BASELINE: Update Chromium to 79.0.3945.139

Change-Id: I336b7182fab9bca80b709682489c07db112eaca5
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

61 files changed, 529 insertions, 1535 deletions

diff --git a/chromium/content/common/BUILD.gn b/chromium/content/common/BUILD.gn
index fa7f26603b8..7070753ef72 100644
--- a/chromium/content/common/BUILD.gn
+++ b/chromium/content/common/BUILD.gn
@@ -24,6 +24,7 @@ buildflag_header("buildflags") {
   flags = [
     "USE_EXTERNAL_POPUP_MENU=$use_external_popup_menu",
     "ALLOW_CRITICAL_MEMORY_PRESSURE_HANDLING_IN_FOREGROUND=$allow_critical_memory_pressure_handling_in_foreground",
+    "ENABLE_SCREEN_CAPTURE=$enable_screen_capture",
   ]
 }
 
@@ -59,6 +60,9 @@ source_set("common") {
     "browser_plugin/browser_plugin_messages.h",
     "child_process_host_impl.cc",
     "child_process_host_impl.h",
+    "common_param_traits.cc",
+    "common_param_traits.h",
+    "common_param_traits_macros.h",
     "common_sandbox_support_linux.cc",
     "content_constants_internal.cc",
     "content_constants_internal.h",
@@ -177,10 +181,6 @@ source_set("common") {
     "media/cdm_info.cc",
     "media/media_player_delegate_messages.h",
     "media/peer_connection_tracker_messages.h",
-    "mime_sniffing_throttle.cc",
-    "mime_sniffing_throttle.h",
-    "mime_sniffing_url_loader.cc",
-    "mime_sniffing_url_loader.h",
     "navigation_gesture.h",
     "navigation_params.cc",
     "navigation_params.h",
@@ -192,7 +192,6 @@ source_set("common") {
     "page_messages.h",
     "page_state_serialization.cc",
     "page_state_serialization.h",
-    "page_zoom.cc",
     "pepper_file_util.cc",
     "pepper_file_util.h",
     "pepper_plugin_list.cc",
@@ -473,7 +472,6 @@ mojom("mojo_bindings") {
     "frame_proxy.mojom",
     "frame_sink_provider.mojom",
     "histogram_fetcher.mojom",
-    "host_zoom.mojom",
     "input/input_handler.mojom",
     "input/input_injector.mojom",
     "input/synchronous_compositor.mojom",
diff --git a/chromium/content/common/DEPS b/chromium/content/common/DEPS
index 6a18ca55af0..571d23646cb 100644
--- a/chromium/content/common/DEPS
+++ b/chromium/content/common/DEPS
@@ -47,7 +47,6 @@ include_rules = [
   "+third_party/blink/public/platform/web_scroll_into_view_params.h",
   "+third_party/blink/public/platform/web_scroll_types.h",
   "+third_party/blink/public/platform/web_storage_area.h",
-  "+third_party/blink/public/platform/web_sudden_termination_disabler_type.h",
   "+third_party/blink/public/platform/web_text_autosizer_page_info.h",
   "+third_party/blink/public/platform/web_touch_event.h",
   "+third_party/blink/public/platform/linux/web_fallback_font.h",
@@ -63,15 +62,12 @@ include_rules = [
   "+third_party/blink/public/web/web_device_emulation_params.h",
   "+third_party/blink/public/web/web_drag_status.h",
   "+third_party/blink/public/web/web_frame_owner_properties.h",
-  "+third_party/blink/public/web/web_fullscreen_options.h",
   "+third_party/blink/public/web/web_ime_text_span.h",
   "+third_party/blink/public/web/web_media_player_action.h",
-  "+third_party/blink/public/web/web_plugin_action.h",
   "+third_party/blink/public/web/WebSharedWorkerCreationContextType.h",
   "+third_party/blink/public/web/WebSharedWorkerCreationErrors.h",
   "+third_party/blink/public/web/web_text_direction.h",
   "+third_party/blink/public/web/web_tree_scope_type.h",
-  "+third_party/blink/public/web/web_triggering_event_info.h",
   "+third_party/blink/public/web/win/web_font_rendering.h",
 ]
 specific_include_rules = {
diff --git a/chromium/content/common/associated_interfaces.mojom b/chromium/content/common/associated_interfaces.mojom
index cc8bdcb3f3c..a890215ac40 100644
--- a/chromium/content/common/associated_interfaces.mojom
+++ b/chromium/content/common/associated_interfaces.mojom
@@ -10,5 +10,5 @@ import "third_party/blink/public/mojom/associated_interfaces/associated_interfac
 // ID to an AssociatedInterfaceProvider.
 interface RouteProvider {
   GetRoute(int32 routing_id,
-           associated blink.mojom.AssociatedInterfaceProvider& request);
+           pending_associated_receiver<blink.mojom.AssociatedInterfaceProvider> receiver);
 };
diff --git a/chromium/content/common/background_fetch/background_fetch_types.cc b/chromium/content/common/background_fetch/background_fetch_types.cc
index f5726e16a5b..3521948217c 100644
--- a/chromium/content/common/background_fetch/background_fetch_types.cc
+++ b/chromium/content/common/background_fetch/background_fetch_types.cc
@@ -4,16 +4,18 @@
 
 #include "content/common/background_fetch/background_fetch_types.h"
 
+#include "mojo/public/cpp/bindings/remote.h"
+
 namespace {
 
 blink::mojom::SerializedBlobPtr CloneSerializedBlob(
     const blink::mojom::SerializedBlobPtr& blob) {
   if (blob.is_null())
     return nullptr;
-  blink::mojom::BlobPtr blob_ptr(std::move(blob->blob));
-  blob_ptr->Clone(mojo::MakeRequest(&blob->blob));
-  return blink::mojom::SerializedBlob::New(
-      blob->uuid, blob->content_type, blob->size, blob_ptr.PassInterface());
+  mojo::Remote<blink::mojom::Blob> blob_remote(std::move(blob->blob));
+  blob_remote->Clone(blob->blob.InitWithNewPipeAndPassReceiver());
+  return blink::mojom::SerializedBlob::New(blob->uuid, blob->content_type,
+                                           blob->size, blob_remote.Unbind());
 }
 
 }  // namespace
@@ -33,7 +35,9 @@ blink::mojom::FetchAPIResponsePtr BackgroundFetchSettledFetch::CloneResponse(
       CloneSerializedBlob(response->blob), response->error,
       response->response_time, response->cache_storage_cache_name,
       response->cors_exposed_header_names,
-      CloneSerializedBlob(response->side_data_blob));
+      CloneSerializedBlob(response->side_data_blob),
+      CloneSerializedBlob(response->side_data_blob_for_cache_put),
+      response->content_security_policy.Clone());
 }
 
 // static
diff --git a/chromium/content/common/common_param_traits.cc b/chromium/content/common/common_param_traits.cc
new file mode 100644
index 00000000000..a2125ec45cd
--- /dev/null
+++ b/chromium/content/common/common_param_traits.cc
@@ -0,0 +1,27 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Get basic type definitions.
+#include "content/common/common_param_traits.h"
+
+// Generate param traits write methods.
+#include "ipc/param_traits_write_macros.h"
+namespace IPC {
+#undef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#include "content/common/common_param_traits_macros.h"
+}  // namespace IPC
+
+// Generate param traits read methods.
+#include "ipc/param_traits_read_macros.h"
+namespace IPC {
+#undef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#include "content/common/common_param_traits_macros.h"
+}  // namespace IPC
+
+// Generate param traits log methods.
+#include "ipc/param_traits_log_macros.h"
+namespace IPC {
+#undef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#include "content/common/common_param_traits_macros.h"
+}  // namespace IPC
diff --git a/chromium/content/common/common_param_traits.h b/chromium/content/common/common_param_traits.h
new file mode 100644
index 00000000000..d375a2a137a
--- /dev/null
+++ b/chromium/content/common/common_param_traits.h
@@ -0,0 +1,13 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_COMMON_PARAM_TRAITS_H_
+#define CONTENT_COMMON_COMMON_PARAM_TRAITS_H_
+
+// This file provides declarations of IPC serialization macros that are used
+// in more than one IPC message file.
+
+#include "content/common/common_param_traits_macros.h"
+
+#endif  // CONTENT_COMMON_COMMON_PARAM_TRAITS_H_
diff --git a/chromium/content/common/common_param_traits_macros.h b/chromium/content/common/common_param_traits_macros.h
new file mode 100644
index 00000000000..7b3fc10afd6
--- /dev/null
+++ b/chromium/content/common/common_param_traits_macros.h
@@ -0,0 +1,54 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Singly or Multiply-included shared traits file depending on circumstances.
+// This allows the use of IPC serialization macros in more than one IPC message
+// file.
+#ifndef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#define CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+
+#include "content/common/frame_messages.h"
+#include "content/common/visual_properties.h"
+#include "ipc/ipc_message_macros.h"
+#include "third_party/blink/public/web/web_device_emulation_params.h"
+
+#undef IPC_MESSAGE_EXPORT
+#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
+
+// Traits for VisualProperties.
+IPC_ENUM_TRAITS_MAX_VALUE(blink::WebDeviceEmulationParams::ScreenPosition,
+                          blink::WebDeviceEmulationParams::kScreenPositionLast)
+
+IPC_ENUM_TRAITS_MAX_VALUE(content::ScreenOrientationValues,
+                          content::SCREEN_ORIENTATION_VALUES_LAST)
+
+IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScreenOrientationType,
+                              blink::kWebScreenOrientationUndefined,
+                              blink::WebScreenOrientationTypeLast)
+
+IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::DisplayMode,
+                          blink::mojom::DisplayMode::kMaxValue)
+
+IPC_STRUCT_TRAITS_BEGIN(content::VisualProperties)
+  IPC_STRUCT_TRAITS_MEMBER(screen_info)
+  IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
+  IPC_STRUCT_TRAITS_MEMBER(max_size_for_auto_resize)
+  IPC_STRUCT_TRAITS_MEMBER(new_size)
+  IPC_STRUCT_TRAITS_MEMBER(compositor_viewport_pixel_rect)
+  IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
+  IPC_STRUCT_TRAITS_MEMBER(scroll_focused_node_into_view)
+  IPC_STRUCT_TRAITS_MEMBER(top_controls_height)
+  IPC_STRUCT_TRAITS_MEMBER(bottom_controls_height)
+  IPC_STRUCT_TRAITS_MEMBER(local_surface_id_allocation)
+  IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
+  IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
+  IPC_STRUCT_TRAITS_MEMBER(display_mode)
+  IPC_STRUCT_TRAITS_MEMBER(capture_sequence_number)
+  IPC_STRUCT_TRAITS_MEMBER(zoom_level)
+  IPC_STRUCT_TRAITS_MEMBER(page_scale_factor)
+  IPC_STRUCT_TRAITS_MEMBER(is_pinch_gesture_active)
+IPC_STRUCT_TRAITS_END()
+
+#endif  // CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
diff --git a/chromium/content/common/content_param_traits.cc b/chromium/content/common/content_param_traits.cc
index 7a5c824a3c0..7487aa02656 100644
--- a/chromium/content/common/content_param_traits.cc
+++ b/chromium/content/common/content_param_traits.cc
@@ -17,10 +17,12 @@
 #include "content/common/tab_switch_time_recorder.h"
 #include "ipc/ipc_mojo_message_helper.h"
 #include "ipc/ipc_mojo_param_traits.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/ip_endpoint.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
+#include "third_party/blink/public/mojom/feature_policy/policy_value.mojom.h"
 #include "third_party/blink/public/mojom/messaging/transferable_message.mojom.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/events/blink/web_input_event_traits.h"
@@ -223,7 +225,7 @@ struct ParamTraits<blink::mojom::SerializedBlobPtr> {
     WriteParam(m, p->uuid);
     WriteParam(m, p->content_type);
     WriteParam(m, p->size);
-    WriteParam(m, p->blob.PassHandle().release());
+    WriteParam(m, p->blob.PassPipe().release());
   }
 
   static bool Read(const base::Pickle* m,
@@ -236,7 +238,7 @@ struct ParamTraits<blink::mojom::SerializedBlobPtr> {
         !ReadParam(m, iter, &(*r)->size) || !ReadParam(m, iter, &handle)) {
       return false;
     }
-    (*r)->blob = blink::mojom::BlobPtrInfo(
+    (*r)->blob = mojo::PendingRemote<blink::mojom::Blob>(
         mojo::ScopedMessagePipeHandle(handle), blink::mojom::Blob::Version_);
     return true;
   }
@@ -250,6 +252,7 @@ void ParamTraits<scoped_refptr<base::RefCountedData<
   WriteParam(m, p->data.stack_trace_id);
   WriteParam(m, p->data.stack_trace_debugger_id_first);
   WriteParam(m, p->data.stack_trace_debugger_id_second);
+  WriteParam(m, p->data.stack_trace_should_pause);
   WriteParam(m, p->data.ports);
   WriteParam(m, p->data.stream_channels);
   WriteParam(m, !!p->data.user_activation);
@@ -282,6 +285,7 @@ bool ParamTraits<
       !ReadParam(m, iter, &(*r)->data.stack_trace_id) ||
       !ReadParam(m, iter, &(*r)->data.stack_trace_debugger_id_first) ||
       !ReadParam(m, iter, &(*r)->data.stack_trace_debugger_id_second) ||
+      !ReadParam(m, iter, &(*r)->data.stack_trace_should_pause) ||
       !ReadParam(m, iter, &(*r)->data.ports) ||
       !ReadParam(m, iter, &(*r)->data.stream_channels) ||
       !ReadParam(m, iter, &has_activation) ||
diff --git a/chromium/content/common/content_security_policy/csp_source.cc b/chromium/content/common/content_security_policy/csp_source.cc
index f941a24d864..56166305223 100644
--- a/chromium/content/common/content_security_policy/csp_source.cc
+++ b/chromium/content/common/content_security_policy/csp_source.cc
@@ -9,6 +9,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/common/content_security_policy/csp_context.h"
+#include "services/network/public/mojom/content_security_policy.mojom.h"
 #include "url/url_canon.h"
 #include "url/url_util.h"
 
@@ -172,6 +173,14 @@ CSPSource::CSPSource(const std::string& scheme,
   DCHECK(!is_port_wildcard || port == url::PORT_UNSPECIFIED);
 }
 
+CSPSource::CSPSource(const network::mojom::CSPSource& csp_source)
+    : CSPSource(csp_source.scheme,
+                csp_source.host,
+                csp_source.is_host_wildcard,
+                csp_source.port,
+                csp_source.is_port_wildcard,
+                csp_source.path) {}
+
 CSPSource::CSPSource(const CSPSource& source) = default;
 CSPSource::~CSPSource() = default;
 
diff --git a/chromium/content/common/content_security_policy/csp_source.h b/chromium/content/common/content_security_policy/csp_source.h
index de2c051945c..9dfd5bf61b5 100644
--- a/chromium/content/common/content_security_policy/csp_source.h
+++ b/chromium/content/common/content_security_policy/csp_source.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "content/common/content_export.h"
+#include "services/network/public/mojom/content_security_policy.mojom-forward.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -31,6 +32,7 @@ struct CONTENT_EXPORT CSPSource {
             int port,
             bool is_port_wildcard,
             const std::string& path);
+  explicit CSPSource(const network::mojom::CSPSource& csp_source);
   CSPSource(const CSPSource& source);
   ~CSPSource();
 
diff --git a/chromium/content/common/content_security_policy/csp_source_list.cc b/chromium/content/common/content_security_policy/csp_source_list.cc
index 3adb1e4e60d..664c2b64160 100644
--- a/chromium/content/common/content_security_policy/csp_source_list.cc
+++ b/chromium/content/common/content_security_policy/csp_source_list.cc
@@ -36,6 +36,29 @@ CSPSourceList::CSPSourceList(bool allow_self,
       allow_response_redirects(allow_response_redirects),
       sources(sources) {}
 
+CSPSourceList::CSPSourceList(
+    const network::mojom::CSPSourceList& csp_source_list)
+    : allow_self(false), allow_star(false), allow_response_redirects(false) {
+  for (auto& source : csp_source_list.sources) {
+    // The mojo representation of the source list has 'self' as a source entry,
+    // mark this source list as accepting 'self'.
+    if (source->allow_self) {
+      allow_self = true;
+      continue;
+    }
+    // The mojo representation has a '*' (wildcard) representation as empty
+    // scheme, host and port with is_host_wildcard set to true. Mark the source
+    // list as accepting star.
+    if (source->scheme == "" && source->is_host_wildcard &&
+        source->host == "" && source->port == url::PORT_UNSPECIFIED) {
+      allow_star = true;
+      continue;
+    }
+
+    sources.push_back(CSPSource(*source));
+  }
+}
+
 CSPSourceList::CSPSourceList(const CSPSourceList&) = default;
 CSPSourceList::~CSPSourceList() = default;
 
diff --git a/chromium/content/common/content_security_policy/csp_source_list.h b/chromium/content/common/content_security_policy/csp_source_list.h
index a1ce31f83c0..1bb5e5046db 100644
--- a/chromium/content/common/content_security_policy/csp_source_list.h
+++ b/chromium/content/common/content_security_policy/csp_source_list.h
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "content/common/content_security_policy/csp_source.h"
+#include "services/network/public/mojom/content_security_policy.mojom-forward.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -20,6 +21,7 @@ struct CONTENT_EXPORT CSPSourceList {
                 bool allow_star,
                 bool allow_response_redirects,
                 std::vector<CSPSource> source_list);
+  explicit CSPSourceList(const network::mojom::CSPSourceList& csp_source_list);
   CSPSourceList(const CSPSourceList&);
   ~CSPSourceList();
 
diff --git a/chromium/content/common/coverage_utils.cc b/chromium/content/common/coverage_utils.cc
index 00794b2253d..609f5039309 100644
--- a/chromium/content/common/coverage_utils.cc
+++ b/chromium/content/common/coverage_utils.cc
@@ -15,8 +15,11 @@
 #include "base/path_service.h"
 #include "base/rand_util.h"
 #include "base/strings/strcat.h"
+#include "base/strings/string16.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_restrictions.h"
+#include "build/build_config.h"
 
 namespace content {
 
@@ -26,7 +29,11 @@ base::File OpenCoverageFile() {
   std::string prof_template;
   base::FilePath path;
   if (env->GetVar("LLVM_PROFILE_FILE", &prof_template)) {
+#if defined(OS_WIN)
+    path = base::FilePath(base::UTF8ToUTF16(prof_template)).DirName();
+#else
     path = base::FilePath(prof_template).DirName();
+#endif
     base::CreateDirectory(path);
   } else {
     base::PathService::Get(base::DIR_CURRENT, &path);
@@ -37,7 +44,11 @@ base::File OpenCoverageFile() {
   int pool_index = base::RandInt(0, 3);
   std::string filename = base::StrCat(
       {"child_pool-", base::NumberToString(pool_index), ".profraw"});
+#if defined(OS_WIN)
+  path = path.Append(base::UTF8ToUTF16(filename));
+#else
   path = path.Append(filename);
+#endif
   uint32_t flags = base::File::FLAG_OPEN_ALWAYS | base::File::FLAG_READ |
                    base::File::FLAG_WRITE;
 
diff --git a/chromium/content/common/features.gni b/chromium/content/common/features.gni
index b1bcb83306b..13874c33dde 100644
--- a/chromium/content/common/features.gni
+++ b/chromium/content/common/features.gni
@@ -12,3 +12,5 @@ declare_args() {
   # false, critical memory pressure is treated like moderate pressure in foreground).
   allow_critical_memory_pressure_handling_in_foreground = is_chromecast
 }
+
+enable_screen_capture = is_linux || is_mac || is_win || is_android
diff --git a/chromium/content/common/fetch/fetch_api_request_proto.cc b/chromium/content/common/fetch/fetch_api_request_proto.cc
index 1a478f2b0c8..52e33c17e3c 100644
--- a/chromium/content/common/fetch/fetch_api_request_proto.cc
+++ b/chromium/content/common/fetch/fetch_api_request_proto.cc
@@ -5,6 +5,7 @@
 #include "content/common/fetch/fetch_api_request_proto.h"
 
 #include "content/common/fetch/fetch_api_request.pb.h"
+#include "content/public/common/referrer.h"
 
 namespace content {
 
@@ -54,10 +55,10 @@ blink::mojom::FetchAPIRequestPtr DeserializeFetchRequestFromString(
   request_ptr->method = request_proto.method();
   request_ptr->headers = {request_proto.headers().begin(),
                           request_proto.headers().end()};
-  request_ptr->referrer =
-      blink::mojom::Referrer::New(GURL(request_proto.referrer().url()),
-                                  static_cast<network::mojom::ReferrerPolicy>(
-                                      request_proto.referrer().policy()));
+  request_ptr->referrer = blink::mojom::Referrer::New(
+      GURL(request_proto.referrer().url()),
+
+      Referrer::ConvertToPolicy(request_proto.referrer().policy()));
   request_ptr->is_reload = request_proto.is_reload();
   request_ptr->credentials_mode = static_cast<network::mojom::CredentialsMode>(
       request_proto.credentials_mode());
diff --git a/chromium/content/common/font_cache_dispatcher_win.cc b/chromium/content/common/font_cache_dispatcher_win.cc
index d4cb522a813..bb8fd56bcd6 100644
--- a/chromium/content/common/font_cache_dispatcher_win.cc
+++ b/chromium/content/common/font_cache_dispatcher_win.cc
@@ -15,7 +15,6 @@
 #include "base/strings/string16.h"
 #include "base/thread_annotations.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
-#include "services/service_manager/public/cpp/bind_source_info.h"
 
 namespace content {
 namespace {
@@ -138,9 +137,7 @@ FontCacheDispatcher::~FontCacheDispatcher() {
 }
 
 // static
-void FontCacheDispatcher::Create(
-    mojom::FontCacheWinRequest request,
-    const service_manager::BindSourceInfo& source_info) {
+void FontCacheDispatcher::Create(mojom::FontCacheWinRequest request) {
   mojo::MakeStrongBinding(std::make_unique<FontCacheDispatcher>(),
                           std::move(request));
 }
diff --git a/chromium/content/common/font_list_mac.mm b/chromium/content/common/font_list_mac.mm
index 64d2210bcb4..6b605e97fd6 100644
--- a/chromium/content/common/font_list_mac.mm
+++ b/chromium/content/common/font_list_mac.mm
@@ -8,38 +8,38 @@
 
 #include <utility>
 
-#include "base/mac/scoped_nsautorelease_pool.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/values.h"
 
 namespace content {
 
 std::unique_ptr<base::ListValue> GetFontList_SlowBlocking() {
-  base::mac::ScopedNSAutoreleasePool autorelease_pool;
-  std::unique_ptr<base::ListValue> font_list(new base::ListValue);
-  NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
-  NSMutableDictionary* fonts_dict = [NSMutableDictionary dictionary];
-  NSArray* fonts = [fontManager availableFontFamilies];
-
-  for (NSString* family_name in fonts) {
-    NSString* localized_family_name =
-        [fontManager localizedNameForFamily:family_name face:nil];
-    fonts_dict[family_name] = localized_family_name;
+  @autoreleasepool {
+    std::unique_ptr<base::ListValue> font_list(new base::ListValue);
+    NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
+    NSMutableDictionary* fonts_dict = [NSMutableDictionary dictionary];
+    NSArray* fonts = [fontManager availableFontFamilies];
+
+    for (NSString* family_name in fonts) {
+      NSString* localized_family_name =
+          [fontManager localizedNameForFamily:family_name face:nil];
+      fonts_dict[family_name] = localized_family_name;
+    }
+
+    // Sort family names based on localized names.
+    NSArray* sortedFonts = [fonts_dict
+        keysSortedByValueUsingSelector:@selector(localizedStandardCompare:)];
+
+    for (NSString* family_name in sortedFonts) {
+      NSString* localized_family_name = fonts_dict[family_name];
+      auto font_item = std::make_unique<base::ListValue>();
+      font_item->AppendString(base::SysNSStringToUTF16(family_name));
+      font_item->AppendString(base::SysNSStringToUTF16(localized_family_name));
+      font_list->Append(std::move(font_item));
+    }
+
+    return font_list;
   }
-
-  // Sort family names based on localized names.
-  NSArray* sortedFonts = [fonts_dict
-      keysSortedByValueUsingSelector:@selector(localizedStandardCompare:)];
-
-  for (NSString* family_name in sortedFonts) {
-    NSString* localized_family_name = fonts_dict[family_name];
-    auto font_item = std::make_unique<base::ListValue>();
-    font_item->AppendString(base::SysNSStringToUTF16(family_name));
-    font_item->AppendString(base::SysNSStringToUTF16(localized_family_name));
-    font_list->Append(std::move(font_item));
-  }
-
-  return font_list;
 }
 
 }  // namespace content
diff --git a/chromium/content/common/frame.mojom b/chromium/content/common/frame.mojom
index 79660bebe2f..b7ef3588dcf 100644
--- a/chromium/content/common/frame.mojom
+++ b/chromium/content/common/frame.mojom
@@ -9,6 +9,7 @@ import "content/common/frame_messages.mojom";
 import "content/common/native_types.mojom";
 import "content/common/navigation_client.mojom";
 import "content/common/navigation_params.mojom";
+import "content/public/common/browser_controls_state.mojom";
 import "content/public/common/resource_type.mojom";
 import "content/public/common/resource_load_info.mojom";
 import "content/public/common/transferrable_url_loader.mojom";
@@ -21,6 +22,7 @@ import "services/network/public/mojom/url_loader.mojom";
 import "services/network/public/mojom/url_loader_factory.mojom";
 import "services/service_manager/public/mojom/interface_provider.mojom";
 import "services/viz/public/mojom/compositing/surface_id.mojom";
+import "skia/public/mojom/skcolor.mojom";
 import "third_party/blink/public/mojom/blob/blob_url_store.mojom";
 import "third_party/blink/public/mojom/commit_result/commit_result.mojom";
 import "third_party/blink/public/mojom/devtools/console_message.mojom";
@@ -71,6 +73,13 @@ interface Frame {
   ExtractSmartClipData(gfx.mojom.Rect rect)
       => (mojo_base.mojom.String16 text, mojo_base.mojom.String16 html,
               gfx.mojom.Rect clip_rect);
+
+  // Notifies the renderer whether hiding/showing the browser controls is
+  // enabled, what the current state should be, and whether or not to
+  // animate to the proper state.
+  UpdateBrowserControlsState(BrowserControlsState constraints,
+                             BrowserControlsState current,
+                             bool animate);
 };
 
 // Implemented by the frame provider and currently must be associated with the
@@ -252,12 +261,18 @@ interface FrameBindingsControl {
   // that allow JS content extended privileges. See BindingsPolicy for valid
   // flag values.
   AllowBindings(int32 enabled_bindings_flags);
+
+  // Used to tell the RenderFrame to enable Mojo JS bindings, which allows
+  // JS code running in the renderer process to connect to Mojo interfaces
+  // and make method calls on them.
+  // This is used for WebUI only at this time.
+  EnableMojoJsBindings();
 };
 
 // Implemented by a service that provides implementations of the Frame
 // interface. (e.g. renderer processes).
 interface FrameFactory {
-  CreateFrame(int32 frame_routing_id, Frame& frame);
+  CreateFrame(int32 frame_routing_id, pending_receiver<Frame> frame);
 };
 
 struct CreateNewWindowParams {
@@ -323,6 +338,9 @@ struct CreateNewWindowReply {
   // The ID of the widget for the main frame.
   int32 main_frame_widget_route_id;
 
+  // Initial properties for the main frame RenderWidget.
+  VisualProperties visual_properties;
+
   DocumentScopedInterfaceBundle main_frame_interface_bundle;
 
   // Duplicated from CreateNewWindowParams because legacy code.
@@ -371,7 +389,7 @@ interface FrameHost {
           mojo_base.mojom.UnguessableToken devtools_frame_token);
 
   // Creates and returns a KeepAliveHandle.
-  IssueKeepAliveHandle(KeepAliveHandle& keep_alive_handle);
+  IssueKeepAliveHandle(pending_receiver<KeepAliveHandle> keep_alive_handle);
 
   // Sent by the renderer when a navigation commits in the frame.
 
@@ -416,7 +434,7 @@ interface FrameHost {
       CommonNavigationParams common_params,
       BeginNavigationParams begin_params,
       pending_remote<blink.mojom.BlobURLToken>? blob_url_token,
-      associated NavigationClient? navigation_client,
+      pending_associated_remote<NavigationClient>? navigation_client,
       pending_remote<blink.mojom.NavigationInitiator>? navigation_initiator);
 
   // Sent when a subresource response has started.
@@ -466,10 +484,6 @@ interface FrameHost {
   // navigation.
   FrameSizeChanged(gfx.mojom.Size size);
 
-  // Notifies the browser that the current frame has either become or is no
-  // longer fullscreen.
-  FullscreenStateChanged(bool is_fullscreen);
-
   // Notifies the browser that the current frame has changed its visibility
   // status.
   VisibilityChanged(blink.mojom.FrameVisibility visibility);
@@ -549,4 +563,7 @@ interface FrameHost {
   // Evicts the page from the back/forward cache due to e.g., JavaScript
   // execution.
   EvictFromBackForwardCache();
+
+  // Notifies the browser that the current frame has changed theme color.
+  DidChangeThemeColor(skia.mojom.SkColor? theme_color);
 };
diff --git a/chromium/content/common/frame_messages.h b/chromium/content/common/frame_messages.h
index c67d0cc0156..24decdbf52a 100644
--- a/chromium/content/common/frame_messages.h
+++ b/chromium/content/common/frame_messages.h
@@ -59,8 +59,11 @@
 #include "third_party/blink/public/common/frame/user_activation_update_type.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
+#include "third_party/blink/public/common/sudden_termination_disabler_type.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
@@ -69,12 +72,9 @@
 #include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
 #include "third_party/blink/public/platform/web_scroll_into_view_params.h"
 #include "third_party/blink/public/platform/web_scroll_types.h"
-#include "third_party/blink/public/platform/web_sudden_termination_disabler_type.h"
 #include "third_party/blink/public/web/web_frame_owner_properties.h"
-#include "third_party/blink/public/web/web_fullscreen_options.h"
 #include "third_party/blink/public/web/web_media_player_action.h"
 #include "third_party/blink/public/web/web_tree_scope_type.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
 #include "ui/events/types/scroll_types.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -138,8 +138,8 @@ IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::FeaturePolicyFeature,
                           blink::mojom::FeaturePolicyFeature::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(content::CSPDisposition,
                           content::CSPDisposition::LAST)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebTriggeringEventInfo,
-                          blink::WebTriggeringEventInfo::kMaxValue)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::TriggeringEventInfo,
+                          blink::TriggeringEventInfo::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::UserActivationUpdateType,
                           blink::UserActivationUpdateType::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebMediaPlayerAction::Type,
@@ -180,10 +180,6 @@ IPC_STRUCT_TRAITS_BEGIN(blink::WebIntrinsicSizingInfo)
   IPC_STRUCT_TRAITS_MEMBER(has_height)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(blink::WebFullscreenOptions)
-  IPC_STRUCT_TRAITS_MEMBER(prefers_navigation_bar)
-IPC_STRUCT_TRAITS_END()
-
 IPC_STRUCT_TRAITS_BEGIN(blink::WebScrollIntoViewParams::Alignment)
   IPC_STRUCT_TRAITS_MEMBER(rect_visible)
   IPC_STRUCT_TRAITS_MEMBER(rect_hidden)
@@ -506,20 +502,18 @@ IPC_STRUCT_BEGIN(FrameHostMsg_OpenURL_Params)
   IPC_STRUCT_MEMBER(WindowOpenDisposition, disposition)
   IPC_STRUCT_MEMBER(bool, should_replace_current_entry)
   IPC_STRUCT_MEMBER(bool, user_gesture)
-  IPC_STRUCT_MEMBER(blink::WebTriggeringEventInfo, triggering_event_info)
+  IPC_STRUCT_MEMBER(blink::TriggeringEventInfo, triggering_event_info)
   IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, blob_url_token)
   IPC_STRUCT_MEMBER(std::string, href_translate)
   IPC_STRUCT_MEMBER(content::NavigationDownloadPolicy, download_policy)
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameHostMsg_DownloadUrl_Params)
-  IPC_STRUCT_MEMBER(int, render_view_id)
-  IPC_STRUCT_MEMBER(int, render_frame_id)
   IPC_STRUCT_MEMBER(GURL, url)
   IPC_STRUCT_MEMBER(content::Referrer, referrer)
   IPC_STRUCT_MEMBER(url::Origin, initiator_origin)
   IPC_STRUCT_MEMBER(base::string16, suggested_name)
-  IPC_STRUCT_MEMBER(bool, follow_cross_origin_redirects)
+  IPC_STRUCT_MEMBER(network::mojom::RedirectMode, cross_origin_redirects)
   IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, blob_url_token)
 IPC_STRUCT_END()
 
@@ -692,10 +686,6 @@ IPC_MESSAGE_ROUTED0(FrameMsg_ChildFrameProcessGone)
 IPC_MESSAGE_ROUTED1(FrameMsg_ContextMenuClosed,
                     content::CustomContextMenuContext /* custom_context */)
 
-// Reloads all the Lo-Fi images in the RenderFrame. Ignores the cache and
-// reloads from the network.
-IPC_MESSAGE_ROUTED0(FrameMsg_ReloadLoFiImages)
-
 // Executes custom context menu action that was provided from Blink.
 IPC_MESSAGE_ROUTED2(FrameMsg_CustomContextMenuAction,
                     content::CustomContextMenuContext /* custom_context */,
@@ -751,10 +741,9 @@ IPC_MESSAGE_ROUTED3(FrameMsg_AddMessageToConsole,
                     std::string /* message */,
                     bool /* discard_duplicates */)
 
-// Tells the renderer to reload the frame, optionally bypassing the cache while
-// doing so.
-IPC_MESSAGE_ROUTED1(FrameMsg_Reload,
-                    bool /* bypass_cache */)
+// TODO(https://crbug.com/995428): Deprecated.
+// Tells the renderer to reload the frame.
+IPC_MESSAGE_ROUTED0(FrameMsg_Reload)
 
 // Change the accessibility mode in the renderer process.
 IPC_MESSAGE_ROUTED1(FrameMsg_SetAccessibilityMode, ui::AXMode)
@@ -1039,15 +1028,13 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_DidFinishLoad,
                     GURL /* validated_url */)
 
 // Initiates a download based on user actions like 'ALT+click'.
-IPC_MESSAGE_CONTROL(FrameHostMsg_DownloadUrl, FrameHostMsg_DownloadUrl_Params)
+IPC_MESSAGE_ROUTED1(FrameHostMsg_DownloadUrl, FrameHostMsg_DownloadUrl_Params)
 
 // Asks the browser to save a image (for <canvas> or <img>) from a data URL.
 // Note: |data_url| is the contents of a data:URL, and that it's represented as
 // a string only to work around size limitations for GURLs in IPC messages.
-IPC_MESSAGE_CONTROL3(FrameHostMsg_SaveImageFromDataURL,
-                     int /* render_view_id */,
-                     int /* render_frame_id */,
-                     std::string /* data_url */)
+IPC_MESSAGE_ROUTED1(FrameHostMsg_SaveImageFromDataURL,
+                    std::string /* data_url */)
 
 // Notifies that the initial empty document of a view has been accessed.
 // After this, it is no longer safe to show a pending navigation's URL without
@@ -1336,10 +1323,6 @@ IPC_SYNC_MESSAGE_ROUTED1_2(FrameHostMsg_RunBeforeUnloadConfirm,
                            bool /* out - success */,
                            base::string16 /* out - This is ignored.*/)
 
-// Notify browser the theme color has been changed.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_DidChangeThemeColor,
-                    base::Optional<SkColor> /* theme_color */)
-
 // Register a new handler for URL requests with the given scheme.
 IPC_MESSAGE_ROUTED4(FrameHostMsg_RegisterProtocolHandler,
                     std::string /* scheme */,
@@ -1378,19 +1361,11 @@ IPC_MESSAGE_ROUTED0(FrameHostMsg_AbortNavigation)
 // The message is delivered using RenderWidget::QueueMessage.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_VisualStateResponse, uint64_t /* id */)
 
-// Puts the browser into "tab fullscreen" mode for the sending renderer.
-// See the comment in chrome/browser/ui/browser.h for more details.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_EnterFullscreen, blink::WebFullscreenOptions)
-
-// Exits the browser from "tab fullscreen" mode for the sending renderer.
-// See the comment in chrome/browser/ui/browser.h for more details.
-IPC_MESSAGE_ROUTED0(FrameHostMsg_ExitFullscreen)
-
 // Sent when a new sudden termination disabler condition is either introduced or
 // removed.
 IPC_MESSAGE_ROUTED2(FrameHostMsg_SuddenTerminationDisablerChanged,
                     bool /* present */,
-                    blink::WebSuddenTerminationDisablerType /* disabler_type */)
+                    blink::SuddenTerminationDisablerType /* disabler_type */)
 
 // Requests that the resource timing info be added to the performance entries of
 // a remote parent frame.
@@ -1504,10 +1479,9 @@ IPC_MESSAGE_ROUTED0(FrameHostMsg_RenderFallbackContentInParentProcess)
 // Used to go to the session history entry at the given offset (ie, -1 will
 // return the "back" item). This message affects a view and not just a frame,
 // but is sent on the frame channel for attribution purposes.
-IPC_MESSAGE_ROUTED3(FrameHostMsg_GoToEntryAtOffset,
+IPC_MESSAGE_ROUTED2(FrameHostMsg_GoToEntryAtOffset,
                     int /* offset (from current) of history item to get */,
-                    bool /* has_user_gesture */,
-                    bool /* from_script */)
+                    bool /* has_user_gesture */)
 
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
 
diff --git a/chromium/content/common/frame_sink_provider.mojom b/chromium/content/common/frame_sink_provider.mojom
index f02c4825426..2df0b197d5b 100644
--- a/chromium/content/common/frame_sink_provider.mojom
+++ b/chromium/content/common/frame_sink_provider.mojom
@@ -14,12 +14,15 @@ import "services/viz/public/mojom/compositing/compositor_frame_sink.mojom";
 interface FrameSinkProvider {
   CreateForWidget(
       int32 widget_id,
-      viz.mojom.CompositorFrameSink& compositor_frame_sink_request,
-      viz.mojom.CompositorFrameSinkClient compositor_frame_sink_client);
+      pending_receiver<viz.mojom.CompositorFrameSink>
+          compositor_frame_sink_receiver,
+      pending_remote<viz.mojom.CompositorFrameSinkClient>
+          compositor_frame_sink_client);
 
    RegisterRenderFrameMetadataObserver(
       int32  widget_id,
-      RenderFrameMetadataObserverClient&
-        render_frame_metadata_observer_client_request,
-      RenderFrameMetadataObserver render_frame_metadata_observer);
+      pending_receiver<RenderFrameMetadataObserverClient>
+        render_frame_metadata_observer_client_receiver,
+      pending_remote<RenderFrameMetadataObserver>
+        render_frame_metadata_observer);
 };
diff --git a/chromium/content/common/histogram_fetcher.mojom b/chromium/content/common/histogram_fetcher.mojom
index 76c0d258b40..5ffecb492bc 100644
--- a/chromium/content/common/histogram_fetcher.mojom
+++ b/chromium/content/common/histogram_fetcher.mojom
@@ -10,7 +10,7 @@ interface ChildHistogramFetcherFactory {
   // Creates a ChildHistogram interface that uses shared memory buffer to
   // store histograms that are to be reported by the browser process to UMA.
   CreateFetcher(mojo_base.mojom.WritableSharedMemoryRegion? shared_memory,
-                       ChildHistogramFetcher& child_histogram_fetcher);
+                pending_receiver<ChildHistogramFetcher> child_histogram_fetcher);
 };
 
 interface ChildHistogramFetcher{
diff --git a/chromium/content/common/host_zoom.mojom b/chromium/content/common/host_zoom.mojom
deleted file mode 100644
index 2204340da70..00000000000
--- a/chromium/content/common/host_zoom.mojom
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content.mojom;
-
-import "url/mojom/url.mojom";
-
-interface HostZoom {
-  // Sets the host zoom level for the given url, called just before commit.
-  SetHostZoomLevel(url.mojom.Url url, double zoom_level);
-};
diff --git a/chromium/content/common/input/event_with_latency_info_unittest.cc b/chromium/content/common/input/event_with_latency_info_unittest.cc
index 1d5fec27ea2..53c46856a46 100644
--- a/chromium/content/common/input/event_with_latency_info_unittest.cc
+++ b/chromium/content/common/input/event_with_latency_info_unittest.cc
@@ -325,13 +325,10 @@ TEST_F(EventWithLatencyInfoTest, WebMouseWheelEventCoalescing) {
   EXPECT_TRUE(CanCoalesce(mouse_wheel_0, mouse_wheel_1));
   EXPECT_EQ(mouse_wheel_0.event.GetModifiers(),
             mouse_wheel_1.event.GetModifiers());
-  EXPECT_EQ(mouse_wheel_0.event.scroll_by_page,
-            mouse_wheel_1.event.scroll_by_page);
+  EXPECT_EQ(mouse_wheel_0.event.delta_units, mouse_wheel_1.event.delta_units);
   EXPECT_EQ(mouse_wheel_0.event.phase, mouse_wheel_1.event.phase);
   EXPECT_EQ(mouse_wheel_0.event.momentum_phase,
             mouse_wheel_1.event.momentum_phase);
-  EXPECT_EQ(mouse_wheel_0.event.has_precise_scrolling_deltas,
-            mouse_wheel_1.event.has_precise_scrolling_deltas);
   Coalesce(mouse_wheel_0, &mouse_wheel_1);
 
   // Coalesced event has the position of the most recent event.
diff --git a/chromium/content/common/input/input_event_mojom_traits.cc b/chromium/content/common/input/input_event_mojom_traits.cc
index 2a14695627b..ff9f5aa6735 100644
--- a/chromium/content/common/input/input_event_mojom_traits.cc
+++ b/chromium/content/common/input/input_event_mojom_traits.cc
@@ -340,13 +340,13 @@ bool StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::Read(
         wheel_event->momentum_phase =
             static_cast<blink::WebMouseWheelEvent::Phase>(
                 wheel_data->momentum_phase);
-        wheel_event->scroll_by_page = wheel_data->scroll_by_page;
-        wheel_event->has_precise_scrolling_deltas =
-            wheel_data->has_precise_scrolling_deltas;
         wheel_event->dispatch_type = wheel_data->cancelable;
         wheel_event->event_action =
             static_cast<blink::WebMouseWheelEvent::EventAction>(
                 wheel_data->event_action);
+        wheel_event->delta_units =
+            static_cast<ui::input_types::ScrollGranularity>(
+                wheel_data->delta_units);
       }
     }
 
@@ -397,9 +397,9 @@ StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::pointer_data(
         wheel_event->wheel_ticks_y, wheel_event->acceleration_ratio_x,
         wheel_event->acceleration_ratio_y, wheel_event->resending_plugin_id,
         wheel_event->phase, wheel_event->momentum_phase,
-        wheel_event->scroll_by_page, wheel_event->has_precise_scrolling_deltas,
         wheel_event->dispatch_type,
-        static_cast<uint8_t>(wheel_event->event_action));
+        static_cast<uint8_t>(wheel_event->event_action),
+        static_cast<uint8_t>(wheel_event->delta_units));
   }
 
   return PointerDataFromPointerProperties(
diff --git a/chromium/content/common/input/input_handler.mojom b/chromium/content/common/input/input_handler.mojom
index caf15e51a3a..623f1b6c110 100644
--- a/chromium/content/common/input/input_handler.mojom
+++ b/chromium/content/common/input/input_handler.mojom
@@ -63,10 +63,9 @@ struct WheelData {
   int32 resending_plugin_id;
   uint8 phase;
   uint8 momentum_phase;
-  bool scroll_by_page;
-  bool has_precise_scrolling_deltas;
   Cancelability cancelable;
   uint8 event_action;
+  uint8 delta_units;
 };
 
 struct MouseData {
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
index ee9ec1e1933..018d4955460 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
@@ -18,8 +18,7 @@ SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams()
       speed_in_pixels_s(kDefaultSpeedInPixelsS),
       fling_velocity_x(0),
       fling_velocity_y(0),
-      precise_scrolling_deltas(false),
-      scroll_by_page(false) {}
+      granularity(ui::input_types::ScrollGranularity::kScrollByPixel) {}
 
 SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams(
     const SyntheticSmoothScrollGestureParams& other) = default;
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
index d590892d409..ccc6dce65a9 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
@@ -9,6 +9,7 @@
 
 #include "content/common/content_export.h"
 #include "content/common/input/synthetic_gesture_params.h"
+#include "ui/events/types/scroll_types.h"
 #include "ui/gfx/geometry/point_f.h"
 #include "ui/gfx/geometry/vector2d.h"
 
@@ -30,8 +31,7 @@ struct CONTENT_EXPORT SyntheticSmoothScrollGestureParams
   float speed_in_pixels_s;
   float fling_velocity_x;
   float fling_velocity_y;
-  bool precise_scrolling_deltas;
-  bool scroll_by_page;
+  ui::input_types::ScrollGranularity granularity;
 
   static const SyntheticSmoothScrollGestureParams* Cast(
       const SyntheticGestureParams* gesture_params);
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders.cc b/chromium/content/common/input/synthetic_web_input_event_builders.cc
index 425c65ea5c7..54f11ee619a 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders.cc
+++ b/chromium/content/common/input/synthetic_web_input_event_builders.cc
@@ -58,9 +58,8 @@ WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
     float dx,
     float dy,
     int modifiers,
-    bool precise,
-    bool scroll_by_page) {
-  return Build(x, y, 0, 0, dx, dy, modifiers, precise, scroll_by_page);
+    ui::input_types::ScrollGranularity delta_units) {
+  return Build(x, y, 0, 0, dx, dy, modifiers, delta_units);
 }
 
 WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
@@ -71,20 +70,19 @@ WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
     float dx,
     float dy,
     int modifiers,
-    bool precise,
-    bool scroll_by_page) {
+    ui::input_types::ScrollGranularity delta_units) {
   WebMouseWheelEvent result(WebInputEvent::kMouseWheel, modifiers,
                             ui::EventTimeForNow());
   result.SetPositionInScreen(global_x, global_y);
   result.SetPositionInWidget(x, y);
+  result.delta_units = delta_units;
   result.delta_x = dx;
   result.delta_y = dy;
   if (dx)
     result.wheel_ticks_x = dx > 0.0f ? 1.0f : -1.0f;
   if (dy)
     result.wheel_ticks_y = dy > 0.0f ? 1.0f : -1.0f;
-  result.has_precise_scrolling_deltas = precise;
-  result.scroll_by_page = scroll_by_page;
+
   result.event_action = WebMouseWheelEventTraits::GetEventAction(result);
   return result;
 }
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders.h b/chromium/content/common/input/synthetic_web_input_event_builders.h
index 9c29e98bdd0..608123f4266 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders.h
+++ b/chromium/content/common/input/synthetic_web_input_event_builders.h
@@ -12,6 +12,7 @@
 #include "third_party/blink/public/platform/web_keyboard_event.h"
 #include "third_party/blink/public/platform/web_mouse_wheel_event.h"
 #include "third_party/blink/public/platform/web_touch_event.h"
+#include "ui/events/types/scroll_types.h"
 
 // Provides sensible creation of default WebInputEvents for testing purposes.
 
@@ -33,22 +34,22 @@ class CONTENT_EXPORT SyntheticWebMouseWheelEventBuilder {
  public:
   static blink::WebMouseWheelEvent Build(
       blink::WebMouseWheelEvent::Phase phase);
-  static blink::WebMouseWheelEvent Build(float x,
-                                         float y,
-                                         float dx,
-                                         float dy,
-                                         int modifiers,
-                                         bool precise,
-                                         bool scroll_by_page = false);
-  static blink::WebMouseWheelEvent Build(float x,
-                                         float y,
-                                         float global_x,
-                                         float global_y,
-                                         float dx,
-                                         float dy,
-                                         int modifiers,
-                                         bool precise,
-                                         bool scroll_by_page = false);
+  static blink::WebMouseWheelEvent Build(
+      float x,
+      float y,
+      float dx,
+      float dy,
+      int modifiers,
+      ui::input_types::ScrollGranularity delta_units);
+  static blink::WebMouseWheelEvent Build(
+      float x,
+      float y,
+      float global_x,
+      float global_y,
+      float dx,
+      float dy,
+      int modifiers,
+      ui::input_types::ScrollGranularity delta_units);
 };
 
 class CONTENT_EXPORT SyntheticWebKeyboardEventBuilder {
diff --git a/chromium/content/common/input/web_mouse_wheel_event_traits.cc b/chromium/content/common/input/web_mouse_wheel_event_traits.cc
index 372ae755785..0ff0bde4f9a 100644
--- a/chromium/content/common/input/web_mouse_wheel_event_traits.cc
+++ b/chromium/content/common/input/web_mouse_wheel_event_traits.cc
@@ -16,7 +16,8 @@ blink::WebMouseWheelEvent::EventAction WebMouseWheelEventTraits::GetEventAction(
 #if defined(USE_AURA)
   // Scroll events generated from the mouse wheel when the control key is held
   // don't trigger scrolling. Instead, they may cause zooming.
-  if (!event.has_precise_scrolling_deltas &&
+  if (event.delta_units !=
+          ui::input_types::ScrollGranularity::kScrollByPrecisePixel &&
       (event.GetModifiers() & WebInputEvent::kControlKey)) {
     return blink::WebMouseWheelEvent::EventAction::kPageZoom;
   }
diff --git a/chromium/content/common/input_messages.h b/chromium/content/common/input_messages.h
index d27d9123927..316d8dd0b41 100644
--- a/chromium/content/common/input_messages.h
+++ b/chromium/content/common/input_messages.h
@@ -119,8 +119,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::SyntheticSmoothScrollGestureParams)
   IPC_STRUCT_TRAITS_MEMBER(speed_in_pixels_s)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_x)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_y)
-  IPC_STRUCT_TRAITS_MEMBER(precise_scrolling_deltas)
-  IPC_STRUCT_TRAITS_MEMBER(scroll_by_page)
+  IPC_STRUCT_TRAITS_MEMBER(granularity)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::SyntheticPinchGestureParams)
diff --git a/chromium/content/common/media/peer_connection_tracker.mojom b/chromium/content/common/media/peer_connection_tracker.mojom
index 12fe034fb5c..020e836504a 100644
--- a/chromium/content/common/media/peer_connection_tracker.mojom
+++ b/chromium/content/common/media/peer_connection_tracker.mojom
@@ -4,6 +4,21 @@
 
 module content.mojom;
 
+struct PeerConnectionInfo {
+  // ID of the peer connection. Unique only within the renderer process.
+  int32 lid;
+
+  // Serialized version of RTCConfiguration.
+  string rtc_configuration;
+
+  // Serialized version of blink::WebMediaConstraints.
+  string constraints;
+
+  // The URL of the blink::WebLocalFrame within which this peer connection
+  // lives. Used for debugging purposes (displayed by WebRTC-Internals).
+  string url;
+};
+
 // This interface allows forwarding PeerConnection events to WebRTCInternals in
 // the browser process.
 interface PeerConnectionTrackerHost {
@@ -11,6 +26,10 @@ interface PeerConnectionTrackerHost {
   // TODO(vm.arjun): Migrate rest of the messages,
   // https://bugs.chromium.org/p/chromium/issues/detail?id=792801
 
+  // Notifies WebRTCInternals about the addition of the peer connection
+  // whose data is specified in |info|.
+  AddPeerConnection(PeerConnectionInfo info);
+
   // Notifies WebRTCInternals about the removal of the peer connection
   // identified with local id |lid|.
   RemovePeerConnection(int32 lid);
diff --git a/chromium/content/common/media/peer_connection_tracker_messages.h b/chromium/content/common/media/peer_connection_tracker_messages.h
index 231725edaec..0c721cb54c6 100644
--- a/chromium/content/common/media/peer_connection_tracker_messages.h
+++ b/chromium/content/common/media/peer_connection_tracker_messages.h
@@ -14,21 +14,7 @@
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 #define IPC_MESSAGE_START PeerConnectionTrackerMsgStart
 
-IPC_STRUCT_BEGIN(PeerConnectionInfo)
-  // ID of the peer connection. Unique only within the renderer process.
-  IPC_STRUCT_MEMBER(int, lid)
-  // Serialized version of RTCConfiguration.
-  IPC_STRUCT_MEMBER(std::string, rtc_configuration)
-  // Serialized version of blink::WebMediaConstraints.
-  IPC_STRUCT_MEMBER(std::string, constraints)
-  // The URL of the blink::WebLocalFrame within which this peer connection
-  // lives. Used for debugging purposes (displayed by WebRTC-Internals).
-  IPC_STRUCT_MEMBER(std::string, url)
-IPC_STRUCT_END()
-
 // Messages sent from PeerConnectionTracker to PeerConnectionTrackerHost.
-IPC_MESSAGE_CONTROL1(PeerConnectionTrackerHost_AddPeerConnection,
-                     PeerConnectionInfo /* info */)
 IPC_MESSAGE_CONTROL2(PeerConnectionTrackerHost_AddStandardStats,
                      int /* lid */,
                      base::ListValue /* value */)
diff --git a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
index 5d43f4f7120..a6120daa6f0 100644
--- a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
+++ b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
@@ -17,7 +17,7 @@ import "services/audio/public/mojom/audio_processing.mojom";
 // by the lifetime of the client.
 interface RendererAudioInputStreamFactory {
   CreateStream(
-      RendererAudioInputStreamFactoryClient client,
+      pending_remote<RendererAudioInputStreamFactoryClient> client,
       mojo_base.mojom.UnguessableToken session_id,
       media.mojom.AudioParameters params,
       bool automatic_gain_control,
diff --git a/chromium/content/common/media/renderer_audio_output_stream_factory.mojom b/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
index c26c8cce401..c151fec4513 100644
--- a/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
+++ b/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
@@ -10,18 +10,18 @@ import "media/mojo/mojom/media_types.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 
 // This interface is used to create output streams. The client supplies a
-// request for a stream provider, and then supplies the desired audio
+// mojo receiver for a stream provider, and then supplies the desired audio
 // parameters to that to create the stream.
 interface RendererAudioOutputStreamFactory {
-  // Used to request a device. The AudioOutputStreamProviderRequest will be
-  // bound to an AudioOutputStreamProvider implementation or closed
-  // (in case of an error).
-  // If |session_id| is provided, it will be taken into account together with
-  // |device_id| in the selection of the audio output device to request.
-  // If not provided, only |device_id| will be taken into account in the
-  // selection of the audio output device.
+  // Used to request a device. If successful, |stream_provider_receiver| will be
+  // bound to an AudioOutputStreamProvider implementation, otherwise it will
+  // simply be discarded (won't be bound). If |session_id| is provided, it will
+  // be taken into account together with |device_id| in the selection of the
+  // audio output device to request. If not provided, only |device_id| will be
+  // taken into account in the selection of the audio output device.
   RequestDeviceAuthorization(
-      media.mojom.AudioOutputStreamProvider& stream_provider_request,
+      pending_receiver<media.mojom.AudioOutputStreamProvider>
+          stream_provider_receiver,
       mojo_base.mojom.UnguessableToken? session_id,
       string device_id) =>
       (media.mojom.OutputDeviceStatus state,
diff --git a/chromium/content/common/mime_sniffing_throttle.cc b/chromium/content/common/mime_sniffing_throttle.cc
deleted file mode 100644
index 62d72feefc7..00000000000
--- a/chromium/content/common/mime_sniffing_throttle.cc
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mime_sniffing_throttle.h"
-
-#include "content/common/mime_sniffing_url_loader.h"
-#include "net/base/mime_sniffer.h"
-
-namespace content {
-
-MimeSniffingThrottle::MimeSniffingThrottle(
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : task_runner_(std::move(task_runner)) {}
-
-MimeSniffingThrottle::~MimeSniffingThrottle() = default;
-
-void MimeSniffingThrottle::WillProcessResponse(
-    const GURL& response_url,
-    network::ResourceResponseHead* response_head,
-    bool* defer) {
-  // No need to do mime sniffing again.
-  if (response_head->did_mime_sniff)
-    return;
-
-  bool blocked_sniffing_mime = false;
-  std::string content_type_options;
-  if (response_head->headers &&
-      response_head->headers->GetNormalizedHeader("x-content-type-options",
-                                                  &content_type_options)) {
-    blocked_sniffing_mime =
-        base::LowerCaseEqualsASCII(content_type_options, "nosniff");
-  }
-
-  if (!blocked_sniffing_mime &&
-      net::ShouldSniffMimeType(response_url, response_head->mime_type)) {
-    // Pause the response until the mime type becomes ready.
-    *defer = true;
-
-    network::mojom::URLLoaderPtr new_loader;
-    network::mojom::URLLoaderClientRequest new_loader_request;
-    network::mojom::URLLoaderPtr source_loader;
-    network::mojom::URLLoaderClientRequest source_client_request;
-    MimeSniffingURLLoader* mime_sniffing_loader;
-    std::tie(new_loader, new_loader_request, mime_sniffing_loader) =
-        MimeSniffingURLLoader::CreateLoader(weak_factory_.GetWeakPtr(),
-                                            response_url, *response_head,
-                                            task_runner_);
-    delegate_->InterceptResponse(std::move(new_loader),
-                                 std::move(new_loader_request), &source_loader,
-                                 &source_client_request);
-    mime_sniffing_loader->Start(std::move(source_loader),
-                                std::move(source_client_request));
-  }
-}
-
-void MimeSniffingThrottle::ResumeWithNewResponseHead(
-    const network::ResourceResponseHead& new_response_head) {
-  delegate_->UpdateDeferredResponseHead(new_response_head);
-  delegate_->Resume();
-}
-
-}  // namespace content
diff --git a/chromium/content/common/mime_sniffing_throttle.h b/chromium/content/common/mime_sniffing_throttle.h
deleted file mode 100644
index 135b3d14d36..00000000000
--- a/chromium/content/common/mime_sniffing_throttle.h
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MIME_SNIFFING_THROTTLE_H_
-#define CONTENT_COMMON_MIME_SNIFFING_THROTTLE_H_
-
-#include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/common/loader/url_loader_throttle.h"
-
-namespace content {
-
-// Throttle for mime type sniffing. This may intercept the request and
-// modify the response's mime type in the response head.
-class CONTENT_EXPORT MimeSniffingThrottle : public blink::URLLoaderThrottle {
- public:
-  // |task_runner| is used to bind the right task runner for handling incoming
-  // IPC in MimeSniffingLoader. |task_runner| is supposed to be bound to the
-  // current sequence.
-  explicit MimeSniffingThrottle(
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-  ~MimeSniffingThrottle() override;
-
-  // Implements blink::URLLoaderThrottle.
-  void WillProcessResponse(const GURL& response_url,
-                           network::ResourceResponseHead* response_head,
-                           bool* defer) override;
-
-  // Called from MimeSniffingURLLoader once mime type is ready.
-  void ResumeWithNewResponseHead(
-      const network::ResourceResponseHead& new_response_head);
-
- private:
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-  base::WeakPtrFactory<MimeSniffingThrottle> weak_factory_{this};
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_MIME_SNIFFING_THROTTLE_H_
diff --git a/chromium/content/common/mime_sniffing_throttle_unittest.cc b/chromium/content/common/mime_sniffing_throttle_unittest.cc
deleted file mode 100644
index d216febf8b1..00000000000
--- a/chromium/content/common/mime_sniffing_throttle_unittest.cc
+++ /dev/null
@@ -1,508 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mime_sniffing_throttle.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/run_loop.h"
-#include "base/test/task_environment.h"
-#include "content/common/mime_sniffing_url_loader.h"
-#include "mojo/public/cpp/system/data_pipe_utils.h"
-#include "services/network/test/test_url_loader_client.h"
-#include "services/network/test/test_url_loader_factory.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/common/loader/url_loader_throttle.h"
-#include "url/gurl.h"
-
-namespace content {
-
-namespace {
-
-class MojoDataPipeSender {
- public:
-  MojoDataPipeSender(mojo::ScopedDataPipeProducerHandle handle)
-      : handle_(std::move(handle)),
-        watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::AUTOMATIC) {}
-
-  void Start(std::string data, base::OnceClosure done_callback) {
-    data_ = std::move(data);
-    done_callback_ = std::move(done_callback);
-    watcher_.Watch(handle_.get(),
-                   MOJO_HANDLE_SIGNAL_WRITABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-                   base::BindRepeating(&MojoDataPipeSender::OnWritable,
-                                       base::Unretained(this)));
-  }
-
-  void OnWritable(MojoResult) {
-    uint32_t sending_bytes = data_.size() - sent_bytes_;
-    MojoResult result = handle_->WriteData(
-        data_.c_str() + sent_bytes_, &sending_bytes, MOJO_WRITE_DATA_FLAG_NONE);
-    switch (result) {
-      case MOJO_RESULT_OK:
-        break;
-      case MOJO_RESULT_FAILED_PRECONDITION:
-        // Finished unexpectedly.
-        std::move(done_callback_).Run();
-        return;
-      case MOJO_RESULT_SHOULD_WAIT:
-        // Just wait until OnWritable() is called by the watcher.
-        return;
-      default:
-        NOTREACHED();
-        return;
-    }
-    sent_bytes_ += sending_bytes;
-    if (data_.size() == sent_bytes_)
-      std::move(done_callback_).Run();
-  }
-
-  mojo::ScopedDataPipeProducerHandle ReleaseHandle() {
-    return std::move(handle_);
-  }
-
-  bool has_succeeded() const { return data_.size() == sent_bytes_; }
-
- private:
-  mojo::ScopedDataPipeProducerHandle handle_;
-  mojo::SimpleWatcher watcher_;
-  base::OnceClosure done_callback_;
-  std::string data_;
-  uint32_t sent_bytes_ = 0;
-};
-
-class MockDelegate : public blink::URLLoaderThrottle::Delegate {
- public:
-  // Implements blink::URLLoaderThrottle::Delegate.
-  void CancelWithError(int error_code,
-                       base::StringPiece custom_reason) override {
-    NOTIMPLEMENTED();
-  }
-  void Resume() override {
-    is_resumed_ = true;
-    // Resume from OnReceiveResponse() with a customized response header.
-    destination_loader_client()->OnReceiveResponse(
-        updated_response_head().value());
-  }
-
-  void SetPriority(net::RequestPriority priority) override { NOTIMPLEMENTED(); }
-  void UpdateDeferredResponseHead(
-      const network::ResourceResponseHead& new_response_head) override {
-    updated_response_head_ = new_response_head;
-  }
-  void PauseReadingBodyFromNet() override { NOTIMPLEMENTED(); }
-  void ResumeReadingBodyFromNet() override { NOTIMPLEMENTED(); }
-  void InterceptResponse(
-      network::mojom::URLLoaderPtr new_loader,
-      network::mojom::URLLoaderClientRequest new_client_request,
-      network::mojom::URLLoaderPtr* original_loader,
-      network::mojom::URLLoaderClientRequest* original_client_request)
-      override {
-    is_intercepted_ = true;
-
-    destination_loader_ptr_ = std::move(new_loader);
-    ASSERT_TRUE(mojo::FuseInterface(
-        std::move(new_client_request),
-        destination_loader_client_.CreateInterfacePtr().PassInterface()));
-    source_loader_request_ = mojo::MakeRequest(original_loader);
-    *original_client_request = mojo::MakeRequest(&source_loader_client_ptr_);
-  }
-
-  void LoadResponseBody(const std::string& body) {
-    if (!source_body_handle_.is_valid()) {
-      // Send OnStartLoadingResponseBody() if it's the first call.
-      mojo::ScopedDataPipeConsumerHandle consumer;
-      EXPECT_EQ(MOJO_RESULT_OK,
-                mojo::CreateDataPipe(nullptr, &source_body_handle_, &consumer));
-      source_loader_client()->OnStartLoadingResponseBody(std::move(consumer));
-    }
-
-    MojoDataPipeSender sender(std::move(source_body_handle_));
-    base::RunLoop loop;
-    sender.Start(body, loop.QuitClosure());
-    loop.Run();
-
-    EXPECT_TRUE(sender.has_succeeded());
-    source_body_handle_ = sender.ReleaseHandle();
-  }
-
-  void CompleteResponse() {
-    source_loader_client()->OnComplete(network::URLLoaderCompletionStatus());
-    source_body_handle_.reset();
-  }
-
-  uint32_t ReadResponseBody(uint32_t size) {
-    std::vector<uint8_t> buffer(size);
-    MojoResult result = destination_loader_client_.response_body().ReadData(
-        buffer.data(), &size, MOJO_READ_DATA_FLAG_NONE);
-    switch (result) {
-      case MOJO_RESULT_OK:
-        return size;
-      case MOJO_RESULT_FAILED_PRECONDITION:
-        return 0;
-      case MOJO_RESULT_SHOULD_WAIT:
-        return 0;
-      default:
-        NOTREACHED();
-    }
-    return 0;
-  }
-
-  bool is_intercepted() const { return is_intercepted_; }
-  bool is_resumed() const { return is_resumed_; }
-
-  const base::Optional<network::ResourceResponseHead>& updated_response_head()
-      const {
-    return updated_response_head_;
-  }
-
-  network::TestURLLoaderClient* destination_loader_client() {
-    return &destination_loader_client_;
-  }
-
-  network::mojom::URLLoaderClient* source_loader_client() {
-    return source_loader_client_ptr_.get();
-  }
-
- private:
-  bool is_intercepted_ = false;
-  bool is_resumed_ = false;
-  base::Optional<network::ResourceResponseHead> updated_response_head_;
-
-  // A pair of a loader and a loader client for destination of the response.
-  network::mojom::URLLoaderPtr destination_loader_ptr_;
-  network::TestURLLoaderClient destination_loader_client_;
-
-  // A pair of a loader and a loader client for source of the response.
-  network::mojom::URLLoaderClientPtr source_loader_client_ptr_;
-  network::mojom::URLLoaderRequest source_loader_request_;
-
-  mojo::ScopedDataPipeProducerHandle source_body_handle_;
-};
-
-}  // namespace
-
-class MimeSniffingThrottleTest : public testing::Test {
- protected:
-  // Be the first member so it is destroyed last.
-  base::test::TaskEnvironment task_environment_;
-};
-
-TEST_F(MimeSniffingThrottleTest, NoMimeTypeWithSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, SniffableMimeTypeWithSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/plain";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NotSniffableMimeTypeWithSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/javascript";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NoMimeTypeWithNotSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("wss://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, SniffableMimeTypeWithNotSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/plain";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("wss://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NotSniffableMimeTypeWithNotSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/javascript";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("wss://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, SniffableButAlreadySniffed) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/plain";
-  response_head.did_mime_sniff = true;
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NoBody) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Call OnComplete() without sending body.
-  delegate->source_loader_client()->OnComplete(
-      network::URLLoaderCompletionStatus(net::ERR_FAILED));
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated to the default mime type ("text/plain").
-  EXPECT_TRUE(delegate->destination_loader_client()->has_received_response());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, EmptyBody) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  mojo::DataPipe pipe;
-  delegate->source_loader_client()->OnStartLoadingResponseBody(
-      std::move(pipe.consumer_handle));
-  pipe.producer_handle.reset();  // The pipe is empty.
-
-  delegate->source_loader_client()->OnComplete(
-      network::URLLoaderCompletionStatus());
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated to the default mime type ("text/plain").
-  EXPECT_TRUE(delegate->destination_loader_client()->has_received_response());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_PlainText) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body and complete the response.
-  delegate->LoadResponseBody("This is a text.");
-  delegate->CompleteResponse();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_Docx) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com/hogehoge.docx");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body and complete the response.
-  delegate->LoadResponseBody("\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1");
-  delegate->CompleteResponse();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("application/msword",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_PNG) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com/hogehoge.docx");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body and complete the response.
-  delegate->LoadResponseBody("\x89PNG\x0D\x0A\x1A\x0A");
-  delegate->CompleteResponse();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("image/png",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_LongPlainText) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // 64KiB is coming from the default value used in
-  // mojo::core::Core::CreateDataPipe().
-  const uint32_t kDefaultDataPipeBufferSize = 64 * 1024;
-  std::string long_body(kDefaultDataPipeBufferSize * 2, 'x');
-
-  // Send the data to the MimeSniffingURLLoader.
-  // |delegate|'s MojoDataPipeSender sends the first
-  // |kDefaultDataPipeBufferSize| bytes to MimeSniffingURLLoader and
-  // MimeSniffingURLLoader will read the first |kDefaultDataPipeBufferSize|
-  // bytes of the body, so the MojoDataPipeSender can push the rest of
-  // |kDefaultDataPipeBufferSize| of the body soon and finishes sending the
-  // body. After this, MimeSniffingURLLoader is waiting to push the body to the
-  // destination data pipe since the pipe should be full until it's read.
-  delegate->LoadResponseBody(long_body);
-  task_environment_.RunUntilIdle();
-
-  // Send OnComplete() to the MimeSniffingURLLoader.
-  delegate->CompleteResponse();
-  task_environment_.RunUntilIdle();
-  // MimeSniffingURLLoader should not send OnComplete() to the destination
-  // client until it finished writing all the data.
-  EXPECT_FALSE(
-      delegate->destination_loader_client()->has_received_completion());
-
-  // Read the half of the body. This unblocks MimeSniffingURLLoader to push the
-  // rest of the body to the data pipe.
-  uint32_t read_bytes = delegate->ReadResponseBody(long_body.size() / 2);
-  task_environment_.RunUntilIdle();
-
-  // Read the rest of the body.
-  read_bytes += delegate->ReadResponseBody(long_body.size() / 2);
-  task_environment_.RunUntilIdle();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // Check if all data has been read.
-  EXPECT_EQ(long_body.size(), read_bytes);
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Abort_NoBodyPipe) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body
-  std::string body = "This should be long enough to complete sniffing.";
-  body.resize(1024, 'a');
-  delegate->LoadResponseBody(body);
-  task_environment_.RunUntilIdle();
-
-  // Release a pipe for the body on the receiver side.
-  delegate->destination_loader_client()->response_body_release();
-  task_environment_.RunUntilIdle();
-
-  // Send the body after the pipe is closed. The the loader aborts.
-  delegate->LoadResponseBody("This is a text.");
-
-  // Calling OnComplete should not crash.
-  delegate->CompleteResponse();
-  task_environment_.RunUntilIdle();
-}
-
-}  // namespace content
diff --git a/chromium/content/common/mime_sniffing_url_loader.cc b/chromium/content/common/mime_sniffing_url_loader.cc
deleted file mode 100644
index 7d9c71633f7..00000000000
--- a/chromium/content/common/mime_sniffing_url_loader.cc
+++ /dev/null
@@ -1,368 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mime_sniffing_url_loader.h"
-
-#include "base/bind.h"
-#include "content/common/mime_sniffing_throttle.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
-#include "net/base/mime_sniffer.h"
-
-namespace content {
-
-// static
-const char MimeSniffingURLLoader::kDefaultMimeType[] = "text/plain";
-
-// static
-std::tuple<network::mojom::URLLoaderPtr,
-           network::mojom::URLLoaderClientRequest,
-           MimeSniffingURLLoader*>
-MimeSniffingURLLoader::CreateLoader(
-    base::WeakPtr<MimeSniffingThrottle> throttle,
-    const GURL& response_url,
-    const network::ResourceResponseHead& response_head,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  network::mojom::URLLoaderPtr url_loader;
-  network::mojom::URLLoaderClientPtr url_loader_client;
-  network::mojom::URLLoaderClientRequest url_loader_client_request =
-      mojo::MakeRequest(&url_loader_client);
-  auto loader = base::WrapUnique(new MimeSniffingURLLoader(
-      std::move(throttle), response_url, response_head,
-      std::move(url_loader_client), std::move(task_runner)));
-  MimeSniffingURLLoader* loader_rawptr = loader.get();
-  mojo::MakeStrongBinding(std::move(loader), mojo::MakeRequest(&url_loader));
-  return std::make_tuple(std::move(url_loader),
-                         std::move(url_loader_client_request), loader_rawptr);
-}
-
-MimeSniffingURLLoader::MimeSniffingURLLoader(
-    base::WeakPtr<MimeSniffingThrottle> throttle,
-    const GURL& response_url,
-    const network::ResourceResponseHead& response_head,
-    network::mojom::URLLoaderClientPtr destination_url_loader_client,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : throttle_(throttle),
-      source_url_client_binding_(this),
-      destination_url_loader_client_(std::move(destination_url_loader_client)),
-      response_url_(response_url),
-      response_head_(response_head),
-      task_runner_(task_runner),
-      body_consumer_watcher_(FROM_HERE,
-                             mojo::SimpleWatcher::ArmingPolicy::MANUAL,
-                             task_runner),
-      body_producer_watcher_(FROM_HERE,
-                             mojo::SimpleWatcher::ArmingPolicy::MANUAL,
-                             std::move(task_runner)) {}
-
-MimeSniffingURLLoader::~MimeSniffingURLLoader() = default;
-
-void MimeSniffingURLLoader::Start(
-    network::mojom::URLLoaderPtr source_url_loader,
-    network::mojom::URLLoaderClientRequest source_url_loader_client_request) {
-  source_url_loader_ = std::move(source_url_loader);
-  source_url_client_binding_.Bind(std::move(source_url_loader_client_request),
-                                  task_runner_);
-}
-
-void MimeSniffingURLLoader::OnReceiveResponse(
-    network::mojom::URLResponseHeadPtr response_head) {
-  // OnReceiveResponse() shouldn't be called because MimeSniffingURLLoader is
-  // created by MimeSniffingThrottle::WillProcessResponse(), which is equivalent
-  // to OnReceiveResponse().
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::OnReceiveRedirect(
-    const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr response_head) {
-  // OnReceiveRedirect() shouldn't be called because MimeSniffingURLLoader is
-  // created by MimeSniffingThrottle::WillProcessResponse(), which is equivalent
-  // to OnReceiveResponse().
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::OnUploadProgress(
-    int64_t current_position,
-    int64_t total_size,
-    OnUploadProgressCallback ack_callback) {
-  destination_url_loader_client_->OnUploadProgress(current_position, total_size,
-                                                   std::move(ack_callback));
-}
-
-void MimeSniffingURLLoader::OnReceiveCachedMetadata(mojo_base::BigBuffer data) {
-  destination_url_loader_client_->OnReceiveCachedMetadata(std::move(data));
-}
-
-void MimeSniffingURLLoader::OnTransferSizeUpdated(int32_t transfer_size_diff) {
-  destination_url_loader_client_->OnTransferSizeUpdated(transfer_size_diff);
-}
-
-void MimeSniffingURLLoader::OnStartLoadingResponseBody(
-    mojo::ScopedDataPipeConsumerHandle body) {
-  state_ = State::kSniffing;
-  body_consumer_handle_ = std::move(body);
-  body_consumer_watcher_.Watch(
-      body_consumer_handle_.get(),
-      MOJO_HANDLE_SIGNAL_READABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-      base::BindRepeating(&MimeSniffingURLLoader::OnBodyReadable,
-                          base::Unretained(this)));
-  body_consumer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::OnComplete(
-    const network::URLLoaderCompletionStatus& status) {
-  DCHECK(!complete_status_.has_value());
-  switch (state_) {
-    case State::kWaitForBody:
-      // An error occured before receiving any data.
-      DCHECK_NE(net::OK, status.error_code);
-      state_ = State::kCompleted;
-      response_head_.mime_type = kDefaultMimeType;
-      if (!throttle_) {
-        Abort();
-        return;
-      }
-      throttle_->ResumeWithNewResponseHead(response_head_);
-      destination_url_loader_client_->OnComplete(status);
-      return;
-    case State::kSniffing:
-    case State::kSending:
-      // Defer calling OnComplete() until mime sniffing has finished and all
-      // data is sent.
-      complete_status_ = status;
-      return;
-    case State::kCompleted:
-      destination_url_loader_client_->OnComplete(status);
-      return;
-    case State::kAborted:
-      NOTREACHED();
-      return;
-  }
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::FollowRedirect(
-    const std::vector<std::string>& removed_headers,
-    const net::HttpRequestHeaders& modified_headers,
-    const base::Optional<GURL>& new_url) {
-  // MimeSniffingURLLoader starts handling the request after
-  // OnReceivedResponse(). A redirect response is not expected.
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::SetPriority(net::RequestPriority priority,
-                                        int32_t intra_priority_value) {
-  if (state_ == State::kAborted)
-    return;
-  source_url_loader_->SetPriority(priority, intra_priority_value);
-}
-
-void MimeSniffingURLLoader::PauseReadingBodyFromNet() {
-  if (state_ == State::kAborted)
-    return;
-  source_url_loader_->PauseReadingBodyFromNet();
-}
-
-void MimeSniffingURLLoader::ResumeReadingBodyFromNet() {
-  if (state_ == State::kAborted)
-    return;
-  source_url_loader_->ResumeReadingBodyFromNet();
-}
-
-void MimeSniffingURLLoader::OnBodyReadable(MojoResult) {
-  if (state_ == State::kSending) {
-    // The pipe becoming readable when kSending means all buffered body has
-    // already been sent.
-    ForwardBodyToClient();
-    return;
-  }
-  DCHECK_EQ(State::kSniffing, state_);
-
-  size_t start_size = buffered_body_.size();
-  uint32_t read_bytes = net::kMaxBytesToSniff;
-  buffered_body_.resize(start_size + read_bytes);
-  MojoResult result =
-      body_consumer_handle_->ReadData(buffered_body_.data() + start_size,
-                                      &read_bytes, MOJO_READ_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // Finished the body before mime type is completely decided.
-      buffered_body_.resize(start_size);
-      CompleteSniffing();
-      return;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_consumer_watcher_.ArmOrNotify();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-
-  DCHECK_EQ(MOJO_RESULT_OK, result);
-  buffered_body_.resize(start_size + read_bytes);
-  std::string new_type;
-  bool made_final_decision =
-      net::SniffMimeType(buffered_body_.data(), buffered_body_.size(),
-                         response_url_, response_head_.mime_type,
-                         net::ForceSniffFileUrlsForHtml::kDisabled, &new_type);
-  response_head_.mime_type = new_type;
-  response_head_.did_mime_sniff = true;
-  if (made_final_decision) {
-    CompleteSniffing();
-    return;
-  }
-  body_consumer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::OnBodyWritable(MojoResult) {
-  DCHECK_EQ(State::kSending, state_);
-  if (bytes_remaining_in_buffer_ > 0) {
-    SendReceivedBodyToClient();
-  } else {
-    ForwardBodyToClient();
-  }
-}
-
-void MimeSniffingURLLoader::CompleteSniffing() {
-  DCHECK_EQ(State::kSniffing, state_);
-  if (buffered_body_.empty()) {
-    // The URLLoader ended before sending any data. There is not enough
-    // information to determine the MIME type.
-    response_head_.mime_type = kDefaultMimeType;
-  }
-
-  state_ = State::kSending;
-  bytes_remaining_in_buffer_ = buffered_body_.size();
-  if (!throttle_) {
-    Abort();
-    return;
-  }
-  throttle_->ResumeWithNewResponseHead(response_head_);
-  mojo::ScopedDataPipeConsumerHandle body_to_send;
-  MojoResult result =
-      mojo::CreateDataPipe(nullptr, &body_producer_handle_, &body_to_send);
-  if (result != MOJO_RESULT_OK) {
-    Abort();
-    return;
-  }
-  // Set up the watcher for the producer handle.
-  body_producer_watcher_.Watch(
-      body_producer_handle_.get(),
-      MOJO_HANDLE_SIGNAL_WRITABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-      base::BindRepeating(&MimeSniffingURLLoader::OnBodyWritable,
-                          base::Unretained(this)));
-
-  // Send deferred message.
-  destination_url_loader_client_->OnStartLoadingResponseBody(
-      std::move(body_to_send));
-
-  if (bytes_remaining_in_buffer_) {
-    SendReceivedBodyToClient();
-    return;
-  }
-
-  CompleteSending();
-}
-
-void MimeSniffingURLLoader::CompleteSending() {
-  DCHECK_EQ(State::kSending, state_);
-  state_ = State::kCompleted;
-  // Call client's OnComplete() if |this|'s OnComplete() has already been
-  // called.
-  if (complete_status_.has_value())
-    destination_url_loader_client_->OnComplete(complete_status_.value());
-
-  body_consumer_watcher_.Cancel();
-  body_producer_watcher_.Cancel();
-  body_consumer_handle_.reset();
-  body_producer_handle_.reset();
-}
-
-void MimeSniffingURLLoader::SendReceivedBodyToClient() {
-  DCHECK_EQ(State::kSending, state_);
-  // Send the buffered data first.
-  DCHECK_GT(bytes_remaining_in_buffer_, 0u);
-  size_t start_position = buffered_body_.size() - bytes_remaining_in_buffer_;
-  uint32_t bytes_sent = bytes_remaining_in_buffer_;
-  MojoResult result =
-      body_producer_handle_->WriteData(buffered_body_.data() + start_position,
-                                       &bytes_sent, MOJO_WRITE_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // The pipe is closed unexpectedly. |this| should be deleted once
-      // URLLoaderPtr on the destination is released.
-      Abort();
-      return;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_producer_watcher_.ArmOrNotify();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-  bytes_remaining_in_buffer_ -= bytes_sent;
-  body_producer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::ForwardBodyToClient() {
-  DCHECK_EQ(0u, bytes_remaining_in_buffer_);
-  // Send the body from the consumer to the producer.
-  const void* buffer;
-  uint32_t buffer_size = 0;
-  MojoResult result = body_consumer_handle_->BeginReadData(
-      &buffer, &buffer_size, MOJO_BEGIN_READ_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_consumer_watcher_.ArmOrNotify();
-      return;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // All data has been sent.
-      CompleteSending();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-
-  result = body_producer_handle_->WriteData(buffer, &buffer_size,
-                                            MOJO_WRITE_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // The pipe is closed unexpectedly. |this| should be deleted once
-      // URLLoaderPtr on the destination is released.
-      Abort();
-      return;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_consumer_handle_->EndReadData(0);
-      body_producer_watcher_.ArmOrNotify();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-
-  body_consumer_handle_->EndReadData(buffer_size);
-  body_consumer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::Abort() {
-  state_ = State::kAborted;
-  body_consumer_watcher_.Cancel();
-  body_producer_watcher_.Cancel();
-  source_url_loader_.reset();
-  source_url_client_binding_.Close();
-  destination_url_loader_client_.reset();
-  // |this| should be removed since the owner will destroy |this| or the owner
-  // has already been destroyed by some reason.
-}
-
-}  // namespace content
diff --git a/chromium/content/common/mime_sniffing_url_loader.h b/chromium/content/common/mime_sniffing_url_loader.h
deleted file mode 100644
index 5480191583a..00000000000
--- a/chromium/content/common/mime_sniffing_url_loader.h
+++ /dev/null
@@ -1,151 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MIME_SNIFFING_URL_LOADER_H_
-#define CONTENT_COMMON_MIME_SNIFFING_URL_LOADER_H_
-
-#include <tuple>
-
-#include "base/callback.h"
-#include "base/memory/ref_counted.h"
-#include "base/memory/weak_ptr.h"
-#include "base/strings/string_piece.h"
-#include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/system/data_pipe.h"
-#include "mojo/public/cpp/system/simple_watcher.h"
-#include "services/network/public/cpp/resource_response.h"
-#include "services/network/public/cpp/shared_url_loader_factory.h"
-#include "services/network/public/mojom/url_loader.mojom.h"
-#include "services/network/public/mojom/url_loader_factory.mojom.h"
-#include "third_party/blink/public/common/loader/url_loader_throttle.h"
-
-namespace content {
-
-class MimeSniffingThrottle;
-
-// Reads the response body and determines its mime type. This url loader buffers
-// the response body until the mime type is decided. MimeSniffingURLLoader
-// is expected to be created just after receiving OnReceiveResponse(), so this
-// handles only OnStartLoadingResponseBody() and OnComplete() as a
-// network::mojom::URLLoaderClient.
-//
-// This loader has five states:
-// kWaitForBody: The initial state until the body is received (=
-//               OnStartLoadingResponseBody() is called) or the response is
-//               finished (= OnComplete() is called). When body is provided, the
-//               state is changed to kSniffing. Otherwise the state goes to
-//               kCompleted.
-// kSniffing: Receives the body from the source loader and estimate the mime
-//            type. The received body is kept in this loader until the mime type
-//            is decided. When the mime type is decided or all body has been
-//            received, this loader will dispatch queued messages like
-//            OnStartLoadingResponseBody() to the destination
-//            loader client, and then the state is changed to kSending.
-// kSending: Receives the body and sends it to the destination loader client.
-//           The state changes to kCompleted after all data is sent.
-// kCompleted: All data has been sent to the destination loader.
-// kAborted: Unexpected behavior happens. Watchers, pipes and the binding from
-//           the source loader to |this| are stopped. All incoming messages from
-//           the destination (through network::mojom::URLLoader) are ignored in
-//           this state.
-class CONTENT_EXPORT MimeSniffingURLLoader
-    : public network::mojom::URLLoaderClient,
-      public network::mojom::URLLoader {
- public:
-  ~MimeSniffingURLLoader() override;
-
-  // Start waiting for the body.
-  void Start(
-      network::mojom::URLLoaderPtr source_url_loader,
-      network::mojom::URLLoaderClientRequest source_url_loader_client_request);
-
-  // network::mojom::URLLoaderPtr controls the lifetime of the loader.
-  static std::tuple<network::mojom::URLLoaderPtr,
-                    network::mojom::URLLoaderClientRequest,
-                    MimeSniffingURLLoader*>
-  CreateLoader(base::WeakPtr<MimeSniffingThrottle> throttle,
-               const GURL& response_url,
-               const network::ResourceResponseHead& response_head,
-               scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-
- private:
-  MimeSniffingURLLoader(
-      base::WeakPtr<MimeSniffingThrottle> throttle,
-      const GURL& response_url,
-      const network::ResourceResponseHead& response_head,
-      network::mojom::URLLoaderClientPtr destination_url_loader_client,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-
-  // network::mojom::URLLoaderClient implementation (called from the source of
-  // the response):
-  void OnReceiveResponse(
-      network::mojom::URLResponseHeadPtr response_head) override;
-  void OnReceiveRedirect(
-      const net::RedirectInfo& redirect_info,
-      network::mojom::URLResponseHeadPtr response_head) override;
-  void OnUploadProgress(int64_t current_position,
-                        int64_t total_size,
-                        OnUploadProgressCallback ack_callback) override;
-  void OnReceiveCachedMetadata(mojo_base::BigBuffer data) override;
-  void OnTransferSizeUpdated(int32_t transfer_size_diff) override;
-  void OnStartLoadingResponseBody(
-      mojo::ScopedDataPipeConsumerHandle body) override;
-  void OnComplete(const network::URLLoaderCompletionStatus& status) override;
-
-  // network::mojom::URLLoader implementation (called from the destination of
-  // the response):
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
-  void SetPriority(net::RequestPriority priority,
-                   int32_t intra_priority_value) override;
-  void PauseReadingBodyFromNet() override;
-  void ResumeReadingBodyFromNet() override;
-
-  void OnBodyReadable(MojoResult);
-  void OnBodyWritable(MojoResult);
-  void CompleteSniffing();
-  void CompleteSending();
-  void SendReceivedBodyToClient();
-  void ForwardBodyToClient();
-
-  void Abort();
-
-  static const char kDefaultMimeType[];
-
-  base::WeakPtr<MimeSniffingThrottle> throttle_;
-
-  mojo::Binding<network::mojom::URLLoaderClient> source_url_client_binding_;
-  network::mojom::URLLoaderPtr source_url_loader_;
-  network::mojom::URLLoaderClientPtr destination_url_loader_client_;
-
-  GURL response_url_;
-
-  // Capture the response head to defer to send it to the destination until the
-  // mime type is decided.
-  network::ResourceResponseHead response_head_;
-
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-
-  enum class State { kWaitForBody, kSniffing, kSending, kCompleted, kAborted };
-  State state_ = State::kWaitForBody;
-
-  // Set if OnComplete() is called during sniffing.
-  base::Optional<network::URLLoaderCompletionStatus> complete_status_;
-
-  std::vector<char> buffered_body_;
-  size_t bytes_remaining_in_buffer_;
-
-  mojo::ScopedDataPipeConsumerHandle body_consumer_handle_;
-  mojo::ScopedDataPipeProducerHandle body_producer_handle_;
-  mojo::SimpleWatcher body_consumer_watcher_;
-  mojo::SimpleWatcher body_producer_watcher_;
-
-  DISALLOW_COPY_AND_ASSIGN(MimeSniffingURLLoader);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_MIME_SNIFFING_URL_LOADER_H_
diff --git a/chromium/content/common/navigation_params.mojom b/chromium/content/common/navigation_params.mojom
index c0bbef7c50d..e2761bd24c2 100644
--- a/chromium/content/common/navigation_params.mojom
+++ b/chromium/content/common/navigation_params.mojom
@@ -344,4 +344,8 @@ struct CommitNavigationParams {
   // https://wicg.github.io/cors-rfc1918/#address-space
   network.mojom.IPAddressSpace ip_address_space =
       network.mojom.IPAddressSpace.kUnknown;
+
+  // The base URL which will be set for the document to support relative path
+  // subresource loading in unsigned bundled exchanges file.
+  url.mojom.Url base_url_override_for_bundled_exchanges;
 };
diff --git a/chromium/content/common/page_messages.h b/chromium/content/common/page_messages.h
index 36718e326d5..21fd5d1e05b 100644
--- a/chromium/content/common/page_messages.h
+++ b/chromium/content/common/page_messages.h
@@ -36,10 +36,6 @@ IPC_MESSAGE_ROUTED2(PageMsg_SetHistoryOffsetAndLength,
 
 IPC_MESSAGE_ROUTED1(PageMsg_AudioStateChanged, bool /* is_audio_playing */)
 
-// Sent to OOPIF renderers when the main frame's ScreenInfo changes.
-IPC_MESSAGE_ROUTED1(PageMsg_UpdateScreenInfo,
-                    content::ScreenInfo /* screen_info */)
-
 // Sent to renderers with remote main frames when page-related visual properties
 // change.
 IPC_MESSAGE_ROUTED1(PageMsg_UpdatePageVisualProperties,
@@ -62,6 +58,9 @@ IPC_MESSAGE_ROUTED0(PageMsg_RestorePageFromBackForwardCache)
 IPC_MESSAGE_ROUTED1(PageMsg_UpdateTextAutosizerPageInfoForRemoteMainFrames,
                     blink::WebTextAutosizerPageInfo /* page_info */)
 
+// Sends updated preferences to the renderer.
+IPC_MESSAGE_ROUTED1(PageMsg_SetRendererPrefs, blink::mojom::RendererPreferences)
+
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
diff --git a/chromium/content/common/page_state.mojom b/chromium/content/common/page_state.mojom
index 771c9ad7d99..e4f2abcd424 100644
--- a/chromium/content/common/page_state.mojom
+++ b/chromium/content/common/page_state.mojom
@@ -4,6 +4,7 @@
 
 module content.history.mojom;
 
+// WARNING: Please read the comments below, before including other Mojo types.
 import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/time.mojom";
 import "services/network/public/mojom/referrer_policy.mojom";
@@ -13,23 +14,31 @@ import "ui/gfx/geometry/mojom/geometry.mojom";
 // This file contains the mojo IDL definitions for PageState and its constituent
 // parts. The resultant generated code is used to serialize and deserialize
 // PageState for the purpose of history restore.
-// When adding fields, assign your new field an explicity ordinal(@n) and
-// prefer to add fields to the end of the struct to simplify finding the
-// latest ordinal.
-// For backwards compatibility purposes, new fields must be tagged with a
-// [MinVersion=x] attribute; x is specified at the bottom of this comment
-// block.
-// You'll also need to read/write the new field's value when decoding and
-// encoding PageState, update PageStateSerializationTest to check that
-// your new field is preserved across serialization, and add a BackwardsCompat
-// test with associated serialized_vxx.dat file. Look for
-// DumpExpectedPageStateForBackwardsCompat in page_state_serialization_unittest
-// for how to do this.
+//
+// When adding fields:
+// - Assign your new field an explicit ordinal(@n) and prefer to add fields to
+//   the end of the struct to simplify finding the latest ordinal.
+// - For backwards compatibility purposes:
+//     - New fields must be tagged with a [MinVersion=x] attribute; x is
+//       specified at the bottom of this comment block.
+//     - Only types with frozen/unchanging Mojo serialization may be used;
+//       for example, |string| is okay, but |url.mojom.Origin| is not.
+//       (note that if serialization of any of the types used in PageState
+//       changes in a backwards-incompatible way then it should be caught by
+//       one of PageStateSerializationTest, BackwardsCompat_vXX tests).
+// - You'll also need to read/write the new field's value when decoding and
+//   encoding PageState, update PageStateSerializationTest to check that your
+//   new field is preserved across serialization, and add a BackwardsCompat
+//   test with associated serialized_vxx.dat file. Look for
+//   DumpExpectedPageStateForBackwardsCompat in
+//   page_state_serialization_unittest for how to do this.
+//
 // Don't remove, or change the type of fields; this will break
 // compatibility. If re-ordering fields, make sure to retain the original
 // ordinal value.
+//
 // Update the below value if your change introduces fields using it.
-// Next MinVersion: 2
+// Next MinVersion: 3
 
 // Next Ordinal: 4
 // FileSystemFile is no longer supported.
@@ -90,6 +99,7 @@ struct ViewState {
   [MinVersion=1] uint64 scroll_anchor_simhash@5 = 0;
 };
 
+// Next Ordinal: 13
 struct FrameState {
   mojo_base.mojom.String16? url_string@0;
   mojo_base.mojom.String16? referrer@1;
@@ -103,6 +113,7 @@ struct FrameState {
   network.mojom.ReferrerPolicy referrer_policy@9;
   HttpBody http_body@10;
   array<FrameState> children@11;
+  [MinVersion=2] string? initiator_origin@12;
 };
 
 // Next Ordinal: 2
diff --git a/chromium/content/common/page_state_serialization.cc b/chromium/content/common/page_state_serialization.cc
index bf884e3d3d3..1d92376abf3 100644
--- a/chromium/content/common/page_state_serialization.cc
+++ b/chromium/content/common/page_state_serialization.cc
@@ -6,6 +6,7 @@
 
 #include <algorithm>
 #include <limits>
+#include <utility>
 
 #include "base/pickle.h"
 #include "base/strings/string_number_conversions.h"
@@ -14,6 +15,7 @@
 #include "build/build_config.h"
 #include "content/common/page_state.mojom.h"
 #include "content/common/unique_name_helper.h"
+#include "content/public/common/referrer.h"
 #include "ipc/ipc_message_utils.h"
 #include "mojo/public/cpp/base/string16_mojom_traits.h"
 #include "mojo/public/cpp/base/time_mojom_traits.h"
@@ -205,6 +207,7 @@ struct SerializeObject {
 // 25: Limit the length of unique names: https://crbug.com/626202
 // 26: Switch to mojo-based serialization.
 // 27: Add serialized scroll anchor to FrameState.
+// 28: Add initiator origin to FrameState.
 // NOTE: If the version is -1, then the pickle contains only a URL string.
 // See ReadPageState.
 //
@@ -212,7 +215,7 @@ const int kMinVersion = 11;
 // NOTE: When changing the version, please add a backwards compatibility test.
 // See PageStateSerializationTest.DumpExpectedPageStateForBackwardsCompat for
 // instructions on how to generate the new test case.
-const int kCurrentVersion = 27;
+const int kCurrentVersion = 28;
 
 // A bunch of convenience functions to write to/read from SerializeObjects.  The
 // de-serializers assume the input data will be in the correct format and fall
@@ -464,7 +467,7 @@ void ReadResourceRequestBody(
         std::string blob_uuid = ReadStdString(obj);
         AppendBlobToRequestBody(request_body, blob_uuid);
       } else {
-        ReadGURL(obj); // Skip the obsolete blob url value.
+        ReadGURL(obj);  // Skip the obsolete blob url value.
       }
     }
   }
@@ -544,14 +547,13 @@ void ReadFrameState(
   state->item_sequence_number = ReadInteger64(obj);
   state->document_sequence_number = ReadInteger64(obj);
   if (obj->version >= 21 && obj->version < 23)
-    ReadInteger64(obj); // Skip obsolete frame sequence number.
+    ReadInteger64(obj);  // Skip obsolete frame sequence number.
 
   if (obj->version >= 17 && obj->version < 19)
-    ReadInteger64(obj); // Skip obsolete target frame id number.
+    ReadInteger64(obj);  // Skip obsolete target frame id number.
 
   if (obj->version >= 18) {
-    state->referrer_policy =
-        static_cast<network::mojom::ReferrerPolicy>(ReadInteger(obj));
+    state->referrer_policy = Referrer::ConvertToPolicy(ReadInteger(obj));
   }
 
   if (obj->version >= 20 && state->did_save_scroll_or_scale_state) {
@@ -773,6 +775,8 @@ void WriteFrameState(const ExplodedFrameState& state,
                      history::mojom::FrameState* frame) {
   frame->url_string = state.url_string;
   frame->referrer = state.referrer;
+  if (state.initiator_origin.has_value())
+    frame->initiator_origin = state.initiator_origin.value().Serialize();
   frame->target = state.target;
   frame->state_object = state.state_object;
 
@@ -823,6 +827,11 @@ void ReadFrameState(history::mojom::FrameState* frame,
                     ExplodedFrameState* state) {
   state->url_string = frame->url_string;
   state->referrer = frame->referrer;
+  if (frame->initiator_origin.has_value()) {
+    state->initiator_origin =
+        url::Origin::Create(GURL(frame->initiator_origin.value()));
+  }
+
   state->target = frame->target;
   state->state_object = frame->state_object;
 
@@ -1023,6 +1032,7 @@ void EncodePageState(const ExplodedPageState& exploded, std::string* encoded) {
   obj.version = kCurrentVersion;
   WriteMojoPageState(exploded, &obj);
   *encoded = obj.GetAsString();
+  DCHECK(!encoded->empty());
 }
 
 void LegacyEncodePageStateForTesting(const ExplodedPageState& exploded,
diff --git a/chromium/content/common/page_state_serialization.h b/chromium/content/common/page_state_serialization.h
index bed9ba7399c..c61a6c3eb56 100644
--- a/chromium/content/common/page_state_serialization.h
+++ b/chromium/content/common/page_state_serialization.h
@@ -21,6 +21,7 @@
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/point_f.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -38,6 +39,7 @@ struct CONTENT_EXPORT ExplodedHttpBody {
 struct CONTENT_EXPORT ExplodedFrameState {
   base::Optional<base::string16> url_string;
   base::Optional<base::string16> referrer;
+  base::Optional<url::Origin> initiator_origin;
   base::Optional<base::string16> target;
   base::Optional<base::string16> state_object;
   std::vector<base::Optional<base::string16>> document_state;
diff --git a/chromium/content/common/page_state_serialization_unittest.cc b/chromium/content/common/page_state_serialization_unittest.cc
index 80cd7d6d615..251ef06ece6 100644
--- a/chromium/content/common/page_state_serialization_unittest.cc
+++ b/chromium/content/common/page_state_serialization_unittest.cc
@@ -75,6 +75,7 @@ void ExpectEquality(const ExplodedFrameState& expected,
   EXPECT_EQ(expected.url_string, actual.url_string);
   EXPECT_EQ(expected.referrer, actual.referrer);
   EXPECT_EQ(expected.referrer_policy, actual.referrer_policy);
+  EXPECT_EQ(expected.initiator_origin, actual.initiator_origin);
   EXPECT_EQ(expected.target, actual.target);
   EXPECT_EQ(expected.state_object, actual.state_object);
   ExpectEquality(expected.document_state, actual.document_state);
@@ -145,9 +146,30 @@ class PageStateSerializationTest : public testing::Test {
     referenced_files->emplace_back(path.AsUTF16Unsafe());
   }
 
-  void PopulateFrameStateForBackwardsCompatTest(
-      ExplodedFrameState* frame_state,
-      bool is_child) {
+  void PopulateFrameStateForBackwardsCompatTest(ExplodedFrameState* frame_state,
+                                                bool is_child,
+                                                int version) {
+    if (version < 28) {
+      // Older versions didn't cover |initiator_origin| -  we expect that
+      // deserialization will set it to the default, null value.
+      frame_state->initiator_origin = base::nullopt;
+    } else {
+      frame_state->initiator_origin =
+          url::Origin::Create(GURL("https://initiator.example.com"));
+    }
+
+    // Some of the test values below are the same as the default value that
+    // would be deserialized when reading old versions.  This is undesirable,
+    // because it means that the tests do not fully test that a non-default
+    // value is correctly deserialized.  Unfortunately this is tricky to change,
+    // because these default/old test values are baked into serialized_XX.dat
+    // test files (which we should be wary of modifying, since they are supposed
+    // to represent set-in-stone old serialization format).
+    //
+    // When introducing new fields, please test a non-default value, starting
+    // with the |version| where the new field is being introduced (set the
+    // |version|-dependent test value above - next to and similarly to how
+    // |initiator_origin| is handled).
     frame_state->url_string = base::UTF8ToUTF16("http://chromium.org/");
     frame_state->referrer = base::UTF8ToUTF16("http://google.com/");
     frame_state->referrer_policy = network::mojom::ReferrerPolicy::kDefault;
@@ -189,14 +211,15 @@ class PageStateSerializationTest : public testing::Test {
                                                        test_body2.size());
 
       ExplodedFrameState child_state;
-      PopulateFrameStateForBackwardsCompatTest(&child_state, true);
+      PopulateFrameStateForBackwardsCompatTest(&child_state, true, version);
       frame_state->children.push_back(child_state);
     }
   }
 
-  void PopulatePageStateForBackwardsCompatTest(ExplodedPageState* page_state) {
+  void PopulatePageStateForBackwardsCompatTest(ExplodedPageState* page_state,
+                                               int version) {
     page_state->referenced_files.push_back(base::UTF8ToUTF16("file.txt"));
-    PopulateFrameStateForBackwardsCompatTest(&page_state->top, false);
+    PopulateFrameStateForBackwardsCompatTest(&page_state->top, false, version);
   }
 
   void ReadBackwardsCompatPageState(const std::string& suffix,
@@ -251,7 +274,7 @@ class PageStateSerializationTest : public testing::Test {
 
     ExplodedPageState decoded_state;
     ExplodedPageState expected_state;
-    PopulatePageStateForBackwardsCompatTest(&expected_state);
+    PopulatePageStateForBackwardsCompatTest(&expected_state, version);
     ReadBackwardsCompatPageState(suffix, version, &decoded_state);
 
     ExpectEquality(expected_state, decoded_state);
@@ -390,7 +413,7 @@ TEST_F(PageStateSerializationTest, BadMessagesTest2) {
 // test compatibility and migration.
 TEST_F(PageStateSerializationTest, LegacyEncodePageStateFrozen) {
   ExplodedPageState actual_state;
-  PopulatePageStateForBackwardsCompatTest(&actual_state);
+  PopulatePageStateForBackwardsCompatTest(&actual_state, 25);
 
   std::string actual_encoded_state;
   LegacyEncodePageStateForTesting(actual_state, 25, &actual_encoded_state);
@@ -449,8 +472,11 @@ TEST_F(PageStateSerializationTest, ScrollAnchorSelectorLengthLimited) {
 // revision where page_state_serialization.cc:kCurrentVersion == 23.
 #if 0
 TEST_F(PageStateSerializationTest, DumpExpectedPageStateForBackwardsCompat) {
+  // Populate |state| with test data suitable for testing the current (i.e. the
+  // latest) version of serialization.  This is accomplished by asking for test
+  // data for version 9999 - a future, hypothetical version number.
   ExplodedPageState state;
-  PopulatePageStateForBackwardsCompatTest(&state);
+  PopulatePageStateForBackwardsCompatTest(&state, 9999);
 
   std::string encoded;
   EncodePageState(state, &encoded);
@@ -541,6 +567,10 @@ TEST_F(PageStateSerializationTest, BackwardsCompat_v27) {
   TestBackwardsCompat(27);
 }
 
+TEST_F(PageStateSerializationTest, BackwardsCompat_v28) {
+  TestBackwardsCompat(28);
+}
+
 // Add your new backwards compat test for future versions *above* this
 // comment block; field-specific tests go *below* this comment block.
 // Any field additions require a new version and backcompat test; only fields
diff --git a/chromium/content/common/page_zoom.cc b/chromium/content/common/page_zoom.cc
deleted file mode 100644
index af448aa421e..00000000000
--- a/chromium/content/common/page_zoom.cc
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <cmath>
-
-#include "content/public/common/page_zoom.h"
-
-namespace content {
-
-const double kMinimumZoomFactor = 0.25;
-const double kMaximumZoomFactor = 5.0;
-const double kEpsilon = 0.001;
-const double kTextSizeMultiplierRatio = 1.2;
-
-bool ZoomValuesEqual(double value_a, double value_b) {
-  return (std::fabs(value_a - value_b) <= kEpsilon);
-}
-
-double ZoomLevelToZoomFactor(double zoom_level) {
-  return std::pow(kTextSizeMultiplierRatio, zoom_level);
-}
-
-double ZoomFactorToZoomLevel(double factor) {
-  return std::log(factor) / std::log(kTextSizeMultiplierRatio);
-}
-
-}  // namespace content
diff --git a/chromium/content/common/page_zoom_unittest.cc b/chromium/content/common/page_zoom_unittest.cc
deleted file mode 100644
index 67dd5d567da..00000000000
--- a/chromium/content/common/page_zoom_unittest.cc
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/common/page_zoom.h"
-
-#include "testing/gtest/include/gtest/gtest.h"
-
-TEST(PageZoomTest, ZoomValuesEqual) {
-  // Test two identical values.
-  EXPECT_TRUE(content::ZoomValuesEqual(1.5, 1.5));
-
-  // Test two values that are close enough to be considered equal.
-  EXPECT_TRUE(content::ZoomValuesEqual(1.5, 1.49999999));
-
-  // Test two values that are close, but should not be considered equal.
-  EXPECT_FALSE(content::ZoomValuesEqual(1.5, 1.4));
-}
-
diff --git a/chromium/content/common/render_message_filter.mojom b/chromium/content/common/render_message_filter.mojom
index bc461da3cfc..96e22365ac2 100644
--- a/chromium/content/common/render_message_filter.mojom
+++ b/chromium/content/common/render_message_filter.mojom
@@ -17,11 +17,11 @@ interface RenderMessageFilter {
 
   // Similar to CreateWindow, except used for sub-widgets, like <select>
   // dropdowns.
-  [Sync] CreateNewWidget(int32 opener_id, Widget widget)
+  [Sync] CreateNewWidget(int32 opener_id, pending_remote<Widget> widget)
       => (int32 route_id);
 
   // Similar to CreateWidget except the widget is a full screen window.
-  [Sync] CreateFullscreenWidget(int32 opener_id, Widget widget)
+  [Sync] CreateFullscreenWidget(int32 opener_id, pending_remote<Widget> widget)
       => (int32 route_id);
 
   // A renderer sends this when it wants to know whether a gpu process exists.
diff --git a/chromium/content/common/renderer.mojom b/chromium/content/common/renderer.mojom
index 9cd918745e4..4e4c1615c98 100644
--- a/chromium/content/common/renderer.mojom
+++ b/chromium/content/common/renderer.mojom
@@ -11,8 +11,8 @@ import "mojo/public/mojom/base/generic_pending_receiver.mojom";
 import "mojo/public/mojom/base/time.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "services/network/public/mojom/network_types.mojom";
+import "third_party/blink/public/mojom/manifest/manifest.mojom";
 import "third_party/blink/public/mojom/renderer_preferences.mojom";
-import "third_party/blink/public/mojom/service_worker/embedded_worker.mojom";
 import "third_party/blink/public/mojom/user_agent/user_agent_metadata.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
 
@@ -75,7 +75,9 @@ struct CreateViewParams {
   // Whether or not the frame has previously committed a real load.
   bool has_committed_real_load;
 
-  // The initial renderer size.
+  // Initial state for the main frame RenderWidget.
+  // TODO(danakj): This should be optional and not included when there is no
+  // main_frame_widget_routing_id.
   VisualProperties visual_properties;
 
   // Whether lookup of frames in the created RenderView (e.g. lookup via
@@ -89,9 +91,11 @@ struct CreateViewParams {
 
 struct CreateFrameWidgetParams {
   // Gives the routing ID for the RenderWidget that will be attached to the
-  // new RenderFrame. If the RenderFrame does not need a RenderWidget, this
-  // is MSG_ROUTING_NONE and the other parameters are not read.
+  // new RenderFrame.
   int32 routing_id;
+
+  // The initial visual properties of the widget.
+  VisualProperties visual_properties;
 };
 
 struct CreateFrameParams {
@@ -141,7 +145,7 @@ struct CreateFrameParams {
 
   // Specifies properties for a new RenderWidget that will be attached to the
   // new RenderFrame (if one is needed).
-  CreateFrameWidgetParams widget_params;
+  CreateFrameWidgetParams? widget_params;
 
   // Whether or not the frame has previously committed a real load.
   bool has_committed_real_load;
@@ -210,14 +214,6 @@ interface Renderer {
                    FrameReplicationState replication_state,
                    mojo_base.mojom.UnguessableToken devtools_frame_token);
 
-  // Tells the renderer to create an EmbeddedWorkerInstanceClient, which is what
-  // manages service worker startup and shutdown.
-  // TODO(shimazu): Send all params for starting service worker to reduce the
-  // number of IPCs.
-  SetUpEmbeddedWorkerChannelForServiceWorker(
-      pending_receiver<blink.mojom.EmbeddedWorkerInstanceClient>
-          client_receiver);
-
   // Tells the renderer that the network type has changed so that
   // navigator.onLine and navigator.connection can be updated.
   OnNetworkConnectionChanged(NetworkConnectionType connection_type,
diff --git a/chromium/content/common/resource_messages.h b/chromium/content/common/resource_messages.h
index c31444de9a6..0d31d88e8d4 100644
--- a/chromium/content/common/resource_messages.h
+++ b/chromium/content/common/resource_messages.h
@@ -29,10 +29,6 @@
 
 #endif  // INTERNAL_CONTENT_COMMON_RESOURCE_MESSAGES_H_
 
-#define IPC_MESSAGE_START ResourceMsgStart
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebMixedContentContextType,
                           blink::WebMixedContentContextType::kLast)
 
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc b/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
index 0de95f888f0..44a23dd1163 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
+++ b/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
@@ -23,7 +23,7 @@ constexpr char kTestServiceName[] = "test service";
 }  // namespace
 
 TEST(ServiceManagerConnectionImplTest, ServiceLaunchThreading) {
-  base::test::TaskEnvironment task_environment;
+  base::test::SingleThreadTaskEnvironment task_environment;
   base::Thread io_thread("ServiceManagerConnectionImplTest IO Thread");
   io_thread.Start();
   service_manager::mojom::ServicePtr service;
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.cc b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
index 392867932a5..1f573ee5b22 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.cc
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
@@ -17,9 +17,10 @@
 #include "net/http/http_util.h"
 #include "net/url_request/redirect_util.h"
 #include "services/network/loader_util.h"
+#include "services/network/public/cpp/content_security_policy.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_request_body.h"
-#include "services/network/public/cpp/resource_response.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
 #include "ui/base/page_transition_types.h"
 
@@ -52,7 +53,7 @@ void ServiceWorkerLoaderHelpers::SaveResponseHeaders(
     const int status_code,
     const std::string& status_text,
     const base::flat_map<std::string, std::string>& headers,
-    network::ResourceResponseHead* out_head) {
+    network::mojom::URLResponseHead* out_head) {
   // Build a string instead of using HttpResponseHeaders::AddHeader on
   // each header, since AddHeader has O(n^2) performance.
   std::string buf(base::StringPrintf("HTTP/1.1 %d %s\r\n", status_code,
@@ -93,7 +94,7 @@ void ServiceWorkerLoaderHelpers::SaveResponseHeaders(
 // static
 void ServiceWorkerLoaderHelpers::SaveResponseInfo(
     const blink::mojom::FetchAPIResponse& response,
-    network::ResourceResponseHead* out_head) {
+    network::mojom::URLResponseHead* out_head) {
   out_head->was_fetched_via_service_worker = true;
   out_head->was_fallback_required_by_service_worker = false;
   out_head->url_list_via_service_worker = response.url_list;
@@ -108,13 +109,15 @@ void ServiceWorkerLoaderHelpers::SaveResponseInfo(
     out_head->cache_storage_cache_name.clear();
   out_head->cors_exposed_header_names = response.cors_exposed_header_names;
   out_head->did_service_worker_navigation_preload = false;
+  out_head->content_security_policy =
+      network::ContentSecurityPolicy(response.content_security_policy.Clone());
 }
 
 // static
 base::Optional<net::RedirectInfo>
 ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
     const network::ResourceRequest& original_request,
-    const network::ResourceResponseHead& response_head) {
+    const network::mojom::URLResponseHead& response_head) {
   std::string new_location;
   if (!response_head.headers->IsRedirect(&new_location))
     return base::nullopt;
@@ -128,9 +131,9 @@ ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
           : net::URLRequest::NEVER_CHANGE_FIRST_PARTY_URL;
   return net::RedirectInfo::ComputeRedirectInfo(
       original_request.method, original_request.url,
-      original_request.site_for_cookies, original_request.top_frame_origin,
-      first_party_url_policy, original_request.referrer_policy,
-      network::ComputeReferrer(original_request.referrer),
+      original_request.site_for_cookies, first_party_url_policy,
+      original_request.referrer_policy,
+      original_request.referrer.GetAsReferrer().spec(),
       response_head.headers->response_code(),
       original_request.url.Resolve(new_location),
       net::RedirectUtil::GetReferrerPolicyHeader(response_head.headers.get()),
@@ -138,7 +141,7 @@ ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
 }
 
 int ServiceWorkerLoaderHelpers::ReadBlobResponseBody(
-    blink::mojom::BlobPtr* blob,
+    mojo::Remote<blink::mojom::Blob>* blob,
     uint64_t blob_size,
     base::OnceCallback<void(int)> on_blob_read_complete,
     mojo::ScopedDataPipeConsumerHandle* handle_out) {
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.h b/chromium/content/common/service_worker/service_worker_loader_helpers.h
index 5b037576294..c90564e3b3a 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.h
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.h
@@ -7,14 +7,15 @@
 
 #include "base/containers/flat_map.h"
 #include "base/optional.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/http/http_request_headers.h"
 #include "net/url_request/redirect_info.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_response.mojom.h"
 
 namespace network {
 struct ResourceRequest;
-struct ResourceResponseHead;
 }
 
 namespace content {
@@ -29,23 +30,23 @@ class ServiceWorkerLoaderHelpers {
       const int status_code,
       const std::string& status_text,
       const base::flat_map<std::string, std::string>& headers,
-      network::ResourceResponseHead* out_head);
+      network::mojom::URLResponseHead* out_head);
   // Populates |out_head| (except for headers) with given |response|.
   static void SaveResponseInfo(const blink::mojom::FetchAPIResponse& response,
-                               network::ResourceResponseHead* out_head);
+                               network::mojom::URLResponseHead* out_head);
 
   // Returns a redirect info if |response_head| is an redirect response.
   // Otherwise returns base::nullopt.
   static base::Optional<net::RedirectInfo> ComputeRedirectInfo(
       const network::ResourceRequest& original_request,
-      const network::ResourceResponseHead& response_head);
+      const network::mojom::URLResponseHead& response_head);
 
   // Reads |blob| into |handle_out|. Calls |on_blob_read_complete| when done or
   // if an error occurred. Currently this always returns net::OK but
   // the plan is to return an error if reading couldn't start, in
   // which case |on_blob_read_complete| isn't called.
   static int ReadBlobResponseBody(
-      blink::mojom::BlobPtr* blob,
+      mojo::Remote<blink::mojom::Blob>* blob,
       uint64_t blob_size,
       base::OnceCallback<void(int net_error)> on_blob_read_complete,
       mojo::ScopedDataPipeConsumerHandle* handle_out);
diff --git a/chromium/content/common/throttling_url_loader.cc b/chromium/content/common/throttling_url_loader.cc
index 4c4046499ce..ee5e64a114f 100644
--- a/chromium/content/common/throttling_url_loader.cc
+++ b/chromium/content/common/throttling_url_loader.cc
@@ -12,6 +12,8 @@
 #include "net/http/http_util.h"
 #include "net/url_request/redirect_util.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/resource_response.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 
 namespace content {
 
@@ -74,11 +76,11 @@ class ThrottlingURLLoader::ForwardingThrottleDelegate
   }
 
   void UpdateDeferredResponseHead(
-      const network::ResourceResponseHead& new_response_head) override {
+      network::mojom::URLResponseHeadPtr new_response_head) override {
     if (!loader_)
       return;
     ScopedDelegateCall scoped_delegate_call(this);
-    loader_->UpdateDeferredResponseHead(new_response_head);
+    loader_->UpdateDeferredResponseHead(std::move(new_response_head));
   }
 
   void PauseReadingBodyFromNet() override {
@@ -179,15 +181,16 @@ ThrottlingURLLoader::StartInfo::StartInfo(
 ThrottlingURLLoader::StartInfo::~StartInfo() = default;
 
 ThrottlingURLLoader::ResponseInfo::ResponseInfo(
-    const network::ResourceResponseHead& in_response_head)
-    : response_head(in_response_head) {}
+    network::mojom::URLResponseHeadPtr in_response_head)
+    : response_head(std::move(in_response_head)) {}
 
 ThrottlingURLLoader::ResponseInfo::~ResponseInfo() = default;
 
 ThrottlingURLLoader::RedirectInfo::RedirectInfo(
     const net::RedirectInfo& in_redirect_info,
-    const network::ResourceResponseHead& in_response_head)
-    : redirect_info(in_redirect_info), response_head(in_response_head) {}
+    network::mojom::URLResponseHeadPtr in_response_head)
+    : redirect_info(in_redirect_info),
+      response_head(std::move(in_response_head)) {}
 
 ThrottlingURLLoader::RedirectInfo::~RedirectInfo() = default;
 
@@ -392,8 +395,7 @@ void ThrottlingURLLoader::StartNow() {
 
     net::RedirectInfo redirect_info = net::RedirectInfo::ComputeRedirectInfo(
         start_info_->url_request.method, start_info_->url_request.url,
-        start_info_->url_request.site_for_cookies,
-        start_info_->url_request.top_frame_origin, first_party_url_policy,
+        start_info_->url_request.site_for_cookies, first_party_url_policy,
         start_info_->url_request.referrer_policy,
         start_info_->url_request.referrer.spec(),
         // Use status code 307 to preserve the method, so POST requests work.
@@ -413,7 +415,7 @@ void ThrottlingURLLoader::StartNow() {
     // that's requested.
     start_info_->url_request.url = throttle_will_start_redirect_url_;
 
-    network::ResourceResponseHead response_head;
+    auto response_head = network::mojom::URLResponseHead::New();
     std::string header_string = base::StringPrintf(
         "HTTP/1.1 %i Internal Redirect\n"
         "Location: %s",
@@ -421,26 +423,26 @@ void ThrottlingURLLoader::StartNow() {
         throttle_will_start_redirect_url_.spec().c_str());
 
     // This is only needed when CORS is running in the renderer.
-    if (!network::features::ShouldEnableOutOfBlinkCors()) {
-      std::string http_origin;
-      if (start_info_->url_request.headers.GetHeader("Origin", &http_origin)) {
-        // If this redirect is used in a cross-origin request, add CORS headers
-        // to make sure that the redirect gets through. Note that the
-        // destination URL is still subject to the usual CORS policy, i.e. the
-        // resource will only be available to web pages if the server serves the
-        // response with the required CORS response headers.
-        header_string += base::StringPrintf(
-            "\n"
-            "Access-Control-Allow-Origin: %s\n"
-            "Access-Control-Allow-Credentials: true",
-            http_origin.c_str());
-      }
+    // TODO(crbug.com/1001450): Remove following code once OOR-CORS is fully
+    // enabled.
+    std::string http_origin;
+    if (start_info_->url_request.headers.GetHeader("Origin", &http_origin)) {
+      // If this redirect is used in a cross-origin request, add CORS headers
+      // to make sure that the redirect gets through. Note that the
+      // destination URL is still subject to the usual CORS policy, i.e. the
+      // resource will only be available to web pages if the server serves the
+      // response with the required CORS response headers.
+      header_string += base::StringPrintf(
+          "\n"
+          "Access-Control-Allow-Origin: %s\n"
+          "Access-Control-Allow-Credentials: true",
+          http_origin.c_str());
     }
 
-    response_head.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+    response_head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
         net::HttpUtil::AssembleRawHeaders(header_string));
-    response_head.encoded_data_length = header_string.size();
-    OnReceiveRedirect(redirect_info, response_head);
+    response_head->encoded_data_length = header_string.size();
+    OnReceiveRedirect(redirect_info, std::move(response_head));
     return;
   }
 
@@ -611,8 +613,8 @@ void ThrottlingURLLoader::OnReceiveRedirect(
 
     if (deferred) {
       deferred_stage_ = DEFERRED_REDIRECT;
-      redirect_info_ =
-          std::make_unique<RedirectInfo>(redirect_info, response_head);
+      redirect_info_ = std::make_unique<RedirectInfo>(redirect_info,
+                                                      std::move(response_head));
       // |client_binding_| can be unbound if the redirect came from a throttle.
       if (client_binding_.is_bound())
         client_binding_.PauseIncomingMethodCallProcessing();
@@ -626,7 +628,6 @@ void ThrottlingURLLoader::OnReceiveRedirect(
   request.url = redirect_info.new_url;
   request.method = redirect_info.new_method;
   request.site_for_cookies = redirect_info.new_site_for_cookies;
-  request.top_frame_origin = redirect_info.new_top_frame_origin;
   request.referrer = GURL(redirect_info.new_referrer);
   request.referrer_policy = redirect_info.new_referrer_policy;
 
@@ -747,8 +748,9 @@ void ThrottlingURLLoader::Resume() {
       // the redirect or if it will be cancelled. FollowRedirect would be a more
       // suitable place to set this URL but there we do not have the data.
       response_url_ = redirect_info_->redirect_info.new_url;
-      forwarding_client_->OnReceiveRedirect(redirect_info_->redirect_info,
-                                            redirect_info_->response_head);
+      forwarding_client_->OnReceiveRedirect(
+          redirect_info_->redirect_info,
+          std::move(redirect_info_->response_head));
       // Note: |this| may be deleted here.
       break;
     }
@@ -765,7 +767,8 @@ void ThrottlingURLLoader::Resume() {
     }
     case DEFERRED_RESPONSE: {
       client_binding_.ResumeIncomingMethodCallProcessing();
-      forwarding_client_->OnReceiveResponse(response_info_->response_head);
+      forwarding_client_->OnReceiveResponse(
+          std::move(response_info_->response_head));
       // Note: |this| may be deleted here.
       break;
     }
@@ -810,10 +813,10 @@ void ThrottlingURLLoader::UpdateDeferredRequestHeaders(
 }
 
 void ThrottlingURLLoader::UpdateDeferredResponseHead(
-    const network::ResourceResponseHead& new_response_head) {
+    network::mojom::URLResponseHeadPtr new_response_head) {
   DCHECK(response_info_);
   DCHECK_EQ(DEFERRED_RESPONSE, deferred_stage_);
-  response_info_->response_head = new_response_head;
+  response_info_->response_head = std::move(new_response_head);
 }
 
 void ThrottlingURLLoader::PauseReadingBodyFromNet(
diff --git a/chromium/content/common/throttling_url_loader.h b/chromium/content/common/throttling_url_loader.h
index f723990d006..e5e64fbe267 100644
--- a/chromium/content/common/throttling_url_loader.h
+++ b/chromium/content/common/throttling_url_loader.h
@@ -14,10 +14,10 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/binding.h"
-#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 
 namespace base {
@@ -144,7 +144,7 @@ class CONTENT_EXPORT ThrottlingURLLoader
       const net::HttpRequestHeaders& modified_request_headers,
       const net::HttpRequestHeaders& modified_cors_exempt_request_headers);
   void UpdateDeferredResponseHead(
-      const network::ResourceResponseHead& new_response_head);
+      network::mojom::URLResponseHeadPtr new_response_head);
   void PauseReadingBodyFromNet(blink::URLLoaderThrottle* throttle);
   void ResumeReadingBodyFromNet(blink::URLLoaderThrottle* throttle);
   void InterceptResponse(
@@ -220,22 +220,21 @@ class CONTENT_EXPORT ThrottlingURLLoader
   std::unique_ptr<StartInfo> start_info_;
 
   struct ResponseInfo {
-    explicit ResponseInfo(
-        const network::ResourceResponseHead& in_response_head);
+    explicit ResponseInfo(network::mojom::URLResponseHeadPtr in_response_head);
     ~ResponseInfo();
 
-    network::ResourceResponseHead response_head;
+    network::mojom::URLResponseHeadPtr response_head;
   };
   // Set if response is deferred.
   std::unique_ptr<ResponseInfo> response_info_;
 
   struct RedirectInfo {
     RedirectInfo(const net::RedirectInfo& in_redirect_info,
-                 const network::ResourceResponseHead& in_response_head);
+                 network::mojom::URLResponseHeadPtr in_response_head);
     ~RedirectInfo();
 
     net::RedirectInfo redirect_info;
-    network::ResourceResponseHead response_head;
+    network::mojom::URLResponseHeadPtr response_head;
   };
   // Set if redirect is deferred.
   std::unique_ptr<RedirectInfo> redirect_info_;
diff --git a/chromium/content/common/throttling_url_loader_unittest.cc b/chromium/content/common/throttling_url_loader_unittest.cc
index 963b47b4812..145bd2f6932 100644
--- a/chromium/content/common/throttling_url_loader_unittest.cc
+++ b/chromium/content/common/throttling_url_loader_unittest.cc
@@ -10,6 +10,7 @@
 #include "base/run_loop.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/task_environment.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
@@ -66,13 +67,14 @@ class TestURLLoaderFactory : public network::mojom::URLLoaderFactory,
   }
 
   void NotifyClientOnReceiveResponse() {
-    client_ptr_->OnReceiveResponse(network::ResourceResponseHead());
+    client_ptr_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   }
 
   void NotifyClientOnReceiveRedirect() {
     net::RedirectInfo info;
     info.new_url = redirect_url;
-    client_ptr_->OnReceiveRedirect(info, network::ResourceResponseHead());
+    client_ptr_->OnReceiveRedirect(info,
+                                   network::mojom::URLResponseHead::New());
   }
 
   void NotifyClientOnComplete(int error_code) {
@@ -112,7 +114,8 @@ class TestURLLoaderFactory : public network::mojom::URLLoaderFactory,
       on_create_loader_and_start_callback_.Run(url_request);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     NOTREACHED();
   }
 
diff --git a/chromium/content/common/user_agent.cc b/chromium/content/common/user_agent.cc
index 65083a09551..37e72394997 100644
--- a/chromium/content/common/user_agent.cc
+++ b/chromium/content/common/user_agent.cc
@@ -30,7 +30,7 @@ const base::Feature kAndroidUserAgentStringContainsBuildId{
 #endif  // defined(OS_ANDROID)
 
 std::string GetUserAgentPlatform() {
-#if defined(OS_WIN) || defined(OS_FUCHSIA)
+#if defined(OS_WIN)
   return "";
 #elif defined(OS_MACOSX)
   return "Macintosh; ";
@@ -38,6 +38,10 @@ std::string GetUserAgentPlatform() {
   return "X11; ";  // strange, but that's what Firefox uses
 #elif defined(OS_ANDROID)
   return "Linux; ";
+#elif defined(OS_FUCHSIA)
+  // TODO(https://crbug.com/1010256): Sites get confused into serving mobile
+  // content if we report only "Fuchsia".
+  return "X11; ";
 #elif defined(OS_POSIX)
   return "Unknown; ";
 #endif
diff --git a/chromium/content/common/view_messages.h b/chromium/content/common/view_messages.h
index 632b7b8159a..ac32a53c5cd 100644
--- a/chromium/content/common/view_messages.h
+++ b/chromium/content/common/view_messages.h
@@ -23,6 +23,7 @@
 #include "components/viz/common/frame_sinks/begin_frame_args.h"
 #include "components/viz/common/quads/compositor_frame.h"
 #include "components/viz/common/resources/shared_bitmap.h"
+#include "content/common/common_param_traits_macros.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/frame_replication_state.h"
@@ -40,10 +41,10 @@
 #include "media/base/ipc/media_param_traits.h"
 #include "net/base/network_change_notifier.h"
 #include "ppapi/buildflags/buildflags.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
+#include "third_party/blink/public/common/plugin/plugin_action.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 #include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
-#include "third_party/blink/public/web/web_plugin_action.h"
 #include "third_party/blink/public/web/web_text_direction.h"
 #include "ui/base/ime/text_input_type.h"
 #include "ui/gfx/color_space.h"
@@ -67,8 +68,8 @@
 
 #define IPC_MESSAGE_START ViewMsgStart
 
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebPluginAction::Type,
-                          blink::WebPluginAction::Type::kTypeLast)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::PluginAction::Type,
+                          blink::PluginAction::Type::kTypeLast)
 IPC_ENUM_TRAITS_MAX_VALUE(content::MenuItem::Type, content::MenuItem::TYPE_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(content::NavigationGesture,
                           content::NavigationGestureLast)
@@ -92,7 +93,7 @@ IPC_ENUM_TRAITS_MAX_VALUE(ui::NativeTheme::PreferredColorScheme,
 IPC_ENUM_TRAITS_MAX_VALUE(ui::NativeTheme::SystemThemeColor,
                           ui::NativeTheme::SystemThemeColor::kMaxValue)
 
-IPC_STRUCT_TRAITS_BEGIN(blink::WebPluginAction)
+IPC_STRUCT_TRAITS_BEGIN(blink::PluginAction)
   IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(enable)
 IPC_STRUCT_TRAITS_END()
@@ -114,9 +115,6 @@ IPC_STRUCT_TRAITS_END()
 // Make the RenderWidget background transparent or opaque.
 IPC_MESSAGE_ROUTED1(ViewMsg_SetBackgroundOpaque, bool /* opaque */)
 
-// Sends updated preferences to the renderer.
-IPC_MESSAGE_ROUTED1(ViewMsg_SetRendererPrefs, blink::mojom::RendererPreferences)
-
 // This passes a set of webkit preferences down to the renderer.
 IPC_MESSAGE_ROUTED1(ViewMsg_UpdateWebPreferences,
                     content::WebPreferences)
@@ -130,7 +128,7 @@ IPC_MESSAGE_ROUTED1(ViewMsg_SetInitialFocus,
 // the given point.
 IPC_MESSAGE_ROUTED2(ViewMsg_PluginActionAt,
                     gfx::Point, /* location */
-                    blink::WebPluginAction)
+                    blink::PluginAction)
 
 // Sets the page scale for the current main frame to the given page scale.
 IPC_MESSAGE_ROUTED1(ViewMsg_SetPageScale, float /* page_scale_factor */)
@@ -284,14 +282,6 @@ IPC_MESSAGE_ROUTED1(
     ViewHostMsg_NotifyTextAutosizerPageInfoChangedInLocalMainFrame,
     blink::WebTextAutosizerPageInfo /* page_info */)
 
-// Updates the minimum/maximum allowed zoom percent for this tab from the
-// default values.  If |remember| is true, then the zoom setting is applied to
-// other pages in the site and is saved, otherwise it only applies to this
-// tab.
-IPC_MESSAGE_ROUTED2(ViewHostMsg_UpdateZoomLimits,
-                    int /* minimum_percent */,
-                    int /* maximum_percent */)
-
 // Send back a string to be recorded by UserMetrics.
 IPC_MESSAGE_CONTROL1(ViewHostMsg_UserMetricsRecordAction,
                      std::string /* action */)
diff --git a/chromium/content/common/visual_properties.h b/chromium/content/common/visual_properties.h
index 198422384e8..5f64c144537 100644
--- a/chromium/content/common/visual_properties.h
+++ b/chromium/content/common/visual_properties.h
@@ -10,11 +10,45 @@
 #include "components/viz/common/surfaces/local_surface_id_allocation.h"
 #include "content/common/content_export.h"
 #include "content/public/common/screen_info.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace content {
 
+// Visual properties contain context required to render a frame tree.
+// For legacy reasons, both Page visual properties [shared by all Renderers] and
+// Widget visual properties [unique to local frame roots] are passed along the
+// same data structure. Separating these is tricky because they both affect
+// rendering, and if updates are received asynchronously, this can cause
+// incorrect behavior.
+// Visual properties are also used for Pepper fullscreen and popups, which are
+// also based on Widgets.
+//
+// The data flow for VisualProperties is tricky. For legacy reasons, visual
+// properties are currently always sent from RenderWidgetHosts to RenderWidgets.
+// However, RenderWidgets can also send visual properties to out-of-process
+// subframes [by bouncing through CrossProcessFrameConnector]. This causes a
+// cascading series of VisualProperty messages. This is necessary due to the
+// current implementation to make sure that cross-process surfaces get
+// simultaneously synchronized. For more details, see:
+// https://docs.google.com/document/d/1VKOLBYlujcn862w9LAyUbv6oW9RZgD65oDCI_G5AEVQ/edit#heading=h.wno2seszsyen
+// https://docs.google.com/document/d/1J7BTRsylGApm6KHaaTu-m6LLvSWJgf1B9CM-USKIp1k/edit#heading=h.ichmoicfam1y
+//
+// Known problems:
+// + It's not clear which properties are page-specific and which are
+// widget-specific. We should document them.
+// + It's not clear which properties are only set by the browser, which are only
+// set by the renderer, and which are set by both.
+// + Given the frame tree A(B(A')) where A and A' are same-origin, same process
+// and B is separate origin separate process:
+//   (1) RenderWidget A gets SynchronizeVisualProperties, passes it to proxy for
+//   B, sets values on RenderView/Page.
+//   (2) RenderWidget B gets SynchronizeVisualProperties, passes it to proxy for
+//   A'
+//   (3) RenderWidget A' gets SynchronizeVisualProperties.
+// In between (1) and (3), frames associated with RenderWidget A' will see
+// updated page properties from (1) but are still seeing old widget properties.
+
 struct CONTENT_EXPORT VisualProperties {
   VisualProperties();
   VisualProperties(const VisualProperties& other);
@@ -69,7 +103,8 @@ struct CONTENT_EXPORT VisualProperties {
   bool is_fullscreen_granted = false;
 
   // The display mode.
-  blink::WebDisplayMode display_mode = blink::kWebDisplayModeUndefined;
+  blink::mojom::DisplayMode display_mode =
+      blink::mojom::DisplayMode::kUndefined;
 
   // This represents the latest capture sequence number requested. When this is
   // incremented, that means the caller wants to synchronize surfaces which
diff --git a/chromium/content/common/widget_messages.h b/chromium/content/common/widget_messages.h
index b7263693670..1fbd8f1fccb 100644
--- a/chromium/content/common/widget_messages.h
+++ b/chromium/content/common/widget_messages.h
@@ -10,6 +10,7 @@
 #include "base/optional.h"
 #include "base/time/time.h"
 #include "cc/input/touch_action.h"
+#include "content/common/common_param_traits_macros.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/cursors/webcursor.h"
 #include "content/common/tab_switch_time_recorder.h"
@@ -22,7 +23,6 @@
 #include "third_party/blink/public/platform/web_float_point.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
 #include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
-#include "third_party/blink/public/web/web_device_emulation_params.h"
 #include "third_party/blink/public/web/web_text_direction.h"
 #include "ui/base/ime/text_input_action.h"
 #include "ui/base/ime/text_input_mode.h"
@@ -35,41 +35,6 @@
 
 #define IPC_MESSAGE_START WidgetMsgStart
 
-// Traits for VisualProperties.
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebDeviceEmulationParams::ScreenPosition,
-                          blink::WebDeviceEmulationParams::kScreenPositionLast)
-
-IPC_ENUM_TRAITS_MAX_VALUE(content::ScreenOrientationValues,
-                          content::SCREEN_ORIENTATION_VALUES_LAST)
-
-IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScreenOrientationType,
-                              blink::kWebScreenOrientationUndefined,
-                              blink::WebScreenOrientationTypeLast)
-
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebDisplayMode,
-                          blink::WebDisplayMode::kWebDisplayModeLast)
-
-IPC_STRUCT_TRAITS_BEGIN(content::VisualProperties)
-  IPC_STRUCT_TRAITS_MEMBER(screen_info)
-  IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(max_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(new_size)
-  IPC_STRUCT_TRAITS_MEMBER(compositor_viewport_pixel_rect)
-  IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
-  IPC_STRUCT_TRAITS_MEMBER(scroll_focused_node_into_view)
-  IPC_STRUCT_TRAITS_MEMBER(top_controls_height)
-  IPC_STRUCT_TRAITS_MEMBER(bottom_controls_height)
-  IPC_STRUCT_TRAITS_MEMBER(local_surface_id_allocation)
-  IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
-  IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
-  IPC_STRUCT_TRAITS_MEMBER(display_mode)
-  IPC_STRUCT_TRAITS_MEMBER(capture_sequence_number)
-  IPC_STRUCT_TRAITS_MEMBER(zoom_level)
-  IPC_STRUCT_TRAITS_MEMBER(page_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(is_pinch_gesture_active)
-IPC_STRUCT_TRAITS_END()
-
 // Traits for WebDeviceEmulationParams.
 IPC_STRUCT_TRAITS_BEGIN(blink::WebFloatPoint)
   IPC_STRUCT_TRAITS_MEMBER(x)
@@ -146,12 +111,6 @@ IPC_MESSAGE_ROUTED2(WidgetMsg_ShowContextMenu,
 // Expects a Close_ACK message when finished.
 IPC_MESSAGE_ROUTED0(WidgetMsg_Close)
 
-// Tells the renderer to update visual properties. The resulting
-// CompositorFrame will produce a RenderFrameMetadata containing a new
-// LocalSurfaceId. This acts as a form of ACK for this message.
-IPC_MESSAGE_ROUTED1(WidgetMsg_SynchronizeVisualProperties,
-                    content::VisualProperties /* params */)
-
 // Enables device emulation. See WebDeviceEmulationParams for description.
 IPC_MESSAGE_ROUTED1(WidgetMsg_EnableDeviceEmulation,
                     blink::WebDeviceEmulationParams /* params */)
@@ -188,8 +147,14 @@ IPC_MESSAGE_ROUTED1(WidgetMsg_SetTextDirection,
 // are in progress.
 IPC_MESSAGE_ROUTED0(WidgetMsg_SetBounds_ACK)
 
+// Updates a RenderWidget's visual properties. This should include all
+// geometries and compositing inputs so that they are updated atomically.
+IPC_MESSAGE_ROUTED1(WidgetMsg_UpdateVisualProperties,
+                    content::VisualProperties /* visual_properties */)
+
 // Informs the RenderWidget of its position on the user's screen, as well as
 // the position of the native window holding the RenderWidget.
+// TODO(danakj): These should be part of UpdateVisualProperties.
 IPC_MESSAGE_ROUTED2(WidgetMsg_UpdateScreenRects,
                     gfx::Rect /* widget_screen_rect */,
                     gfx::Rect /* window_screen_rect */)
@@ -333,9 +298,6 @@ IPC_MESSAGE_ROUTED0(WidgetHostMsg_WaitForNextFrameForTests_ACK)
 // after the frame widget has painted something.
 IPC_MESSAGE_ROUTED0(WidgetHostMsg_DidFirstVisuallyNonEmptyPaint)
 
-// Sent once the RenderWidgetCompositor issues a draw command.
-IPC_MESSAGE_ROUTED0(WidgetHostMsg_DidCommitAndDrawCompositorFrame)
-
 // Notifies whether there are JavaScript touch event handlers or not.
 IPC_MESSAGE_ROUTED1(WidgetHostMsg_HasTouchEventHandlers,
                     bool /* has_handlers */)