string url = 1;
+  optional string method = 2;
+  map<string, string> headers = 3;
+  optional Referrer referrer = 4;
+  optional bool is_reload = 5;
+
+  // Other params.
+  optional int32 mode = 6;  // network::mojom::FetchRequestMode.
+  optional bool is_main_resource_load = 7;
+  optional int32 request_context_type = 8;  // content::RequestContextType.
+  optional int32 credentials_mode = 9;  // network::mojom::FetchCredentialsMode.
+  optional int32 cache_mode = 10;       // blink::mojom::FetchCacheMode.
+  optional int32 redirect_mode = 11;    // network::mojom::FetchRedirectMode.
+  optional string integrity = 12;
+  optional bool keepalive = 13;
+  optional string client_id = 14;
+}
+\ No newline at end of file
diff --git a/chromium/content/common/service_worker/service_worker_types_unittest.cc b/chromium/content/common/service_worker/service_worker_types_unittest.cc
index 9a5373ac91c..8a077d53982 100644
--- a/chromium/content/common/service_worker/service_worker_types_unittest.cc
+++ b/chromium/content/common/service_worker/service_worker_types_unittest.cc
@@ -3,7 +3,13 @@
 // found in the LICENSE file.
 
 #include "content/common/service_worker/service_worker_types.h"
+#include "base/guid.h"
+#include "content/common/service_worker/service_worker_fetch_response_mojom_traits.h"
+#include "mojo/public/cpp/base/time_mojom_traits.h"
+#include "mojo/public/cpp/test_support/test_utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/platform/modules/fetch/fetch_api_response.mojom.h"
+#include "url/mojom/url_gurl_mojom_traits.h"
 
 #include "net/base/load_flags.h"
 
@@ -39,6 +45,65 @@ TEST(ServiceWorkerFetchRequestTest, CacheModeTest) {
                 net::LOAD_ONLY_FROM_CACHE | net::LOAD_BYPASS_CACHE));
 }
 
+// Tests that mojo serialization/deserialization of ServiceWorkerResponse works.
+TEST(ServiceWorkerResponseTest, StructTraits) {
+  ServiceWorkerResponse input;
+  ServiceWorkerResponse output;
+
+  input.url_list = {GURL("https://www.google.ca/"),
+                    GURL("https://www.google.com")};
+  input.status_code = 200;
+  input.status_text = "status_text";
+  input.response_type = network::mojom::FetchResponseType::kDefault;
+  input.headers.insert(
+      std::pair<std::string, std::string>("header1", "value1"));
+  input.headers.insert(
+      std::pair<std::string, std::string>("header2", "value2"));
+  input.error = blink::mojom::ServiceWorkerResponseError::kUnknown;
+  input.response_time = base::Time::Now();
+  input.is_in_cache_storage = true;
+  input.cache_storage_cache_name = "cache_name";
+
+  mojo::test::SerializeAndDeserialize<blink::mojom::FetchAPIResponse>(&input,
+                                                                      &output);
+
+  EXPECT_EQ(input.url_list, output.url_list);
+  EXPECT_EQ(input.status_code, output.status_code);
+  EXPECT_EQ(input.status_text, output.status_text);
+  EXPECT_EQ(input.response_type, output.response_type);
+  EXPECT_EQ(input.headers, output.headers);
+  EXPECT_EQ(input.blob, output.blob);
+  EXPECT_EQ(input.error, output.error);
+  EXPECT_EQ(input.response_time, output.response_time);
+  EXPECT_EQ(input.is_in_cache_storage, output.is_in_cache_storage);
+  EXPECT_EQ(input.cache_storage_cache_name, output.cache_storage_cache_name);
+  EXPECT_EQ(input.cors_exposed_header_names, output.cors_exposed_header_names);
+  EXPECT_EQ(input.side_data_blob, output.side_data_blob);
+}
+
+TEST(ServiceWorkerRequestTest, SerialiazeDeserializeRoundTrip) {
+  ServiceWorkerFetchRequest request(
+      GURL("foo.com"), "GET", {{"User-Agent", "Chrome"}},
+      Referrer(
+          GURL("bar.com"),
+          blink::WebReferrerPolicy::kWebReferrerPolicyNoReferrerWhenDowngrade),
+      true);
+  request.mode = network::mojom::FetchRequestMode::kSameOrigin;
+  request.is_main_resource_load = true;
+  request.request_context_type =
+      RequestContextType::REQUEST_CONTEXT_TYPE_IFRAME;
+  request.credentials_mode = network::mojom::FetchCredentialsMode::kSameOrigin;
+  request.cache_mode = blink::mojom::FetchCacheMode::kForceCache;
+  request.redirect_mode = network::mojom::FetchRedirectMode::kManual;
+  request.integrity = "integrity";
+  request.keepalive = true;
+  request.client_id = "42";
+
+  EXPECT_EQ(request.Serialize(),
+            ServiceWorkerFetchRequest::ParseFromString(request.Serialize())
+                .Serialize());
+}
+
 }  // namespace
 
 }  // namespace content
diff --git a/chromium/content/common/service_worker/service_worker_utils.cc b/chromium/content/common/service_worker/service_worker_utils.cc
index 918b5a7dae1..0820aad1064 100644
--- a/chromium/content/common/service_worker/service_worker_utils.cc
+++ b/chromium/content/common/service_worker/service_worker_utils.cc
@@ -186,6 +186,12 @@ bool ServiceWorkerUtils::ExtractSinglePartHttpRange(
   const net::HttpByteRange& byte_range = ranges[0];
   if (byte_range.first_byte_position() < 0)
     return false;
+  // Allow the range [0, -1] to be valid and specify the entire range.
+  if (byte_range.first_byte_position() == 0 &&
+      byte_range.last_byte_position() == -1) {
+    *has_range_out = false;
+    return true;
+  }
   if (byte_range.last_byte_position() < 0)
     return false;
 
@@ -206,6 +212,21 @@ bool ServiceWorkerUtils::ExtractSinglePartHttpRange(
   return true;
 }
 
+bool ServiceWorkerUtils::ShouldBypassCacheDueToUpdateViaCache(
+    bool is_main_script,
+    blink::mojom::ServiceWorkerUpdateViaCache cache_mode) {
+  switch (cache_mode) {
+    case blink::mojom::ServiceWorkerUpdateViaCache::kImports:
+      return is_main_script;
+    case blink::mojom::ServiceWorkerUpdateViaCache::kNone:
+      return true;
+    case blink::mojom::ServiceWorkerUpdateViaCache::kAll:
+      return false;
+  }
+  NOTREACHED() << static_cast<int>(cache_mode);
+  return false;
+}
+
 bool LongestScopeMatcher::MatchLongest(const GURL& scope) {
   if (!ServiceWorkerUtils::ScopeMatches(scope, url_))
     return false;
diff --git a/chromium/content/common/service_worker/service_worker_utils.h b/chromium/content/common/service_worker/service_worker_utils.h
index 9df6f6668ae..e7ce9c975f1 100644
--- a/chromium/content/common/service_worker/service_worker_utils.h
+++ b/chromium/content/common/service_worker/service_worker_utils.h
@@ -51,7 +51,6 @@ class ServiceWorkerUtils {
   // Returns true if servicified service worker is enabled.
   CONTENT_EXPORT static bool IsServicificationEnabled();
 
-  // PlzNavigate
   // Returns true if the |provider_id| was assigned by the browser process.
   static bool IsBrowserAssignedProviderId(int provider_id) {
     return provider_id < kInvalidServiceWorkerProviderId;
@@ -71,6 +70,10 @@ class ServiceWorkerUtils {
                                          bool* has_range_out,
                                          uint64_t* offset_out,
                                          uint64_t* size_out);
+
+  static bool ShouldBypassCacheDueToUpdateViaCache(
+      bool is_main_script,
+      blink::mojom::ServiceWorkerUpdateViaCache cache_mode);
 };
 
 class CONTENT_EXPORT LongestScopeMatcher {
diff --git a/chromium/content/common/single_request_url_loader_factory.cc b/chromium/content/common/single_request_url_loader_factory.cc
index 1a3828903af..3c1a19b1bd6 100644
--- a/chromium/content/common/single_request_url_loader_factory.cc
+++ b/chromium/content/common/single_request_url_loader_factory.cc
@@ -88,6 +88,11 @@ void SingleRequestURLLoaderFactory::CreateLoaderAndStart(
   state_->HandleRequest(std::move(loader), std::move(client));
 }
 
+void SingleRequestURLLoaderFactory::Clone(
+    network::mojom::URLLoaderFactoryRequest request) {
+  NOTREACHED();
+}
+
 std::unique_ptr<network::SharedURLLoaderFactoryInfo>
 SingleRequestURLLoaderFactory::Clone() {
   return std::make_unique<FactoryInfo>(state_);
diff --git a/chromium/content/common/single_request_url_loader_factory.h b/chromium/content/common/single_request_url_loader_factory.h
index 0250e786be4..9069591c060 100644
--- a/chromium/content/common/single_request_url_loader_factory.h
+++ b/chromium/content/common/single_request_url_loader_factory.h
@@ -32,6 +32,7 @@ class SingleRequestURLLoaderFactory : public network::SharedURLLoaderFactory {
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
+  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
   std::unique_ptr<network::SharedURLLoaderFactoryInfo> Clone() override;
 
  private:
diff --git a/chromium/content/common/speech_recognition_messages.h b/chromium/content/common/speech_recognition_messages.h
deleted file mode 100644
index a7843381fac..00000000000
--- a/chromium/content/common/speech_recognition_messages.h
+++ /dev/null
@@ -1,121 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_SPEECH_RECOGNITION_MESSAGES_H_
-#define CONTENT_COMMON_SPEECH_RECOGNITION_MESSAGES_H_
-
-#include <stdint.h>
-
-#include <string>
-
-#include "content/public/common/speech_recognition_error.h"
-#include "content/public/common/speech_recognition_grammar.h"
-#include "content/public/common/speech_recognition_result.h"
-#include "ipc/ipc_message_macros.h"
-#include "ipc/ipc_param_traits.h"
-#include "ui/gfx/geometry/rect.h"
-
-#define IPC_MESSAGE_START SpeechRecognitionMsgStart
-
-IPC_ENUM_TRAITS_MAX_VALUE(content::SpeechAudioErrorDetails,
-                          content::SPEECH_AUDIO_ERROR_DETAILS_LAST)
-IPC_ENUM_TRAITS_MAX_VALUE(content::SpeechRecognitionErrorCode,
-                          content::SPEECH_RECOGNITION_ERROR_LAST)
-
-IPC_STRUCT_TRAITS_BEGIN(content::SpeechRecognitionError)
-  IPC_STRUCT_TRAITS_MEMBER(code)
-  IPC_STRUCT_TRAITS_MEMBER(details)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(content::SpeechRecognitionHypothesis)
-  IPC_STRUCT_TRAITS_MEMBER(utterance)
-  IPC_STRUCT_TRAITS_MEMBER(confidence)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(content::SpeechRecognitionResult)
-  IPC_STRUCT_TRAITS_MEMBER(is_provisional)
-  IPC_STRUCT_TRAITS_MEMBER(hypotheses)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(content::SpeechRecognitionGrammar)
-  IPC_STRUCT_TRAITS_MEMBER(url)
-  IPC_STRUCT_TRAITS_MEMBER(weight)
-IPC_STRUCT_TRAITS_END()
-
-// ------- Messages for Speech JS APIs (SpeechRecognitionDispatcher) ----------
-
-// Renderer -> Browser messages.
-
-// Used to start a speech recognition session.
-IPC_STRUCT_BEGIN(SpeechRecognitionHostMsg_StartRequest_Params)
-  // The render frame requesting speech recognition.
-  IPC_STRUCT_MEMBER(int, render_frame_id)
-  // Unique ID associated with the JS object making the calls.
-  IPC_STRUCT_MEMBER(int, request_id)
-  // Language to use for speech recognition.
-  IPC_STRUCT_MEMBER(std::string, language)
-  // Speech grammars to use.
-  IPC_STRUCT_MEMBER(content::SpeechRecognitionGrammarArray, grammars)
-  // URL of the page (or iframe if applicable).
-  IPC_STRUCT_MEMBER(std::string, origin_url)
-  // Maximum number of hypotheses allowed for each results.
-  IPC_STRUCT_MEMBER(uint32_t, max_hypotheses)
-  // Whether the user requested continuous recognition or not.
-  IPC_STRUCT_MEMBER(bool, continuous)
-  // Whether the user requested interim results or not.
-  IPC_STRUCT_MEMBER(bool, interim_results)
-IPC_STRUCT_END()
-
-
-// Requests the speech recognition service to start speech recognition.
-IPC_MESSAGE_CONTROL1(SpeechRecognitionHostMsg_StartRequest,
-                     SpeechRecognitionHostMsg_StartRequest_Params)
-
-// Requests the speech recognition service to abort speech recognition on
-// behalf of the given |render_frame_id| and |request_id|. If there are no
-// sessions associated with the |request_id| in the render frame, this call
-// does nothing.
-IPC_MESSAGE_CONTROL2(SpeechRecognitionHostMsg_AbortRequest,
-                     int /* render_frame_id */,
-                     int /* request_id */)
-
-// Requests the speech recognition service to abort all speech recognitions on
-// behalf of the given |render_frame_id|. If speech recognition is not happening
-// or is happening on behalf of some other render frame, this call does nothing.
-IPC_MESSAGE_CONTROL1(SpeechRecognitionHostMsg_AbortAllRequests,
-                     int /* render_frame_id */)
-
-// Requests the speech recognition service to stop audio capture on behalf of
-// the given |render_frame_id|. Any audio recorded so far will be fed to the
-// speech recognizer. If speech recognition is not happening nor or is
-// happening on behalf of some other render frame, this call does nothing.
-IPC_MESSAGE_CONTROL2(SpeechRecognitionHostMsg_StopCaptureRequest,
-                     int /* render_frame_id */,
-                     int /* request_id */)
-
-// Browser -> Renderer messages.
-
-// The messages below follow exactly the same semantic of the corresponding
-// events defined in content/public/browser/speech_recognition_event_listener.h.
-IPC_MESSAGE_ROUTED2(SpeechRecognitionMsg_ResultRetrieved,
-                    int /* request_id */,
-                    content::SpeechRecognitionResults /* results */)
-
-IPC_MESSAGE_ROUTED2(SpeechRecognitionMsg_ErrorOccurred,
-                    int /* request_id */,
-                    content::SpeechRecognitionError /* error */)
-
-IPC_MESSAGE_ROUTED1(SpeechRecognitionMsg_Started, int /* request_id */)
-
-IPC_MESSAGE_ROUTED1(SpeechRecognitionMsg_AudioStarted, int /* request_id */)
-
-IPC_MESSAGE_ROUTED1(SpeechRecognitionMsg_SoundStarted, int /* request_id */)
-
-IPC_MESSAGE_ROUTED1(SpeechRecognitionMsg_SoundEnded, int /* request_id */)
-
-IPC_MESSAGE_ROUTED1(SpeechRecognitionMsg_AudioEnded, int /* request_id */)
-
-IPC_MESSAGE_ROUTED1(SpeechRecognitionMsg_Ended, int /* request_id */)
-
-#endif  // CONTENT_COMMON_SPEECH_RECOGNITION_MESSAGES_H_
diff --git a/chromium/content/common/speech_recognizer.mojom b/chromium/content/common/speech_recognizer.mojom
new file mode 100644
index 00000000000..f790d4c93cb
--- /dev/null
+++ b/chromium/content/common/speech_recognizer.mojom
@@ -0,0 +1,95 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "content/public/common/speech_recognition_grammar.mojom";
+import "content/public/common/speech_recognition_result.mojom";
+import "content/public/common/speech_recognition_error.mojom";
+import "url/mojom/origin.mojom";
+
+// Created by the renderer and sent to the browser to start a speech recognition
+// session.
+struct StartSpeechRecognitionRequestParams {
+  // Used to create a connection with a SpeechRecognitionSession implementation
+  // that will be created when the session is created.
+  SpeechRecognitionSession& session_request;
+
+  // Used by the browser to communicate with a SpeechRecognitionSessionClient
+  // implementation created for the new session.
+  SpeechRecognitionSessionClient client;
+
+  // Language to use for speech recognition.
+  string language;
+
+  // Speech grammars to use.
+  array<content.mojom.SpeechRecognitionGrammar> grammars;
+
+  // URL of the page (or iframe if applicable).
+  url.mojom.Origin origin;
+
+  // Maximum number of hypotheses allowed for each results.
+  uint32 max_hypotheses;
+
+  // Whether the user requested continuous recognition.
+  bool continuous;
+
+  // Whether the user requested interim results.
+  bool interim_results;
+};
+
+// API for the renderer process to start a speech recognition session in the
+// browser process.
+interface SpeechRecognizer {
+  // Requests the speech recognition service to start speech recognition.
+  Start(StartSpeechRecognitionRequestParams params);
+};
+
+// API for the renderer process to stop or abort an existing speech recognition
+// session. An InterfaceRequest is sent to the browser process via
+// SpeechRecognizer::Start, and is bound to an implementation there.
+// SpeechRecognitionSession and SpeechRecognitionSessionClient are 1:1 with each
+// other and with WebSpeechRecognitionHandle.
+interface SpeechRecognitionSession {
+  // Requests the speech recognition service to abort speech recognition for the
+  // associated session.
+  Abort();
+
+  // Requests the speech recognition service to stop audio capture for the
+  // associated session.
+  StopCapture();
+};
+
+// API for the browser process to communicate speech recognition related updates
+// with renderer and cause events to be dispatched to the appropriate speech
+// recognition handle. An InterfacePtr for each handle is sent to the browser
+// process via SpeechRecognizer::Start. SpeechRecognitionSession and
+// SpeechRecognitionSessionClient are 1:1 with each other and with
+// WebSpeechRecognitionHandle.
+interface SpeechRecognitionSessionClient {
+  // Called to dispatch the "result" event.
+  ResultRetrieved(array<content.mojom.SpeechRecognitionResult> results);
+
+  // Called to dispatch the "nomatch" event if the error code passed is of types
+  // kNoMatch, otherwise dispatchers an "error" event.
+  ErrorOccurred(content.mojom.SpeechRecognitionError error);
+
+  // Called to dispatch the "start" event.
+  Started();
+
+  // Called to dispatch the "audiostart" event.
+  AudioStarted();
+
+  // Called to  dispatch the "soundstart" and "speechstart" events.
+  SoundStarted();
+
+  // Called to dispatch "soundend" and "speechend" events.
+  SoundEnded();
+
+  // Called to dispatch the "audioend" event.
+  AudioEnded();
+
+  // Called to dispatch the "end" event.
+  Ended();
+};
diff --git a/chromium/content/common/swapped_out_messages.cc b/chromium/content/common/swapped_out_messages.cc
index d7747d332a2..65cbd051764 100644
--- a/chromium/content/common/swapped_out_messages.cc
+++ b/chromium/content/common/swapped_out_messages.cc
@@ -6,8 +6,6 @@
 
 #include "content/common/accessibility_messages.h"
 #include "content/common/frame_messages.h"
-#include "content/common/input/sync_compositor_messages.h"
-#include "content/common/input_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/common/content_client.h"
 
@@ -18,10 +16,6 @@ bool SwappedOutMessages::CanSendWhileSwappedOut(const IPC::Message* msg) {
   // important (e.g., ACKs) for keeping the browser and renderer state
   // consistent in case we later return to the same renderer.
   switch (msg->type()) {
-    // Handled by RenderWidgetHost.
-    case InputHostMsg_HandleInputEvent_ACK::ID:
-    case SyncCompositorHostMsg_SetNeedsBeginFrames::ID:
-    case ViewHostMsg_ResizeOrRepaint_ACK::ID:
     // Handled by RenderViewHost.
     case FrameHostMsg_RenderProcessGone::ID:
     case ViewHostMsg_ClosePage_ACK::ID:
diff --git a/chromium/content/common/throttling_url_loader.cc b/chromium/content/common/throttling_url_loader.cc
index 0d0ba0268bf..28a8b328015 100644
--- a/chromium/content/common/throttling_url_loader.cc
+++ b/chromium/content/common/throttling_url_loader.cc
@@ -181,7 +181,7 @@ ThrottlingURLLoader::~ThrottlingURLLoader() {
 
 void ThrottlingURLLoader::FollowRedirect() {
   if (url_loader_)
-    url_loader_->FollowRedirect();
+    url_loader_->FollowRedirect(base::nullopt);
 }
 
 void ThrottlingURLLoader::SetPriority(net::RequestPriority priority,
diff --git a/chromium/content/common/throttling_url_loader_unittest.cc b/chromium/content/common/throttling_url_loader_unittest.cc
index b7a22c10b4f..3f6b1610048 100644
--- a/chromium/content/common/throttling_url_loader_unittest.cc
+++ b/chromium/content/common/throttling_url_loader_unittest.cc
@@ -9,8 +9,8 @@
 #include "base/test/scoped_task_environment.h"
 #include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/url_loader_throttle.h"
-#include "content/public/common/weak_wrapper_shared_url_loader_factory.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -26,8 +26,9 @@ class TestURLLoaderFactory : public network::mojom::URLLoaderFactory,
  public:
   TestURLLoaderFactory() : binding_(this), url_loader_binding_(this) {
     binding_.Bind(mojo::MakeRequest(&factory_ptr_));
-    shared_factory_ = base::MakeRefCounted<WeakWrapperSharedURLLoaderFactory>(
-        factory_ptr_.get());
+    shared_factory_ =
+        base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
+            factory_ptr_.get());
   }
 
   ~TestURLLoaderFactory() override { shared_factory_->Detach(); }
@@ -94,7 +95,8 @@ class TestURLLoaderFactory : public network::mojom::URLLoaderFactory,
   }
 
   // network::mojom::URLLoader implementation.
-  void FollowRedirect() override {}
+  void FollowRedirect(const base::Optional<net::HttpRequestHeaders>&
+                          modified_request_headers) override {}
   void ProceedWithResponse() override {}
 
   void SetPriority(net::RequestPriority priority,
@@ -116,7 +118,7 @@ class TestURLLoaderFactory : public network::mojom::URLLoaderFactory,
   mojo::Binding<network::mojom::URLLoader> url_loader_binding_;
   network::mojom::URLLoaderFactoryPtr factory_ptr_;
   network::mojom::URLLoaderClientPtr client_ptr_;
-  scoped_refptr<WeakWrapperSharedURLLoaderFactory> shared_factory_;
+  scoped_refptr<network::WeakWrapperSharedURLLoaderFactory> shared_factory_;
   DISALLOW_COPY_AND_ASSIGN(TestURLLoaderFactory);
 };
 
diff --git a/chromium/content/common/typemaps.gni b/chromium/content/common/typemaps.gni
index 27721793d20..f1da0657d12 100644
--- a/chromium/content/common/typemaps.gni
+++ b/chromium/content/common/typemaps.gni
@@ -4,7 +4,6 @@
 
 typemaps = [
   "//content/common/background_fetch/background_fetch_types.typemap",
-  "//content/common/cache_storage/cache_storage.typemap",
   "//content/common/frame.typemap",
   "//content/common/frame_messages.typemap",
   "//content/common/input/synchronous_compositor.typemap",
diff --git a/chromium/content/common/url_loader_factory_bundle.cc b/chromium/content/common/url_loader_factory_bundle.cc
index e3d31d68690..28fd78fde19 100644
--- a/chromium/content/common/url_loader_factory_bundle.cc
+++ b/chromium/content/common/url_loader_factory_bundle.cc
@@ -78,6 +78,11 @@ void URLLoaderFactoryBundle::CreateLoaderAndStart(
                                     traffic_annotation);
 }
 
+void URLLoaderFactoryBundle::Clone(
+    network::mojom::URLLoaderFactoryRequest request) {
+  NOTREACHED();
+}
+
 std::unique_ptr<network::SharedURLLoaderFactoryInfo>
 URLLoaderFactoryBundle::Clone() {
   network::mojom::URLLoaderFactoryPtrInfo default_factory_info;
diff --git a/chromium/content/common/url_loader_factory_bundle.h b/chromium/content/common/url_loader_factory_bundle.h
index 3db8f4fc096..1883f494ebc 100644
--- a/chromium/content/common/url_loader_factory_bundle.h
+++ b/chromium/content/common/url_loader_factory_bundle.h
@@ -81,7 +81,7 @@ class CONTENT_EXPORT URLLoaderFactoryBundle
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-
+  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
   std::unique_ptr<network::SharedURLLoaderFactoryInfo> Clone() override;
 
   // The |info| contains replacement factories for a subset of the existing
diff --git a/chromium/content/common/url_schemes.cc b/chromium/content/common/url_schemes.cc
index a269e1de2cb..8e4a1eb7f38 100644
--- a/chromium/content/common/url_schemes.cc
+++ b/chromium/content/common/url_schemes.cc
@@ -37,10 +37,10 @@ std::vector<std::string>& GetMutableSavableSchemes() {
   return *schemes;
 }
 
-// Note we store url::Origins here instead of strings to deal with
-// canonicalization.
-std::vector<url::Origin>& GetMutableSecureOrigins() {
-  static base::NoDestructor<std::vector<url::Origin>> origins;
+// This set contains serialized canonicalized origins as well as hostname
+// patterns. The latter are canonicalized by component.
+std::vector<std::string>& GetMutableSecureOriginsAndPatterns() {
+  static base::NoDestructor<std::vector<std::string>> origins;
   return *origins;
 }
 
@@ -58,6 +58,7 @@ void RegisterContentSchemes(bool lock_schemes) {
   url::AddStandardScheme(kChromeDevToolsScheme, url::SCHEME_WITH_HOST);
   url::AddStandardScheme(kChromeUIScheme, url::SCHEME_WITH_HOST);
   url::AddStandardScheme(kGuestScheme, url::SCHEME_WITH_HOST);
+  url::AddStandardScheme(kChromeErrorScheme, url::SCHEME_WITH_HOST);
 
   for (auto& scheme : schemes.standard_schemes)
     url::AddStandardScheme(scheme.c_str(), url::SCHEME_WITH_HOST);
@@ -106,16 +107,16 @@ void RegisterContentSchemes(bool lock_schemes) {
 
   GetMutableServiceWorkerSchemes() = std::move(schemes.service_worker_schemes);
 
-  GetMutableSecureOrigins() = std::move(schemes.secure_origins);
-  network::cors::legacy::RegisterSecureOrigins(GetSecureOrigins());
+  GetMutableSecureOriginsAndPatterns() = std::move(schemes.secure_origins);
+  network::cors::legacy::RegisterSecureOrigins(GetSecureOriginsAndPatterns());
 }
 
 const std::vector<std::string>& GetSavableSchemes() {
   return GetMutableSavableSchemes();
 }
 
-const std::vector<url::Origin>& GetSecureOrigins() {
-  return GetMutableSecureOrigins();
+const std::vector<std::string>& GetSecureOriginsAndPatterns() {
+  return GetMutableSecureOriginsAndPatterns();
 }
 
 const std::vector<std::string>& GetServiceWorkerSchemes() {
diff --git a/chromium/content/common/url_schemes.h b/chromium/content/common/url_schemes.h
index 52ac01845df..802c80b241c 100644
--- a/chromium/content/common/url_schemes.h
+++ b/chromium/content/common/url_schemes.h
@@ -28,7 +28,11 @@ CONTENT_EXPORT void RegisterContentSchemes(bool lock_schemes);
 // See comment in ContentClient::AddAdditionalSchemes for explanations. These
 // getters can be invoked on any thread.
 const std::vector<std::string>& GetSavableSchemes();
-const std::vector<url::Origin>& GetSecureOrigins();
+// Contains serialized canonicalized origins as well as hostname patterns such
+// as "*.foo.com". An origin should be considered secure if it matches an origin
+// in this list or if its hostname matches one of the hostname patterns. The
+// hostname patterns are canonicalized by component.
+const std::vector<std::string>& GetSecureOriginsAndPatterns();
 const std::vector<std::string>& GetServiceWorkerSchemes();
 
 }  // namespace content
diff --git a/chromium/content/common/user_agent.cc b/chromium/content/common/user_agent.cc
index b071e6ba90d..e4565757f88 100644
--- a/chromium/content/common/user_agent.cc
+++ b/chromium/content/common/user_agent.cc
@@ -13,12 +13,10 @@
 #include "build/build_config.h"
 #include "build/util/webkit_version.h"
 
-#if defined(OS_POSIX) && !defined(OS_MACOSX)
-#include <sys/utsname.h>
-#endif
-
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
+#elif (defined(OS_POSIX) && !defined(OS_MACOSX)) || defined(OS_FUCHSIA)
+#include <sys/utsname.h>
 #endif
 
 namespace content {
@@ -47,21 +45,6 @@ std::string BuildOSCpuInfo() {
                                                &os_bugfix_version);
 #endif
 
-#if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
-  // Should work on any Posix system.
-  struct utsname unixinfo;
-  uname(&unixinfo);
-
-  std::string cputype;
-  // special case for biarch systems
-  if (strcmp(unixinfo.machine, "x86_64") == 0 &&
-      sizeof(void*) == sizeof(int32_t)) {  // NOLINT
-    cputype.assign("i686 (x86_64)");
-  } else {
-    cputype.assign(unixinfo.machine);
-  }
-#endif
-
 #if defined(OS_WIN)
   std::string architecture_token;
   base::win::OSInfo* os_info = base::win::OSInfo::GetInstance();
@@ -75,9 +58,7 @@ std::string BuildOSCpuInfo() {
     else if (windows_architecture == base::win::OSInfo::IA64_ARCHITECTURE)
       architecture_token = "; Win64; IA64";
   }
-#endif
-
-#if defined(OS_ANDROID)
+#elif defined(OS_ANDROID)
   std::string android_version_str = base::SysInfo::OperatingSystemVersion();
 
   std::string android_info_str;
@@ -99,6 +80,19 @@ std::string BuildOSCpuInfo() {
     }
     android_info_str += " Build/" + android_build_id;
   }
+#elif (defined(OS_POSIX) && !defined(OS_MACOSX)) || defined(OS_FUCHSIA)
+  // Should work on any Posix system.
+  struct utsname unixinfo;
+  uname(&unixinfo);
+
+  std::string cputype;
+  // special case for biarch systems
+  if (strcmp(unixinfo.machine, "x86_64") == 0 &&
+      sizeof(void*) == sizeof(int32_t)) {  // NOLINT
+    cputype.assign("i686 (x86_64)");
+  } else {
+    cputype.assign(unixinfo.machine);
+  }
 #endif
 
   base::StringAppendF(
@@ -124,10 +118,10 @@ std::string BuildOSCpuInfo() {
       "Android %s%s",
       android_version_str.c_str(),
       android_info_str.c_str()
-#else
-      "%s %s",
-      unixinfo.sysname,  // e.g. Linux
-      cputype.c_str()    // e.g. i686
+#elif defined(OS_POSIX) || defined(OS_FUCHSIA)
+                      "%s %s",
+                      unixinfo.sysname,  // e.g. Linux
+                      cputype.c_str()    // e.g. i686
 #endif
   );  // NOLINT
 
@@ -144,7 +138,7 @@ std::string getUserAgentPlatform() {
       "X11; ";           // strange, but that's what Firefox uses
 #elif defined(OS_ANDROID)
       "Linux; ";
-#else
+#elif defined(OS_POSIX) || defined(OS_FUCHSIA)
       "Unknown; ";
 #endif
 }
diff --git a/chromium/content/common/view_messages.h b/chromium/content/common/view_messages.h
index 1f619836b51..7411a755dd7 100644
--- a/chromium/content/common/view_messages.h
+++ b/chromium/content/common/view_messages.h
@@ -15,10 +15,11 @@
 #include <vector>
 
 #include "base/memory/shared_memory.h"
+#include "base/optional.h"
 #include "base/process/process.h"
 #include "base/strings/string16.h"
 #include "build/build_config.h"
-#include "cc/ipc/cc_param_traits.h"
+#include "cc/input/touch_action.h"
 #include "components/viz/common/frame_sinks/begin_frame_args.h"
 #include "components/viz/common/quads/compositor_frame.h"
 #include "components/viz/common/quads/shared_bitmap.h"
@@ -27,9 +28,9 @@
 #include "content/common/date_time_suggestion.h"
 #include "content/common/frame_replication_state.h"
 #include "content/common/navigation_gesture.h"
-#include "content/common/resize_params.h"
 #include "content/common/text_input_state.h"
 #include "content/common/view_message_enums.h"
+#include "content/common/visual_properties.h"
 #include "content/public/common/common_param_traits.h"
 #include "content/public/common/menu_item.h"
 #include "content/public/common/page_state.h"
@@ -45,8 +46,8 @@
 #include "media/capture/ipc/capture_param_traits.h"
 #include "net/base/network_change_notifier.h"
 #include "ppapi/buildflags/buildflags.h"
-#include "third_party/blink/public/platform/modules/screen_orientation/web_screen_orientation_type.h"
-#include "third_party/blink/public/platform/web_display_mode.h"
+#include "third_party/blink/public/common/manifest/web_display_mode.h"
+#include "third_party/blink/public/common/screen_orientation/web_screen_orientation_type.h"
 #include "third_party/blink/public/platform/web_float_point.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
 #include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
@@ -160,12 +161,11 @@ IPC_STRUCT_TRAITS_BEGIN(blink::WebDeviceEmulationParams)
   IPC_STRUCT_TRAITS_MEMBER(screen_orientation_type)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::ResizeParams)
+IPC_STRUCT_TRAITS_BEGIN(content::VisualProperties)
   IPC_STRUCT_TRAITS_MEMBER(screen_info)
   IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
   IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
   IPC_STRUCT_TRAITS_MEMBER(max_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(auto_resize_sequence_number)
   IPC_STRUCT_TRAITS_MEMBER(new_size)
   IPC_STRUCT_TRAITS_MEMBER(compositor_viewport_pixel_size)
   IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
@@ -176,8 +176,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::ResizeParams)
   IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
   IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
   IPC_STRUCT_TRAITS_MEMBER(display_mode)
-  IPC_STRUCT_TRAITS_MEMBER(needs_resize_ack)
-  IPC_STRUCT_TRAITS_MEMBER(content_source_id)
+  IPC_STRUCT_TRAITS_MEMBER(capture_sequence_number)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::MenuItem)
@@ -281,33 +280,6 @@ IPC_STRUCT_BEGIN(ViewHostMsg_SelectionBounds_Params)
   IPC_STRUCT_MEMBER(bool, is_anchor_first)
 IPC_STRUCT_END()
 
-IPC_STRUCT_BEGIN(ViewHostMsg_ResizeOrRepaint_ACK_Params)
-  // The size of the RenderView when this message was generated.  This is
-  // included so the host knows how large the view is from the perspective of
-  // the renderer process.  This is necessary in case a resize operation is in
-  // progress. If auto-resize is enabled, this should update the corresponding
-  // view size.
-  IPC_STRUCT_MEMBER(gfx::Size, view_size)
-
-  // The following describes the various bits that may be set in flags:
-  //
-  //   ViewHostMsg_ResizeOrRepaint_ACK_Flags::IS_RESIZE_ACK
-  //     Indicates that this is a response to a ViewMsg_Resize message.
-  //
-  //   ViewHostMsg_ResizeOrRepaint_ACK_Flags::IS_REPAINT_ACK
-  //     Indicates that this is a response to a ViewMsg_Repaint message.
-  //
-  // If flags is zero, then this message corresponds to an unsolicited paint
-  // request by the render view.  Any of the above bits may be set in flags,
-  // which would indicate that this paint message is an ACK for multiple
-  // request messages.
-  IPC_STRUCT_MEMBER(int, flags)
-
-  // A unique monotonically increasing sequence number used to identify this
-  // ACK.
-  IPC_STRUCT_MEMBER(uint64_t, sequence_number)
-IPC_STRUCT_END()
-
 // Messages sent from the browser to the renderer.
 
 #if defined(OS_ANDROID)
@@ -340,12 +312,14 @@ IPC_MESSAGE_ROUTED1(ViewMsg_UpdateWebPreferences,
 // Expects a Close_ACK message when finished.
 IPC_MESSAGE_ROUTED0(ViewMsg_Close)
 
-// Tells the render view to change its size.  A ViewHostMsg_ResizeOrRepaint_ACK
-// message is generated in response provided new_size is not empty and not equal
-// to the view's current size.  The generated ViewHostMsg_ResizeOrRepaint_ACK
+// Tells the renderer to update visual properties.  A
+// ViewHostMsg_ResizeOrRepaint_ACK  message is generated in response provided
+// new_size is not empty and not equal to the view's current size.  The
+// generated ViewHostMsg_ResizeOrRepaint_ACK
 // message will have the IS_RESIZE_ACK flag set. It also receives the resizer
 // rect so that we don't have to fetch it every time WebKit asks for it.
-IPC_MESSAGE_ROUTED1(ViewMsg_Resize, content::ResizeParams /* params */)
+IPC_MESSAGE_ROUTED1(ViewMsg_SynchronizeVisualProperties,
+                    content::VisualProperties /* params */)
 
 // Enables device emulation. See WebDeviceEmulationParams for description.
 IPC_MESSAGE_ROUTED1(ViewMsg_EnableDeviceEmulation,
@@ -413,11 +387,6 @@ IPC_MESSAGE_ROUTED2(ViewMsg_EnumerateDirectoryResponse,
 // Expects a ClosePage_ACK message when finished.
 IPC_MESSAGE_ROUTED0(ViewMsg_ClosePage)
 
-// Notifies the renderer that a paint is to be generated for the rectangle
-// passed in.
-IPC_MESSAGE_ROUTED1(ViewMsg_Repaint,
-                    gfx::Size /* The view size to be repainted */)
-
 // Notification that a move or resize renderer's containing window has
 // started.
 IPC_MESSAGE_ROUTED0(ViewMsg_MoveOrResizeStarted)
@@ -502,7 +471,7 @@ IPC_MESSAGE_ROUTED1(ViewMsg_PpapiBrokerPermissionResult,
 // inside the popup, instruct the renderer to generate a synthetic tap at that
 // offset.
 IPC_MESSAGE_ROUTED3(ViewMsg_ResolveTapDisambiguation,
-                    double /* timestamp_seconds */,
+                    base::TimeTicks /* timestamp */,
                     gfx::Point /* tap_viewport_offset */,
                     bool /* is_long_press */)
 
@@ -523,6 +492,9 @@ IPC_MESSAGE_ROUTED2(ViewMsg_SetViewportIntersection,
 // Sets the inert bit on an out-of-process iframe.
 IPC_MESSAGE_ROUTED1(ViewMsg_SetIsInert, bool /* inert */)
 
+// Sets the inherited effective touch action on an out-of-process iframe.
+IPC_MESSAGE_ROUTED1(ViewMsg_SetInheritedEffectiveTouchAction, cc::TouchAction)
+
 // Toggles render throttling for an out-of-process iframe.
 IPC_MESSAGE_ROUTED2(ViewMsg_UpdateRenderThrottlingStatus,
                     bool /* is_throttled */,
@@ -579,12 +551,6 @@ IPC_MESSAGE_ROUTED1(ViewHostMsg_UpdateTargetURL,
 IPC_MESSAGE_ROUTED1(ViewHostMsg_DocumentAvailableInMainFrame,
                     bool /* uses_temporary_zoom_level */)
 
-// Sent as an acknowledgement to a previous resize request. This indicates that
-// the compositor has received a frame from the renderer corresponding to the
-// previous reszie request.
-IPC_MESSAGE_ROUTED1(ViewHostMsg_ResizeOrRepaint_ACK,
-                    ViewHostMsg_ResizeOrRepaint_ACK_Params)
-
 IPC_MESSAGE_ROUTED0(ViewHostMsg_Focus)
 
 IPC_MESSAGE_ROUTED1(ViewHostMsg_SetCursor, content::WebCursor)
diff --git a/chromium/content/common/visual_properties.cc b/chromium/content/common/visual_properties.cc
new file mode 100644
index 00000000000..34c16c3fba5
--- /dev/null
+++ b/chromium/content/common/visual_properties.cc
@@ -0,0 +1,18 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/visual_properties.h"
+
+namespace content {
+
+VisualProperties::VisualProperties() = default;
+
+VisualProperties::VisualProperties(const VisualProperties& other) = default;
+
+VisualProperties::~VisualProperties() = default;
+
+VisualProperties& VisualProperties::operator=(const VisualProperties& other) =
+    default;
+
+}  // namespace content
diff --git a/chromium/content/common/resize_params.h b/chromium/content/common/visual_properties.h
index 51c472dd522..dd29af0cb31 100644
--- a/chromium/content/common/resize_params.h
+++ b/chromium/content/common/visual_properties.h
@@ -2,28 +2,30 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_RESIZE_PARAMS_H_
-#define CONTENT_COMMON_RESIZE_PARAMS_H_
+#ifndef CONTENT_COMMON_VISUAL_PROPERTIES_H_
+#define CONTENT_COMMON_VISUAL_PROPERTIES_H_
 
 #include "base/optional.h"
 #include "components/viz/common/surfaces/local_surface_id.h"
 #include "content/common/content_export.h"
 #include "content/public/common/screen_info.h"
-#include "third_party/blink/public/platform/web_display_mode.h"
+#include "third_party/blink/public/common/manifest/web_display_mode.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace content {
 
-struct CONTENT_EXPORT ResizeParams {
-  ResizeParams();
-  ResizeParams(const ResizeParams& other);
-  ~ResizeParams();
+struct CONTENT_EXPORT VisualProperties {
+  VisualProperties();
+  VisualProperties(const VisualProperties& other);
+  ~VisualProperties();
+
+  VisualProperties& operator=(const VisualProperties& other);
 
   // Information about the screen (dpi, depth, etc..).
   ScreenInfo screen_info;
 
   // Whether or not blink should be in auto-resize mode.
-  bool auto_resize_enabled;
+  bool auto_resize_enabled = false;
 
   // The minimum size for Blink if auto-resize is enabled.
   gfx::Size min_size_for_auto_resize;
@@ -31,11 +33,6 @@ struct CONTENT_EXPORT ResizeParams {
   // The maximum size for Blink if auto-resize is enabled.
   gfx::Size max_size_for_auto_resize;
 
-  // This variable is increased after each auto-resize. If the
-  // renderer receives a ResizeParams with stale auto_resize_seqence_number,
-  // then the resize request is dropped.
-  uint64_t auto_resize_sequence_number;
-
   // The size for the widget in DIPs.
   gfx::Size new_size;
 
@@ -46,18 +43,18 @@ struct CONTENT_EXPORT ResizeParams {
 
   // Whether or not Blink's viewport size should be shrunk by the height of the
   // URL-bar (always false on platforms where URL-bar hiding isn't supported).
-  bool browser_controls_shrink_blink_size;
+  bool browser_controls_shrink_blink_size = false;
 
   // Whether or not the focused node should be scrolled into view after the
   // resize.
-  bool scroll_focused_node_into_view;
+  bool scroll_focused_node_into_view = false;
 
   // The height of the top controls (always 0 on platforms where URL-bar hiding
   // isn't supported).
-  float top_controls_height;
+  float top_controls_height = 0.f;
 
   // The height of the bottom controls.
-  float bottom_controls_height;
+  float bottom_controls_height = 0.f;
 
   // The local surface ID to use (if valid).
   base::Optional<viz::LocalSurfaceId> local_surface_id;
@@ -68,22 +65,17 @@ struct CONTENT_EXPORT ResizeParams {
   gfx::Size visible_viewport_size;
 
   // Indicates whether tab-initiated fullscreen was granted.
-  bool is_fullscreen_granted;
+  bool is_fullscreen_granted = false;
 
   // The display mode.
-  blink::WebDisplayMode display_mode;
-
-  // If set, requests the renderer to reply with a
-  // ViewHostMsg_ResizeOrRepaint_ACK with the
-  // ViewHostMsg_ResizeOrRepaint_ACK_Flags::IS_RESIZE_ACK bit set in flags.
-  bool needs_resize_ack;
+  blink::WebDisplayMode display_mode = blink::kWebDisplayModeUndefined;
 
-  // This variable is increased after each cross-document navigation. If the
-  // renderer receives a ResizeParams with stale content_source_id, it still
-  // performs the resize but doesn't use the given LocalSurfaceId.
-  uint32_t content_source_id;
+  // This represents the latest capture sequence number requested. When this is
+  // incremented, that means the caller wants to synchronize surfaces which
+  // should cause a new LocalSurfaceId to be generated.
+  uint32_t capture_sequence_number = 0u;
 };
 
 }  // namespace content
 
-#endif  // CONTENT_COMMON_RESIZE_PARAMS_H_
+#endif  // CONTENT_COMMON_VISUAL_PROPERTIES_H_
diff --git a/chromium/content/common/wrapper_shared_url_loader_factory.cc b/chromium/content/common/wrapper_shared_url_loader_factory.cc
deleted file mode 100644
index 370d3ab507e..00000000000
--- a/chromium/content/common/wrapper_shared_url_loader_factory.cc
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/wrapper_shared_url_loader_factory.h"
-
-
-namespace content {
-
-WrapperSharedURLLoaderFactoryInfo::WrapperSharedURLLoaderFactoryInfo() =
-    default;
-
-WrapperSharedURLLoaderFactoryInfo::WrapperSharedURLLoaderFactoryInfo(
-    network::mojom::URLLoaderFactoryPtrInfo factory_ptr_info)
-    : factory_ptr_info_(std::move(factory_ptr_info)) {}
-
-WrapperSharedURLLoaderFactoryInfo::~WrapperSharedURLLoaderFactoryInfo() =
-    default;
-
-scoped_refptr<network::SharedURLLoaderFactory>
-WrapperSharedURLLoaderFactoryInfo::CreateFactory() {
-  return base::MakeRefCounted<WrapperSharedURLLoaderFactory>(
-      std::move(factory_ptr_info_));
-}
-
-}  // namespace content
diff --git a/chromium/content/common/wrapper_shared_url_loader_factory.h b/chromium/content/common/wrapper_shared_url_loader_factory.h
deleted file mode 100644
index fd1bc0871b8..00000000000
--- a/chromium/content/common/wrapper_shared_url_loader_factory.h
+++ /dev/null
@@ -1,88 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_WRAPPER_SHARED_URL_LOADER_FACTORY_H_
-#define CONTENT_COMMON_WRAPPER_SHARED_URL_LOADER_FACTORY_H_
-
-#include "content/common/content_export.h"
-#include "content/common/possibly_associated_interface_ptr.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
-#include "services/network/public/cpp/shared_url_loader_factory.h"
-#include "services/network/public/mojom/url_loader_factory.mojom.h"
-
-namespace content {
-
-// A SharedURLLoaderFactoryInfo implementation that wraps a
-// network::mojom::URLLoaderFactoryPtrInfo.
-class CONTENT_EXPORT WrapperSharedURLLoaderFactoryInfo
-    : public network::SharedURLLoaderFactoryInfo {
- public:
-  WrapperSharedURLLoaderFactoryInfo();
-  explicit WrapperSharedURLLoaderFactoryInfo(
-      network::mojom::URLLoaderFactoryPtrInfo factory_ptr_info);
-
-  ~WrapperSharedURLLoaderFactoryInfo() override;
-
- private:
-  // SharedURLLoaderFactoryInfo implementation.
-  scoped_refptr<network::SharedURLLoaderFactory> CreateFactory() override;
-
-  network::mojom::URLLoaderFactoryPtrInfo factory_ptr_info_;
-};
-
-// A SharedURLLoaderFactory implementation that wraps a
-// PtrTemplateType<network::mojom::URLLoaderFactory>.
-template <template <typename> class PtrTemplateType>
-class WrapperSharedURLLoaderFactoryBase
-    : public network::SharedURLLoaderFactory {
- public:
-  using PtrType = PtrTemplateType<network::mojom::URLLoaderFactory>;
-  using PtrInfoType = typename PtrType::PtrInfoType;
-
-  explicit WrapperSharedURLLoaderFactoryBase(PtrType factory_ptr)
-      : factory_ptr_(std::move(factory_ptr)) {}
-
-  explicit WrapperSharedURLLoaderFactoryBase(PtrInfoType factory_ptr_info)
-      : factory_ptr_(std::move(factory_ptr_info)) {}
-
-  // SharedURLLoaderFactory implementation.
-  void CreateLoaderAndStart(network::mojom::URLLoaderRequest loader,
-                            int32_t routing_id,
-                            int32_t request_id,
-                            uint32_t options,
-                            const network::ResourceRequest& request,
-                            network::mojom::URLLoaderClientPtr client,
-                            const net::MutableNetworkTrafficAnnotationTag&
-                                traffic_annotation) override {
-    if (!factory_ptr_)
-      return;
-    factory_ptr_->CreateLoaderAndStart(std::move(loader), routing_id,
-                                       request_id, options, request,
-                                       std::move(client), traffic_annotation);
-  }
-
-  std::unique_ptr<network::SharedURLLoaderFactoryInfo> Clone() override {
-    network::mojom::URLLoaderFactoryPtrInfo factory_ptr_info;
-    if (factory_ptr_)
-      factory_ptr_->Clone(mojo::MakeRequest(&factory_ptr_info));
-    return std::make_unique<WrapperSharedURLLoaderFactoryInfo>(
-        std::move(factory_ptr_info));
-  }
-
- private:
-  ~WrapperSharedURLLoaderFactoryBase() override = default;
-
-  PtrType factory_ptr_;
-};
-
-using WrapperSharedURLLoaderFactory =
-    WrapperSharedURLLoaderFactoryBase<mojo::InterfacePtr>;
-using AssociatedWrapperSharedURLLoaderFactory =
-    WrapperSharedURLLoaderFactoryBase<mojo::AssociatedInterfacePtr>;
-using PossiblyAssociatedWrapperSharedURLLoaderFactory =
-    WrapperSharedURLLoaderFactoryBase<PossiblyAssociatedInterfacePtr>;
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_WRAPPER_URL_LOADER_FACTORY_H_
diff --git a/chromium/content/common/zygote_commands_linux.h b/chromium/content/common/zygote_commands_linux.h
deleted file mode 100644
index 24f3bf6517e..00000000000
--- a/chromium/content/common/zygote_commands_linux.h
+++ /dev/null
@@ -1,54 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_ZYGOTE_COMMANDS_LINUX_H_
-#define CONTENT_COMMON_ZYGOTE_COMMANDS_LINUX_H_
-
-#include <stddef.h>
-
-#include "base/posix/global_descriptors.h"
-
-namespace content {
-
-// Contents of the initial message sent from the zygote to the browser right
-// after it starts.
-static const char kZygoteBootMessage[] = "ZYGOTE_BOOT";
-
-// Contents of the initial message sent from the zygote to the browser when it
-// is ready to go.
-static const char kZygoteHelloMessage[] = "ZYGOTE_OK";
-
-// Message sent by zygote children to the browser so the browser can discover
-// the sending child's process ID.
-static const char kZygoteChildPingMessage[] = "CHILD_PING";
-
-// Maximum allowable length for messages sent to the zygote.
-const size_t kZygoteMaxMessageLength = 8192;
-
-// File descriptors initialized by the Zygote Host
-const int kZygoteSocketPairFd = base::GlobalDescriptors::kBaseDescriptor;
-
-// These are the command codes used on the wire between the browser and the
-// zygote.
-enum {
-  // Fork off a new renderer.
-  kZygoteCommandFork = 0,
-
-  // Reap a renderer child.
-  kZygoteCommandReap = 1,
-
-  // Check what happened to a child process.
-  kZygoteCommandGetTerminationStatus = 2,
-
-  // Read a bitmask of kSandboxLinux*
-  kZygoteCommandGetSandboxStatus = 3,
-
-  // Not a real zygote command, but a subcommand used during the zygote fork
-  // protocol.  Sends the child's PID as seen from the browser process.
-  kZygoteCommandForkRealPID = 4
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_ZYGOTE_COMMANDS_LINUX_H_
author	Allan Sandfeld Jensen <allan.jensen@qt.io>	2018-08-24 12:15:48 +0200
committer	Allan Sandfeld Jensen <allan.jensen@qt.io>	2018-08-28 13:30:04 +0000
commit	b014812705fc80bff0a5c120dfcef88f349816dc (patch)
tree	25a2e2d9fa285f1add86aa333389a839f81a39ae /chromium/content/common
parent	9f4560b1027ae06fdb497023cdcaf91b8511fa74 (diff)
download	qtwebengine-chromium-b014812705fc80bff0a5c120dfcef88f349816dc.tar.gz