BASELINE: Update Chromium to 56.0.2924.122

Change-Id: I4e04de8f47e47e501c46ed934c76a431c6337ced
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

158 files changed, 2487 insertions, 4067 deletions

diff --git a/chromium/content/common/BUILD.gn b/chromium/content/common/BUILD.gn
index 62b1a8f3793..fb3c102a8b6 100644
--- a/chromium/content/common/BUILD.gn
+++ b/chromium/content/common/BUILD.gn
@@ -41,6 +41,7 @@ source_set("common") {
     "android/sync_compositor_messages.h",
     "android/sync_compositor_statics.cc",
     "android/sync_compositor_statics.h",
+    "app_web_message_port_messages.h",
     "appcache_interfaces.cc",
     "appcache_interfaces.h",
     "appcache_messages.h",
@@ -91,13 +92,7 @@ source_set("common") {
     "cursors/webcursor_ozone.cc",
     "database_messages.h",
     "date_time_suggestion.h",
-    "device_sensors/device_light_data.h",
-    "device_sensors/device_light_hardware_buffer.h",
-    "device_sensors/device_motion_hardware_buffer.h",
-    "device_sensors/device_orientation_hardware_buffer.h",
     "devtools_messages.h",
-    "discardable_shared_memory_heap.cc",
-    "discardable_shared_memory_heap.h",
     "dom_storage/dom_storage_map.cc",
     "dom_storage/dom_storage_map.h",
     "dom_storage/dom_storage_messages.h",
@@ -138,8 +133,6 @@ source_set("common") {
     "gpu/client/context_provider_command_buffer.cc",
     "gpu/client/context_provider_command_buffer.h",
     "gpu_host_messages.h",
-    "host_discardable_shared_memory_manager.cc",
-    "host_discardable_shared_memory_manager.h",
     "host_shared_bitmap_manager.cc",
     "host_shared_bitmap_manager.h",
     "in_process_child_thread_params.cc",
@@ -152,8 +145,12 @@ source_set("common") {
     "indexed_db/indexed_db_key_range.cc",
     "indexed_db/indexed_db_key_range.h",
     "indexed_db/indexed_db_messages.h",
+    "indexed_db/indexed_db_metadata.cc",
+    "indexed_db/indexed_db_metadata.h",
     "indexed_db/indexed_db_param_traits.cc",
     "indexed_db/indexed_db_param_traits.h",
+    "indexed_db/indexed_db_struct_traits.cc",
+    "indexed_db/indexed_db_struct_traits.h",
     "input/event_with_latency_info.cc",
     "input/event_with_latency_info.h",
     "input/gesture_event_stream_validator.cc",
@@ -162,6 +159,8 @@ source_set("common") {
     "input/input_event.h",
     "input/input_event_ack.cc",
     "input/input_event_ack.h",
+    "input/input_event_ack_source.h",
+    "input/input_event_ack_state.h",
     "input/input_event_dispatch_type.h",
     "input/input_event_stream_validator.cc",
     "input/input_event_stream_validator.h",
@@ -203,12 +202,10 @@ source_set("common") {
     "media/aec_dump_messages.h",
     "media/audio_messages.h",
     "media/cdm_info.cc",
-    "media/cdm_messages.h",
-    "media/cdm_messages_enums.h",
     "media/media_devices.cc",
     "media/media_devices.h",
-    "media/media_metadata_sanitizer.cc",
-    "media/media_metadata_sanitizer.h",
+    "media/media_devices_param_traits.cc",
+    "media/media_devices_param_traits.h",
     "media/media_player_delegate_messages.h",
     "media/media_player_messages_android.h",
     "media/media_stream_messages.h",
@@ -218,7 +215,6 @@ source_set("common") {
     "media/midi_messages.h",
     "media/surface_view_manager_messages_android.h",
     "media/video_capture.h",
-    "media/video_capture_messages.h",
     "memory_messages.h",
     "message_port_messages.h",
     "navigation_gesture.h",
@@ -247,7 +243,6 @@ source_set("common") {
     "platform_notification_messages.h",
     "plugin_list.cc",
     "plugin_list.h",
-    "power_monitor_messages.h",
     "process_type.cc",
     "push_messaging_messages.h",
     "quota_messages.h",
@@ -294,8 +289,6 @@ source_set("common") {
     "savable_url_schemes.cc",
     "savable_url_schemes.h",
     "screen_orientation_messages.h",
-    "security_style_util.cc",
-    "security_style_util.h",
     "send_zygote_child_ping_linux.cc",
     "service_manager/embedded_service_runner.cc",
     "service_manager/embedded_service_runner.h",
@@ -361,6 +354,7 @@ source_set("common") {
     "//build/util:webkit_version",
     "//cc/ipc",
     "//cc/surfaces",
+    "//components/discardable_memory/common",
     "//components/tracing",
     "//components/tracing:startup_tracing",
     "//content:resources",
@@ -383,18 +377,21 @@ source_set("common") {
     "//media:shared_memory_support",
     "//media/base/ipc",
     "//media/capture",
+    "//media/capture/ipc",
     "//media/gpu/ipc/client",
     "//media/gpu/ipc/common",
     "//media/midi",
+    "//media/midi:mojo_cpp_sources",
     "//mojo/common:common_base",
     "//mojo/edk/system",
     "//net",
     "//sandbox",
-    "//services/shell",
-    "//services/shell/public/cpp",
-    "//services/shell/public/interfaces",
-    "//services/shell/runner/common",
+    "//services/service_manager",
+    "//services/service_manager/public/cpp",
+    "//services/service_manager/public/interfaces",
+    "//services/service_manager/runner/common",
     "//services/ui/public/interfaces",
+    "//services/video_capture/public/interfaces",
     "//skia",
     "//storage/common",
     "//third_party/WebKit/public:blink_minimal",
@@ -554,12 +551,18 @@ mojom("mojo_bindings") {
   # This interface is internal to content.
   visibility = [ "//content/*" ]
 
+  # indexed_db.mojom uses a native typemap that is not available in Java.
+  cpp_only = true
+
   sources = [
     "associated_interfaces.mojom",
     "child_memory_coordinator.mojom",
     "frame.mojom",
+    "host_zoom.mojom",
     "image_downloader/image_downloader.mojom",
+    "indexed_db/indexed_db.mojom",
     "leveldb_wrapper.mojom",
+    "media/media_devices.mojom",
     "memory_coordinator.mojom",
     "native_types.mojom",
     "render_frame_message_filter.mojom",
@@ -568,6 +571,9 @@ mojom("mojo_bindings") {
     "renderer.mojom",
     "service_worker/embedded_worker.mojom",
     "service_worker/embedded_worker_setup.mojom",
+    "service_worker/fetch_event_dispatcher.mojom",
+    "service_worker/service_worker.mojom",
+    "service_worker/service_worker_types.mojom",
     "storage_partition_service.mojom",
     "url_loader.mojom",
     "url_loader_factory.mojom",
@@ -579,13 +585,20 @@ mojom("mojo_bindings") {
   public_deps = [
     "//components/leveldb/public/interfaces",
     "//content/public/common:interfaces",
+    "//device/power_monitor/public/interfaces",
     "//device/sensors/public/interfaces",
+
+    # TODO(mcasas): remove the following dep after https://crbug.com/653994
+    "//gpu/ipc/common:interfaces",
     "//ipc:mojom",
-    "//services/shell/public/interfaces",
+    "//media/capture/mojo:capture_types",
+    "//media/mojo/interfaces",
+    "//mojo/common:common_custom_types",
+    "//services/service_manager/public/interfaces",
     "//services/ui/public/interfaces",
+    "//services/video_capture/public/interfaces",
     "//skia/public/interfaces",
     "//third_party/WebKit/public:mojo_bindings",
-    "//third_party/WebKit/public:new_wrapper_types_mojo_bindings",
     "//ui/base/mojo:mojo_bindings",
     "//ui/gfx/geometry/mojo",
     "//ui/gfx/mojo",
diff --git a/chromium/content/common/DEPS b/chromium/content/common/DEPS
index 4b53a47874f..66adccce7df 100644
--- a/chromium/content/common/DEPS
+++ b/chromium/content/common/DEPS
@@ -1,8 +1,10 @@
 include_rules = [
   "-storage/browser",
 
+  "+components/discardable_memory/common",
   "+device/base/synchronization",
-  "+services/shell/public/cpp",
+  "+services/service_manager/public/cpp",
+  "+services/video_capture/public/interfaces",
 
   # No inclusion of WebKit from the browser, other than strictly enum/POD,
   # header-only types, and some selected common code.
@@ -16,8 +18,10 @@ include_rules = [
   "+third_party/WebKit/public/platform/WebFocusType.h",
   "+third_party/WebKit/public/platform/WebGamepad.h",
   "+third_party/WebKit/public/platform/WebGamepads.h",
+  "+third_party/WebKit/public/platform/WebGestureEvent.h",
   "+third_party/WebKit/public/platform/WebHTTPBody.h",
   "+third_party/WebKit/public/platform/WebHistoryScrollRestorationType.h",
+  "+third_party/WebKit/public/platform/WebInputEvent.h",
   "+third_party/WebKit/public/platform/WebInsecureRequestPolicy.h",
   "+third_party/WebKit/public/platform/WebOriginTrialTokenStatus.h",
   "+third_party/WebKit/public/platform/WebPageVisibilityState.h",
@@ -36,6 +40,7 @@ include_rules = [
   "+third_party/WebKit/public/platform/modules/permissions/WebPermissionType.h",
   "+third_party/WebKit/public/platform/modules/push_messaging/WebPushError.h",
   "+third_party/WebKit/public/platform/modules/push_messaging/WebPushPermissionStatus.h",
+  "+third_party/WebKit/public/platform/modules/remoteplayback/WebRemotePlaybackAvailability.h",
   "+third_party/WebKit/public/platform/modules/screen_orientation/WebLockOrientationError.h",
   "+third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationLockType.h",
   "+third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationType.h",
@@ -55,7 +60,6 @@ include_rules = [
   "+third_party/WebKit/public/web/WebFindOptions.h",
   "+third_party/WebKit/public/web/WebFrameOwnerProperties.h",
   "+third_party/WebKit/public/web/WebFrameSerializerCacheControlPolicy.h",
-  "+third_party/WebKit/public/web/WebInputEvent.h",
   "+third_party/WebKit/public/web/WebMediaPlayerAction.h",
   "+third_party/WebKit/public/web/WebPluginAction.h",
   "+third_party/WebKit/public/web/WebPopupType.h",
diff --git a/chromium/content/common/OWNERS b/chromium/content/common/OWNERS
index fe97f93303a..949baa16c87 100644
--- a/chromium/content/common/OWNERS
+++ b/chromium/content/common/OWNERS
@@ -26,6 +26,9 @@ per-file *_messages.cc=file://ipc/SECURITY_OWNERS
 per-file *_param_traits*.*=set noparent
 per-file *_param_traits*.*=file://ipc/SECURITY_OWNERS
 
+per-file *_struct_traits*.*=set noparent
+per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
+
 per-file *font_config_ipc_linux*=set noparent
 per-file *font_config_ipc_linux*=file://ipc/SECURITY_OWNERS
 
diff --git a/chromium/content/common/accessibility_messages.h b/chromium/content/common/accessibility_messages.h
index abb97a739d7..261efd4c0d2 100644
--- a/chromium/content/common/accessibility_messages.h
+++ b/chromium/content/common/accessibility_messages.h
@@ -13,6 +13,7 @@
 #include "ipc/ipc_param_traits.h"
 #include "ipc/param_traits_macros.h"
 #include "third_party/WebKit/public/web/WebAXEnums.h"
+#include "ui/accessibility/ax_action_data.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/accessibility/ax_relative_bounds.h"
 #include "ui/accessibility/ax_tree_update.h"
@@ -25,6 +26,20 @@
 
 IPC_ENUM_TRAITS_MAX_VALUE(content::AXContentIntAttribute,
                           content::AX_CONTENT_INT_ATTRIBUTE_LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(ui::AXAction, ui::AX_ACTION_LAST)
+
+IPC_STRUCT_TRAITS_BEGIN(ui::AXActionData)
+  IPC_STRUCT_TRAITS_MEMBER(action)
+  IPC_STRUCT_TRAITS_MEMBER(target_node_id)
+  IPC_STRUCT_TRAITS_MEMBER(flags)
+  IPC_STRUCT_TRAITS_MEMBER(anchor_node_id)
+  IPC_STRUCT_TRAITS_MEMBER(anchor_offset)
+  IPC_STRUCT_TRAITS_MEMBER(focus_node_id)
+  IPC_STRUCT_TRAITS_MEMBER(focus_offset)
+  IPC_STRUCT_TRAITS_MEMBER(target_rect)
+  IPC_STRUCT_TRAITS_MEMBER(target_point)
+  IPC_STRUCT_TRAITS_MEMBER(value)
+IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::AXContentNodeData)
   IPC_STRUCT_TRAITS_MEMBER(id)
@@ -116,55 +131,10 @@ IPC_STRUCT_END()
 
 // Messages sent from the browser to the renderer.
 
-// Relay a request from assistive technology to set focus to a given node.
-IPC_MESSAGE_ROUTED1(AccessibilityMsg_SetFocus,
-                    int /* object id */)
-
-// Relay a request from assistive technology to perform the default action
-// on a given node.
-IPC_MESSAGE_ROUTED1(AccessibilityMsg_DoDefaultAction,
-                    int /* object id */)
-
-// Relay a request from assistive technology to make a given object
-// visible by scrolling as many scrollable containers as possible.
-// In addition, if it's not possible to make the entire object visible,
-// scroll so that the |subfocus| rect is visible at least. The subfocus
-// rect is in local coordinates of the object itself.
-IPC_MESSAGE_ROUTED2(AccessibilityMsg_ScrollToMakeVisible,
-                    int /* object id */,
-                    gfx::Rect /* subfocus */)
-
-// Relay a request from assistive technology to show the context menu for a
-// given object.
-IPC_MESSAGE_ROUTED1(AccessibilityMsg_ShowContextMenu, int /* object id */)
-
-// Relay a request from assistive technology to move a given object
-// to a specific location, in the WebContents area coordinate space, i.e.
-// (0, 0) is the top-left corner of the WebContents.
-IPC_MESSAGE_ROUTED2(AccessibilityMsg_ScrollToPoint,
-                    int /* object id */,
-                    gfx::Point /* new location */)
-
-// Relay a request from assistive technology to set the scroll offset
-// of an accessibility object that's a scroll container, to a specific
-// offset.
-IPC_MESSAGE_ROUTED2(AccessibilityMsg_SetScrollOffset,
-                    int /* object id */,
-                    gfx::Point /* new offset */)
-
-// Relay a request from assistive technology to set the cursor or
-// selection within a document.
-IPC_MESSAGE_ROUTED4(AccessibilityMsg_SetSelection,
-                    int /* New anchor object id */,
-                    int /* New anchor offset */,
-                    int /* New focus object id */,
-                    int /* New focus offset */)
-
-// Relay a request from assistive technology to set the value of an
-// editable text element.
-IPC_MESSAGE_ROUTED2(AccessibilityMsg_SetValue,
-                    int /* object id */,
-                    base::string16 /* Value */)
+// Relay a request from assistive technology to perform an action,
+// such as focusing or clicking on a node.
+IPC_MESSAGE_ROUTED1(AccessibilityMsg_PerformAction,
+                    ui::AXActionData  /* action parameters */)
 
 // Determine the accessibility object under a given point.
 //
diff --git a/chromium/content/common/android/media_metadata_android.cc b/chromium/content/common/android/media_metadata_android.cc
index 9238b867a32..1902b3cbab9 100644
--- a/chromium/content/common/android/media_metadata_android.cc
+++ b/chromium/content/common/android/media_metadata_android.cc
@@ -44,18 +44,17 @@ MediaMetadataAndroid::CreateJavaObject(
   ScopedJavaLocalRef<jobject> j_metadata =
       Java_MediaMetadata_create(env, j_title, j_artist, j_album);
 
-  for (const auto& artwork : metadata.artwork) {
-    std::string src = artwork.src.spec();
+  for (const auto& image : metadata.artwork) {
+    std::string src = image.src.spec();
     ScopedJavaLocalRef<jstring> j_src(
         base::android::ConvertUTF8ToJavaString(env, src));
     ScopedJavaLocalRef<jstring> j_type(
-        base::android::ConvertUTF16ToJavaString(env, artwork.type));
+        base::android::ConvertUTF16ToJavaString(env, image.type));
     ScopedJavaLocalRef<jintArray> j_sizes(
-        base::android::ToJavaIntArray(
-            env, GetFlattenedSizeArray(artwork.sizes)));
+        base::android::ToJavaIntArray(env, GetFlattenedSizeArray(image.sizes)));
 
-    Java_MediaMetadata_createAndAddArtwork(env, j_metadata, j_src, j_type,
-                                           j_sizes);
+    Java_MediaMetadata_createAndAddMediaImage(env, j_metadata, j_src, j_type,
+                                              j_sizes);
   }
 
   return j_metadata;
diff --git a/chromium/content/common/android/sync_compositor_messages.h b/chromium/content/common/android/sync_compositor_messages.h
index e7e41d6e5d0..b8c6494c293 100644
--- a/chromium/content/common/android/sync_compositor_messages.h
+++ b/chromium/content/common/android/sync_compositor_messages.h
@@ -5,13 +5,14 @@
 #include <stddef.h>
 
 #include "base/memory/shared_memory_handle.h"
+#include "base/optional.h"
 #include "cc/output/begin_frame_args.h"
 #include "cc/output/compositor_frame.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/input/input_event_ack_state.h"
 #include "ipc/ipc_message_macros.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/scroll_offset.h"
 
@@ -131,7 +132,7 @@ IPC_SYNC_MESSAGE_ROUTED1_3(SyncCompositorMsg_DemandDrawHw,
                            content::SyncCompositorDemandDrawHwParams,
                            content::SyncCompositorCommonRendererParams,
                            uint32_t /* compositor_frame_sink_id */,
-                           cc::CompositorFrame)
+                           base::Optional<cc::CompositorFrame>);
 
 IPC_SYNC_MESSAGE_ROUTED1_2(SyncCompositorMsg_SetSharedMemory,
                            content::SyncCompositorSetSharedMemoryParams,
@@ -170,4 +171,4 @@ IPC_MESSAGE_ROUTED1(SyncCompositorHostMsg_UpdateState,
 
 IPC_MESSAGE_ROUTED2(SyncCompositorHostMsg_ReturnFrame,
                     uint32_t /* compositor_frame_sink_id */,
-                    cc::CompositorFrame);
+                    base::Optional<cc::CompositorFrame>);
diff --git a/chromium/content/common/app_web_message_port_messages.h b/chromium/content/common/app_web_message_port_messages.h
new file mode 100644
index 00000000000..145f63b74a3
--- /dev/null
+++ b/chromium/content/common/app_web_message_port_messages.h
@@ -0,0 +1,86 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Multiply-included file, no traditional include guard.
+#include <vector>
+
+#include "content/common/content_export.h"
+#include "ipc/ipc_message_macros.h"
+
+#undef IPC_MESSAGE_EXPORT
+#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
+#define IPC_MESSAGE_START AwMessagePortMsgStart
+
+//-----------------------------------------------------------------------------
+// MessagePort messages
+// These are messages sent from the browser to the renderer process.
+
+// Normally the postmessages are exchanged between the renderers and the message
+// itself is opaque to the browser process. The format of the message is a
+// WebSerializesScriptValue.  A WebSerializedScriptValue is a blink structure
+// and can only be serialized/deserialized in renderer. Further, we could not
+// have Blink or V8 on the browser side due to their relience on static
+// variables.
+//
+// For posting messages from Java (Android apps) to JS, we pass the
+// browser/renderer boundary an extra time and convert the messages to a type
+// that browser can use. Within the current implementation specificications,
+// where we use the main frame on the browser side and it always stays within
+// the same process this is not expensive, but if we can do the conversion at
+// the browser, then we can drop this code.
+
+// Important Note about multi-process situation: In a multi-process scenario,
+// the renderer that does the conversion can be theoretically different then the
+// renderer that receives the message. Although in the current implementation
+// this doesn't become an issue, there are 2 possible solutions to deal with
+// this and make the overall system more robust to future changes:
+// 1. Do the conversion at the browser side by writing a new serializer
+// deserializer for WebSerializedScriptValue
+// 2. Do the conversion at the content layer, at the renderer at the time of
+// receiving the message. This may need adding new flags to indicate that
+// message needs to be converted. However, this is complicated due to queing
+// at the browser side and possibility of ports being shipped to a different
+// renderer or browser delegate.
+
+// Tells the renderer to convert the message from a WebSerializeScript
+// format to a base::ListValue. This IPC is used for messages that are
+// incoming to Android apps from JS.
+IPC_MESSAGE_ROUTED3(AppWebMessagePortMsg_WebToAppMessage,
+                    int /* recipient message port id */,
+                    base::string16 /* message */,
+                    std::vector<int> /* sent message port_ids */)
+
+// Tells the renderer to convert the message from a String16
+// format to a WebSerializedScriptValue. This IPC is used for messages that
+// are outgoing from Android apps to JS.
+// TODO(sgurun) when we start supporting other types, use a ListValue instead
+// of string16
+IPC_MESSAGE_ROUTED3(AppWebMessagePortMsg_AppToWebMessage,
+                    int /* recipient message port id */,
+                    base::string16 /* message */,
+                    std::vector<int> /* sent message port_ids */)
+
+// Used to defer message port closing until after all in-flight messages
+// are flushed from renderer to browser. Renderer piggy-backs the message
+// to browser.
+IPC_MESSAGE_ROUTED1(AppWebMessagePortMsg_ClosePort, int /* message port id */)
+
+//-----------------------------------------------------------------------------
+// These are messages sent from the renderer to the browser process.
+
+// Response to AppWebMessagePortMessage_WebToAppMessage
+IPC_MESSAGE_ROUTED3(AppWebMessagePortHostMsg_ConvertedWebToAppMessage,
+                    int /* recipient message port id */,
+                    base::ListValue /* converted message */,
+                    std::vector<int> /* sent message port_ids */)
+
+// Response to AppWebMessagePortMessage_AppToWebMessage
+IPC_MESSAGE_ROUTED3(AppWebMessagePortHostMsg_ConvertedAppToWebMessage,
+                    int /* recipient message port id */,
+                    base::string16 /* converted message */,
+                    std::vector<int> /* sent message port_ids */)
+
+// Response to AppWebMessagePortMsg_ClosePort
+IPC_MESSAGE_ROUTED1(AppWebMessagePortHostMsg_ClosePortAck,
+                    int /* message port id */)
diff --git a/chromium/content/common/associated_interface_provider_impl.cc b/chromium/content/common/associated_interface_provider_impl.cc
index c42ff3f15e0..3154596fba2 100644
--- a/chromium/content/common/associated_interface_provider_impl.cc
+++ b/chromium/content/common/associated_interface_provider_impl.cc
@@ -3,14 +3,70 @@
 // found in the LICENSE file.
 
 #include "content/common/associated_interface_provider_impl.h"
+#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/binding.h"
 
 namespace content {
 
+class AssociatedInterfaceProviderImpl::LocalProvider
+    : public mojom::RouteProvider,
+      mojom::AssociatedInterfaceProvider {
+ public:
+  explicit LocalProvider(mojom::AssociatedInterfaceProviderAssociatedPtr* proxy)
+      : route_provider_binding_(this),
+        associated_interface_provider_binding_(this) {
+    route_provider_binding_.Bind(mojo::GetProxy(&route_provider_ptr_));
+    route_provider_ptr_->GetRoute(
+        0, mojo::GetProxy(proxy, route_provider_ptr_.associated_group()));
+  }
+
+  ~LocalProvider() override {}
+
+  void SetBinderForName(
+      const std::string& name,
+      const base::Callback<void(mojo::ScopedInterfaceEndpointHandle)>& binder) {
+    binders_[name] = binder;
+  }
+
+ private:
+  // mojom::RouteProvider:
+  void GetRoute(
+      int32_t routing_id,
+      mojom::AssociatedInterfaceProviderAssociatedRequest request) override {
+    DCHECK(request.is_pending());
+    associated_interface_provider_binding_.Bind(std::move(request));
+  }
+
+  // mojom::AssociatedInterfaceProvider:
+  void GetAssociatedInterface(
+      const std::string& name,
+      mojom::AssociatedInterfaceAssociatedRequest request) override {
+    auto it = binders_.find(name);
+    if (it != binders_.end())
+      it->second.Run(request.PassHandle());
+  }
+
+  using BinderMap =
+      std::map<std::string,
+               base::Callback<void(mojo::ScopedInterfaceEndpointHandle)>>;
+  BinderMap binders_;
+
+  mojom::RouteProviderPtr route_provider_ptr_;
+  mojo::Binding<mojom::RouteProvider> route_provider_binding_;
+
+  mojo::AssociatedBinding<mojom::AssociatedInterfaceProvider>
+      associated_interface_provider_binding_;
+};
+
 AssociatedInterfaceProviderImpl::AssociatedInterfaceProviderImpl(
     mojom::AssociatedInterfaceProviderAssociatedPtr proxy)
     : proxy_(std::move(proxy)) {
+  DCHECK(proxy_.is_bound());
 }
 
+AssociatedInterfaceProviderImpl::AssociatedInterfaceProviderImpl()
+    : local_provider_(new LocalProvider(&proxy_)) {}
+
 AssociatedInterfaceProviderImpl::~AssociatedInterfaceProviderImpl() {}
 
 void AssociatedInterfaceProviderImpl::GetInterface(
@@ -25,4 +81,11 @@ mojo::AssociatedGroup* AssociatedInterfaceProviderImpl::GetAssociatedGroup() {
   return proxy_.associated_group();
 }
 
+void AssociatedInterfaceProviderImpl::OverrideBinderForTesting(
+    const std::string& name,
+    const base::Callback<void(mojo::ScopedInterfaceEndpointHandle)>& binder) {
+  DCHECK(local_provider_);
+  local_provider_->SetBinderForName(name, binder);
+}
+
 }  // namespace content
diff --git a/chromium/content/common/associated_interface_provider_impl.h b/chromium/content/common/associated_interface_provider_impl.h
index af01ce55427..32670b2cbff 100644
--- a/chromium/content/common/associated_interface_provider_impl.h
+++ b/chromium/content/common/associated_interface_provider_impl.h
@@ -5,10 +5,10 @@
 #include "content/public/common/associated_interface_provider.h"
 
 #include <stdint.h>
+#include <memory>
 
 #include "base/macros.h"
 #include "content/common/associated_interfaces.mojom.h"
-#include "mojo/public/cpp/bindings/associated_group.h"
 
 namespace content {
 
@@ -17,16 +17,28 @@ class AssociatedInterfaceProviderImpl : public AssociatedInterfaceProvider {
   // Binds this to a remote mojom::AssociatedInterfaceProvider.
   explicit AssociatedInterfaceProviderImpl(
       mojom::AssociatedInterfaceProviderAssociatedPtr proxy);
+  // Constructs a local provider with no remote interfaces. This is useful in
+  // conjunction with OverrideBinderForTesting(), in test environments where
+  // there may not be a remote |mojom::AssociatedInterfaceProvider| available.
+  AssociatedInterfaceProviderImpl();
   ~AssociatedInterfaceProviderImpl() override;
 
   // AssociatedInterfaceProvider:
   void GetInterface(const std::string& name,
                     mojo::ScopedInterfaceEndpointHandle handle) override;
   mojo::AssociatedGroup* GetAssociatedGroup() override;
+  void OverrideBinderForTesting(
+      const std::string& name,
+      const base::Callback<void(mojo::ScopedInterfaceEndpointHandle)>& binder)
+      override;
 
  private:
+  class LocalProvider;
+
   mojom::AssociatedInterfaceProviderAssociatedPtr proxy_;
 
+  std::unique_ptr<LocalProvider> local_provider_;
+
   DISALLOW_COPY_AND_ASSIGN(AssociatedInterfaceProviderImpl);
 };
 
diff --git a/chromium/content/common/browser_plugin/browser_plugin_messages.h b/chromium/content/common/browser_plugin/browser_plugin_messages.h
index ada01838990..81a54d595ed 100644
--- a/chromium/content/common/browser_plugin/browser_plugin_messages.h
+++ b/chromium/content/common/browser_plugin/browser_plugin_messages.h
@@ -162,6 +162,9 @@ IPC_MESSAGE_ROUTED3(BrowserPluginHostMsg_RequireSequence,
 IPC_MESSAGE_CONTROL1(BrowserPluginMsg_GuestGone,
                      int /* browser_plugin_instance_id */)
 
+IPC_MESSAGE_CONTROL1(BrowserPluginMsg_GuestReady,
+                     int /* browser_plugin_instance_id */)
+
 // When the user tabs to the end of the tab stops of a guest, the browser
 // process informs the embedder to tab out of the browser plugin.
 IPC_MESSAGE_CONTROL2(BrowserPluginMsg_AdvanceFocus,
diff --git a/chromium/content/common/cache_storage/cache_storage_messages.h b/chromium/content/common/cache_storage/cache_storage_messages.h
index 82fe7552d6c..80a4ff8a0ef 100644
--- a/chromium/content/common/cache_storage/cache_storage_messages.h
+++ b/chromium/content/common/cache_storage/cache_storage_messages.h
@@ -152,10 +152,6 @@ IPC_MESSAGE_CONTROL3(CacheStorageMsg_CacheStorageDeleteError,
                      int /* thread_id */,
                      int /* request_id */,
                      blink::WebServiceWorkerCacheError /* reason */)
-IPC_MESSAGE_CONTROL3(CacheStorageMsg_CacheStorageKeysError,
-                     int /* thread_id */,
-                     int /* request_id */,
-                     blink::WebServiceWorkerCacheError /* reason */)
 IPC_MESSAGE_CONTROL3(CacheStorageMsg_CacheStorageMatchError,
                      int /* thread_id */,
                      int /* request_id */,
diff --git a/chromium/content/common/child_process_host_impl.cc b/chromium/content/common/child_process_host_impl.cc
index 23c339f2aa1..12bd1c328d8 100644
--- a/chromium/content/common/child_process_host_impl.cc
+++ b/chromium/content/common/child_process_host_impl.cc
@@ -27,15 +27,13 @@
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
 #include "gpu/ipc/client/gpu_memory_buffer_impl_shared_memory.h"
-#include "ipc/attachment_broker.h"
-#include "ipc/attachment_broker_privileged.h"
 #include "ipc/ipc.mojom.h"
 #include "ipc/ipc_channel.h"
 #include "ipc/ipc_channel_mojo.h"
 #include "ipc/ipc_logging.h"
 #include "ipc/message_filter.h"
 #include "mojo/edk/embedder/embedder.h"
-#include "services/shell/public/cpp/interface_provider.h"
+#include "services/service_manager/public/cpp/interface_provider.h"
 
 #if defined(OS_LINUX)
 #include "base/linux_util.h"
@@ -92,19 +90,6 @@ ChildProcessHostImpl::ChildProcessHostImpl(ChildProcessHostDelegate* delegate)
 #if defined(OS_WIN)
   AddFilter(new FontCacheDispatcher());
 #endif
-
-#if USE_ATTACHMENT_BROKER
-#if defined(OS_MACOSX)
-  // On Mac, the privileged AttachmentBroker needs a reference to the Mach port
-  // Provider, which is only available in the chrome/ module. The attachment
-  // broker must already be created.
-  DCHECK(IPC::AttachmentBroker::GetGlobal());
-#else
-  // Construct the privileged attachment broker early in the life cycle of a
-  // child process.
-  IPC::AttachmentBrokerPrivileged::CreateBrokerIfNeeded();
-#endif  // defined(OS_MACOSX)
-#endif  // USE_ATTACHMENT_BROKER
 }
 
 ChildProcessHostImpl::~ChildProcessHostImpl() {
@@ -114,10 +99,6 @@ ChildProcessHostImpl::~ChildProcessHostImpl() {
   if (!channel_)
     return;
 
-#if USE_ATTACHMENT_BROKER
-  IPC::AttachmentBroker::GetGlobal()->DeregisterCommunicationChannel(
-      channel_.get());
-#endif
   for (size_t i = 0; i < filters_.size(); ++i) {
     filters_[i]->OnChannelClosing();
     filters_[i]->OnFilterRemoved();
@@ -131,7 +112,8 @@ void ChildProcessHostImpl::AddFilter(IPC::MessageFilter* filter) {
     filter->OnFilterAdded(channel_.get());
 }
 
-shell::InterfaceProvider* ChildProcessHostImpl::GetRemoteInterfaces() {
+service_manager::InterfaceProvider*
+ChildProcessHostImpl::GetRemoteInterfaces() {
   return delegate_->GetRemoteInterfaces();
 }
 
@@ -160,7 +142,7 @@ void ChildProcessHostImpl::CreateChannelMojo() {
   DCHECK(channel_id_.empty());
   channel_id_ = "ChannelMojo";
 
-  shell::InterfaceProvider* remote_interfaces = GetRemoteInterfaces();
+  service_manager::InterfaceProvider* remote_interfaces = GetRemoteInterfaces();
   DCHECK(remote_interfaces);
 
   IPC::mojom::ChannelBootstrapPtr bootstrap;
@@ -174,18 +156,8 @@ void ChildProcessHostImpl::CreateChannelMojo() {
 }
 
 bool ChildProcessHostImpl::InitChannel() {
-#if USE_ATTACHMENT_BROKER
-  DCHECK(base::MessageLoopForIO::IsCurrent());
-  IPC::AttachmentBroker::GetGlobal()->RegisterCommunicationChannel(
-      channel_.get(), base::ThreadTaskRunnerHandle::Get());
-#endif
-  if (!channel_->Connect()) {
-#if USE_ATTACHMENT_BROKER
-    IPC::AttachmentBroker::GetGlobal()->DeregisterCommunicationChannel(
-        channel_.get());
-#endif
+  if (!channel_->Connect())
     return false;
-  }
 
   for (size_t i = 0; i < filters_.size(); ++i)
     filters_[i]->OnFilterAdded(channel_.get());
@@ -205,12 +177,6 @@ bool ChildProcessHostImpl::IsChannelOpening() {
   return opening_channel_;
 }
 
-#if defined(OS_POSIX)
-base::ScopedFD ChildProcessHostImpl::TakeClientFileDescriptor() {
-  return channel_->TakeClientFileDescriptor();
-}
-#endif
-
 bool ChildProcessHostImpl::Send(IPC::Message* message) {
   if (!channel_) {
     delete message;
@@ -219,18 +185,6 @@ bool ChildProcessHostImpl::Send(IPC::Message* message) {
   return channel_->Send(message);
 }
 
-void ChildProcessHostImpl::AllocateSharedMemory(
-      size_t buffer_size, base::ProcessHandle child_process_handle,
-      base::SharedMemoryHandle* shared_memory_handle) {
-  base::SharedMemory shared_buf;
-  if (!shared_buf.CreateAnonymous(buffer_size)) {
-    *shared_memory_handle = base::SharedMemory::NULLHandle();
-    NOTREACHED() << "Cannot create shared memory buffer";
-    return;
-  }
-  shared_buf.GiveToProcess(child_process_handle, shared_memory_handle);
-}
-
 int ChildProcessHostImpl::GenerateChildProcessUniqueId() {
   // This function must be threadsafe.
   //
@@ -289,12 +243,9 @@ bool ChildProcessHostImpl::OnMessageReceived(const IPC::Message& msg) {
     IPC_BEGIN_MESSAGE_MAP(ChildProcessHostImpl, msg)
       IPC_MESSAGE_HANDLER(ChildProcessHostMsg_ShutdownRequest,
                           OnShutdownRequest)
-      // NB: The SyncAllocateSharedMemory, SyncAllocateGpuMemoryBuffer, and
-      // DeletedGpuMemoryBuffer IPCs are handled here for non-renderer child
-      // processes. For renderer processes, they are handled in
-      // RenderMessageFilter.
-      IPC_MESSAGE_HANDLER(ChildProcessHostMsg_SyncAllocateSharedMemory,
-                          OnAllocateSharedMemory)
+      // NB: The SyncAllocateGpuMemoryBuffer and DeletedGpuMemoryBuffer IPCs are
+      // handled here for non-renderer child processes. For renderer processes,
+      // they are handled in RenderMessageFilter.
       IPC_MESSAGE_HANDLER(ChildProcessHostMsg_SyncAllocateGpuMemoryBuffer,
                           OnAllocateGpuMemoryBuffer)
       IPC_MESSAGE_HANDLER(ChildProcessHostMsg_DeletedGpuMemoryBuffer,
@@ -308,7 +259,7 @@ bool ChildProcessHostImpl::OnMessageReceived(const IPC::Message& msg) {
 
 #ifdef IPC_MESSAGE_LOG_ENABLED
   if (logger->Enabled())
-    logger->OnPostDispatchMessage(msg, channel_id_);
+    logger->OnPostDispatchMessage(msg);
 #endif
   return handled;
 }
@@ -341,12 +292,6 @@ void ChildProcessHostImpl::OnBadMessageReceived(const IPC::Message& message) {
   delegate_->OnBadMessageReceived(message);
 }
 
-void ChildProcessHostImpl::OnAllocateSharedMemory(
-    uint32_t buffer_size,
-    base::SharedMemoryHandle* handle) {
-  AllocateSharedMemory(buffer_size, peer_process_.Handle(), handle);
-}
-
 void ChildProcessHostImpl::OnShutdownRequest() {
   if (delegate_->CanShutdown())
     Send(new ChildProcessMsg_Shutdown());
@@ -366,7 +311,7 @@ void ChildProcessHostImpl::OnAllocateGpuMemoryBuffer(
   // sure |usage| is supported here.
   if (gpu::GpuMemoryBufferImplSharedMemory::IsUsageSupported(usage)) {
     *handle = gpu::GpuMemoryBufferImplSharedMemory::AllocateForChildProcess(
-        id, gfx::Size(width, height), format, peer_process_.Handle());
+        id, gfx::Size(width, height), format);
   }
 }
 
diff --git a/chromium/content/common/child_process_host_impl.h b/chromium/content/common/child_process_host_impl.h
index f1734f2075e..1576489acb9 100644
--- a/chromium/content/common/child_process_host_impl.h
+++ b/chromium/content/common/child_process_host_impl.h
@@ -22,10 +22,6 @@
 #include "ipc/ipc_listener.h"
 #include "ui/gfx/gpu_memory_buffer.h"
 
-namespace base {
-class FilePath;
-}
-
 namespace IPC {
 class MessageFilter;
 }
@@ -45,11 +41,6 @@ class CONTENT_EXPORT ChildProcessHostImpl : public ChildProcessHost,
  public:
   ~ChildProcessHostImpl() override;
 
-  // Public and static for reuse by RenderMessageFilter.
-  static void AllocateSharedMemory(
-      size_t buffer_size, base::ProcessHandle child_process,
-      base::SharedMemoryHandle* handle);
-
   // Returns a unique ID to identify a child process. On construction, this
   // function will be used to generate the id_, but it is also used to generate
   // IDs for the RenderProcessHost, which doesn't inherit from us, and whose IDs
@@ -82,10 +73,7 @@ class CONTENT_EXPORT ChildProcessHostImpl : public ChildProcessHost,
   void CreateChannelMojo() override;
   bool IsChannelOpening() override;
   void AddFilter(IPC::MessageFilter* filter) override;
-  shell::InterfaceProvider* GetRemoteInterfaces() override;
-#if defined(OS_POSIX)
-  base::ScopedFD TakeClientFileDescriptor() override;
-#endif
+  service_manager::InterfaceProvider* GetRemoteInterfaces() override;
 
  private:
   friend class ChildProcessHost;
@@ -100,8 +88,6 @@ class CONTENT_EXPORT ChildProcessHostImpl : public ChildProcessHost,
 
   // Message handlers:
   void OnShutdownRequest();
-  void OnAllocateSharedMemory(uint32_t buffer_size,
-                              base::SharedMemoryHandle* handle);
   void OnAllocateGpuMemoryBuffer(gfx::GpuMemoryBufferId id,
                                  uint32_t width,
                                  uint32_t height,
diff --git a/chromium/content/common/child_process_messages.h b/chromium/content/common/child_process_messages.h
index a3c48897e71..fefc94fcfc6 100644
--- a/chromium/content/common/child_process_messages.h
+++ b/chromium/content/common/child_process_messages.h
@@ -15,9 +15,9 @@
 #include "base/values.h"
 #include "build/build_config.h"
 #include "cc/resources/shared_bitmap_manager.h"
+#include "components/discardable_memory/common/discardable_shared_memory_id.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits_macros.h"
-#include "content/common/host_discardable_shared_memory_manager.h"
 #include "gpu/command_buffer/common/sync_token.h"
 #include "gpu/ipc/common/gpu_param_traits_macros.h"
 #include "ipc/ipc_channel_handle.h"
@@ -126,6 +126,9 @@ IPC_MESSAGE_CONTROL1(ChildProcessMsg_SetProcessBackgrounded,
 // Sent to child processes to tell them to purge and suspend.
 IPC_MESSAGE_CONTROL0(ChildProcessMsg_PurgeAndSuspend)
 
+// Sent to child processes to tell them to resume from suspended mode.
+IPC_MESSAGE_CONTROL0(ChildProcessMsg_Resume)
+
 ////////////////////////////////////////////////////////////////////////////////
 // Messages sent from the child process to the browser.
 
@@ -173,12 +176,6 @@ IPC_MESSAGE_CONTROL0(ChildProcessHostMsg_ReleaseCachedFonts)
 
 // Asks the browser to create a block of shared memory for the child process to
 // fill in and pass back to the browser.
-IPC_SYNC_MESSAGE_CONTROL1_1(ChildProcessHostMsg_SyncAllocateSharedMemory,
-                            uint32_t /* buffer size */,
-                            base::SharedMemoryHandle)
-
-// Asks the browser to create a block of shared memory for the child process to
-// fill in and pass back to the browser.
 IPC_SYNC_MESSAGE_CONTROL2_1(ChildProcessHostMsg_SyncAllocateSharedBitmap,
                             uint32_t /* buffer size */,
                             cc::SharedBitmapId,
@@ -213,13 +210,13 @@ IPC_MESSAGE_CONTROL2(ChildProcessHostMsg_DeletedGpuMemoryBuffer,
 IPC_SYNC_MESSAGE_CONTROL2_1(
     ChildProcessHostMsg_SyncAllocateLockedDiscardableSharedMemory,
     uint32_t /* size */,
-    content::DiscardableSharedMemoryId,
+    discardable_memory::DiscardableSharedMemoryId,
     base::SharedMemoryHandle)
 
 // Informs the browser that the child deleted a block of discardable shared
 // memory.
 IPC_MESSAGE_CONTROL1(ChildProcessHostMsg_DeletedDiscardableSharedMemory,
-                     content::DiscardableSharedMemoryId)
+                     discardable_memory::DiscardableSharedMemoryId)
 
 #if defined(OS_LINUX)
 // Asks the browser to change the priority of thread.
diff --git a/chromium/content/common/clipboard_messages.h b/chromium/content/common/clipboard_messages.h
index 07519ec9799..f026d7c27aa 100644
--- a/chromium/content/common/clipboard_messages.h
+++ b/chromium/content/common/clipboard_messages.h
@@ -19,6 +19,7 @@
 #include "ipc/ipc_message_macros.h"
 #include "ipc/param_traits_macros.h"
 #include "ui/base/clipboard/clipboard.h"
+#include "ui/gfx/geometry/size.h"
 #include "url/ipc/url_param_traits.h"
 
 // Singly-included section for types and/or struct declarations.
diff --git a/chromium/content/common/content_message_generator.h b/chromium/content/common/content_message_generator.h
index de63cc92f8c..f81cc3106a3 100644
--- a/chromium/content/common/content_message_generator.h
+++ b/chromium/content/common/content_message_generator.h
@@ -28,19 +28,15 @@
 #include "content/common/manifest_manager_messages.h"
 #include "content/common/media/aec_dump_messages.h"
 #include "content/common/media/audio_messages.h"
-// TODO(xhwang): Move this to a new ifdef block.
-#include "content/common/media/cdm_messages.h"
 #include "content/common/media/media_player_delegate_messages.h"
 #include "content/common/media/media_stream_messages.h"
 #include "content/common/media/media_stream_track_metrics_host_messages.h"
 #include "content/common/media/midi_messages.h"
 #include "content/common/media/peer_connection_tracker_messages.h"
-#include "content/common/media/video_capture_messages.h"
 #include "content/common/memory_messages.h"
 #include "content/common/message_port_messages.h"
 #include "content/common/page_messages.h"
 #include "content/common/platform_notification_messages.h"
-#include "content/common/power_monitor_messages.h"
 #include "content/common/push_messaging_messages.h"
 #include "content/common/quota_messages.h"
 #include "content/common/render_process_messages.h"
@@ -60,6 +56,7 @@
 
 #if defined(OS_ANDROID)
 #include "content/common/android/sync_compositor_messages.h"
+#include "content/common/app_web_message_port_messages.h"
 #include "content/common/gin_java_bridge_messages.h"
 #include "content/common/media/media_player_messages_android.h"
 #include "content/common/media/surface_view_manager_messages_android.h"
diff --git a/chromium/content/common/content_param_traits.h b/chromium/content/common/content_param_traits.h
index 660c291a56a..5ce29da7645 100644
--- a/chromium/content/common/content_param_traits.h
+++ b/chromium/content/common/content_param_traits.h
@@ -16,11 +16,7 @@
 
 #include "content/common/content_param_traits_macros.h"
 #include "content/common/cursors/webcursor.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
-
-namespace net {
-class IPEndPoint;
-}
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 
 namespace IPC {
 
diff --git a/chromium/content/common/content_param_traits_macros.h b/chromium/content/common/content_param_traits_macros.h
index f7521f08395..40767e92763 100644
--- a/chromium/content/common/content_param_traits_macros.h
+++ b/chromium/content/common/content_param_traits_macros.h
@@ -15,10 +15,10 @@
 #include "content/public/common/resource_type.h"
 #include "ipc/ipc_message_macros.h"
 #include "third_party/WebKit/public/platform/WebAddressSpace.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "third_party/WebKit/public/platform/WebPageVisibilityState.h"
 #include "third_party/WebKit/public/web/WebCompositionUnderline.h"
 #include "third_party/WebKit/public/web/WebContentSecurityPolicy.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "third_party/WebKit/public/web/WebSharedWorkerCreationContextType.h"
 #include "ui/gfx/gpu_memory_buffer.h"
 
diff --git a/chromium/content/common/content_switches_internal.cc b/chromium/content/common/content_switches_internal.cc
index c0f0cc6550f..105a9d19320 100644
--- a/chromium/content/common/content_switches_internal.cc
+++ b/chromium/content/common/content_switches_internal.cc
@@ -36,6 +36,12 @@ bool IsUseZoomForDSFEnabledByDefault() {
 #endif
 }
 
+#if defined(ANDROID)
+const base::Feature kProgressBarCompletionResourcesBeforeDOMContentLoaded {
+    "progress-bar-completion-resources-before-domContentLoaded",
+    base::FEATURE_DISABLED_BY_DEFAULT};
+#endif
+
 }  // namespace
 
 bool IsPinchToZoomEnabled() {
@@ -48,11 +54,11 @@ bool IsPinchToZoomEnabled() {
 
 #if defined(OS_WIN)
 
-bool IsWin32kRendererLockdownEnabled() {
+bool IsWin32kLockdownEnabled() {
   if (base::win::GetVersion() < base::win::VERSION_WIN8)
     return false;
   const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
-  if (cmd_line->HasSwitch(switches::kDisableWin32kRendererLockDown))
+  if (cmd_line->HasSwitch(switches::kDisableWin32kLockDown))
     return false;
   return true;
 }
@@ -106,6 +112,12 @@ ProgressBarCompletion GetProgressBarCompletionPolicy() {
       "resourcesBeforeDOMContentLoadedAndSameOriginIframes") {
     return ProgressBarCompletion::RESOURCES_BEFORE_DCL_AND_SAME_ORIGIN_IFRAMES;
   }
+  // The command line, which is set by the user, takes priority. Otherwise,
+  // fall back to the feature flag.
+  if (base::FeatureList::IsEnabled(
+          kProgressBarCompletionResourcesBeforeDOMContentLoaded)) {
+    return ProgressBarCompletion::RESOURCES_BEFORE_DCL;
+  }
 #endif
   return ProgressBarCompletion::LOAD_EVENT;
 }
diff --git a/chromium/content/common/content_switches_internal.h b/chromium/content/common/content_switches_internal.h
index f1ddb19d4dc..024a4d7efcb 100644
--- a/chromium/content/common/content_switches_internal.h
+++ b/chromium/content/common/content_switches_internal.h
@@ -13,8 +13,8 @@ namespace content {
 
 bool IsPinchToZoomEnabled();
 #if defined(OS_WIN)
-// Returns whether Win32k Renderer lockdown is enabled or not.
-bool IsWin32kRendererLockdownEnabled();
+// Returns whether Win32k lockdown is enabled for child processes or not.
+bool IsWin32kLockdownEnabled();
 #endif
 V8CacheOptions GetV8CacheOptions();
 
diff --git a/chromium/content/common/device_sensors/OWNERS b/chromium/content/common/device_sensors/OWNERS
deleted file mode 100644
index 0a33f44f91a..00000000000
--- a/chromium/content/common/device_sensors/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-per-file *_hardware_buffer*.h=timvolodine@chromium.org
diff --git a/chromium/content/common/device_sensors/device_light_data.h b/chromium/content/common/device_sensors/device_light_data.h
deleted file mode 100644
index 08140566826..00000000000
--- a/chromium/content/common/device_sensors/device_light_data.h
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_DEVICE_SENSORS_DEVICE_LIGHT_DATA_H_
-#define CONTENT_COMMON_DEVICE_SENSORS_DEVICE_LIGHT_DATA_H_
-
-#include "content/common/content_export.h"
-
-namespace content {
-
-// This struct is intentionally POD and fixed size so that it can be stored
-// in shared memory between the browser and the renderer processes.
-// POD class should be a struct, should have an inline cstor that uses
-// initializer lists and no dstor.
-struct DeviceLightData {
-  DeviceLightData() : value(-1) {}
-  double value;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_DEVICE_SENSORS_DEVICE_LIGHT_DATA_H_
diff --git a/chromium/content/common/device_sensors/device_light_hardware_buffer.h b/chromium/content/common/device_sensors/device_light_hardware_buffer.h
deleted file mode 100644
index 1664af0cdb5..00000000000
--- a/chromium/content/common/device_sensors/device_light_hardware_buffer.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_DEVICE_SENSORS_DEVICE_LIGHT_HARDWARE_BUFFER_H_
-#define CONTENT_COMMON_DEVICE_SENSORS_DEVICE_LIGHT_HARDWARE_BUFFER_H_
-
-#include "content/common/device_sensors/device_light_data.h"
-#include "device/base/synchronization/shared_memory_seqlock_buffer.h"
-
-namespace content {
-
-typedef device::SharedMemorySeqLockBuffer<DeviceLightData>
-    DeviceLightHardwareBuffer;
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_DEVICE_SENSORS_DEVICE_LIGHT_HARDWARE_BUFFER_H_
diff --git a/chromium/content/common/device_sensors/device_motion_hardware_buffer.h b/chromium/content/common/device_sensors/device_motion_hardware_buffer.h
deleted file mode 100644
index ea49290ba86..00000000000
--- a/chromium/content/common/device_sensors/device_motion_hardware_buffer.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_DEVICE_SENSORS_DEVICE_MOTION_HARDWARE_BUFFER_H_
-#define CONTENT_COMMON_DEVICE_SENSORS_DEVICE_MOTION_HARDWARE_BUFFER_H_
-
-#include "device/base/synchronization/shared_memory_seqlock_buffer.h"
-#include "third_party/WebKit/public/platform/modules/device_orientation/WebDeviceMotionData.h"
-
-namespace content {
-
-typedef device::SharedMemorySeqLockBuffer<blink::WebDeviceMotionData>
-    DeviceMotionHardwareBuffer;
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_DEVICE_SENSORS_DEVICE_MOTION_HARDWARE_BUFFER_H_
diff --git a/chromium/content/common/device_sensors/device_orientation_hardware_buffer.h b/chromium/content/common/device_sensors/device_orientation_hardware_buffer.h
deleted file mode 100644
index 66c6fdc4411..00000000000
--- a/chromium/content/common/device_sensors/device_orientation_hardware_buffer.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_DEVICE_SENSORS_DEVICE_ORIENTATION_HARDWARE_BUFFER_H_
-#define CONTENT_COMMON_DEVICE_SENSORS_DEVICE_ORIENTATION_HARDWARE_BUFFER_H_
-
-#include "device/base/synchronization/shared_memory_seqlock_buffer.h"
-#include "third_party/WebKit/public/platform/modules/device_orientation/WebDeviceOrientationData.h"
-
-namespace content {
-
-typedef device::SharedMemorySeqLockBuffer<blink::WebDeviceOrientationData>
-    DeviceOrientationHardwareBuffer;
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_DEVICE_SENSORS_DEVICE_ORIENTATION_HARDWARE_BUFFER_H_
diff --git a/chromium/content/common/discardable_shared_memory_heap.cc b/chromium/content/common/discardable_shared_memory_heap.cc
deleted file mode 100644
index b6559af4c10..00000000000
--- a/chromium/content/common/discardable_shared_memory_heap.cc
+++ /dev/null
@@ -1,477 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/discardable_shared_memory_heap.h"
-
-#include <algorithm>
-#include <utility>
-
-#include "base/format_macros.h"
-#include "base/macros.h"
-#include "base/memory/discardable_shared_memory.h"
-#include "base/memory/ptr_util.h"
-#include "base/strings/stringprintf.h"
-#include "base/trace_event/memory_dump_manager.h"
-
-namespace content {
-namespace {
-
-bool IsPowerOfTwo(size_t x) {
-  return (x & (x - 1)) == 0;
-}
-
-bool IsInFreeList(DiscardableSharedMemoryHeap::Span* span) {
-  return span->previous() || span->next();
-}
-
-}  // namespace
-
-DiscardableSharedMemoryHeap::Span::Span(
-    base::DiscardableSharedMemory* shared_memory,
-    size_t start,
-    size_t length)
-    : shared_memory_(shared_memory),
-      start_(start),
-      length_(length),
-      is_locked_(false) {}
-
-DiscardableSharedMemoryHeap::Span::~Span() {
-}
-
-DiscardableSharedMemoryHeap::ScopedMemorySegment::ScopedMemorySegment(
-    DiscardableSharedMemoryHeap* heap,
-    std::unique_ptr<base::DiscardableSharedMemory> shared_memory,
-    size_t size,
-    int32_t id,
-    const base::Closure& deleted_callback)
-    : heap_(heap),
-      shared_memory_(std::move(shared_memory)),
-      size_(size),
-      id_(id),
-      deleted_callback_(deleted_callback) {}
-
-DiscardableSharedMemoryHeap::ScopedMemorySegment::~ScopedMemorySegment() {
-  heap_->ReleaseMemory(shared_memory_.get(), size_);
-  deleted_callback_.Run();
-}
-
-bool DiscardableSharedMemoryHeap::ScopedMemorySegment::IsUsed() const {
-  return heap_->IsMemoryUsed(shared_memory_.get(), size_);
-}
-
-bool DiscardableSharedMemoryHeap::ScopedMemorySegment::IsResident() const {
-  return heap_->IsMemoryResident(shared_memory_.get());
-}
-
-bool DiscardableSharedMemoryHeap::ScopedMemorySegment::ContainsSpan(
-    Span* span) const {
-  return shared_memory_.get() == span->shared_memory();
-}
-
-base::trace_event::MemoryAllocatorDump*
-DiscardableSharedMemoryHeap::ScopedMemorySegment::CreateMemoryAllocatorDump(
-    Span* span,
-    size_t block_size,
-    const char* name,
-    base::trace_event::ProcessMemoryDump* pmd) const {
-  DCHECK_EQ(shared_memory_.get(), span->shared_memory());
-  base::trace_event::MemoryAllocatorDump* dump = pmd->CreateAllocatorDump(name);
-  dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
-                  base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                  static_cast<uint64_t>(span->length() * block_size));
-
-  pmd->AddSuballocation(
-      dump->guid(),
-      base::StringPrintf("discardable/segment_%d/allocated_objects", id_));
-  return dump;
-}
-
-void DiscardableSharedMemoryHeap::ScopedMemorySegment::OnMemoryDump(
-    base::trace_event::ProcessMemoryDump* pmd) const {
-  heap_->OnMemoryDump(shared_memory_.get(), size_, id_, pmd);
-}
-
-DiscardableSharedMemoryHeap::DiscardableSharedMemoryHeap(size_t block_size)
-    : block_size_(block_size), num_blocks_(0), num_free_blocks_(0) {
-  DCHECK_NE(block_size_, 0u);
-  DCHECK(IsPowerOfTwo(block_size_));
-}
-
-DiscardableSharedMemoryHeap::~DiscardableSharedMemoryHeap() {
-  memory_segments_.clear();
-  DCHECK_EQ(num_blocks_, 0u);
-  DCHECK_EQ(num_free_blocks_, 0u);
-  DCHECK_EQ(std::count_if(free_spans_, free_spans_ + arraysize(free_spans_),
-                          [](const base::LinkedList<Span>& free_spans) {
-                            return !free_spans.empty();
-                          }),
-            0);
-}
-
-std::unique_ptr<DiscardableSharedMemoryHeap::Span>
-DiscardableSharedMemoryHeap::Grow(
-    std::unique_ptr<base::DiscardableSharedMemory> shared_memory,
-    size_t size,
-    int32_t id,
-    const base::Closure& deleted_callback) {
-  // Memory must be aligned to block size.
-  DCHECK_EQ(
-      reinterpret_cast<size_t>(shared_memory->memory()) & (block_size_ - 1),
-      0u);
-  DCHECK_EQ(size & (block_size_ - 1), 0u);
-
-  std::unique_ptr<Span> span(
-      new Span(shared_memory.get(),
-               reinterpret_cast<size_t>(shared_memory->memory()) / block_size_,
-               size / block_size_));
-  DCHECK(spans_.find(span->start_) == spans_.end());
-  DCHECK(spans_.find(span->start_ + span->length_ - 1) == spans_.end());
-  RegisterSpan(span.get());
-
-  num_blocks_ += span->length_;
-
-  // Start tracking if segment is resident by adding it to |memory_segments_|.
-  memory_segments_.push_back(new ScopedMemorySegment(
-      this, std::move(shared_memory), size, id, deleted_callback));
-
-  return span;
-}
-
-void DiscardableSharedMemoryHeap::MergeIntoFreeLists(
-    std::unique_ptr<Span> span) {
-  DCHECK(span->shared_memory_);
-
-  // First add length of |span| to |num_free_blocks_|.
-  num_free_blocks_ += span->length_;
-
-  // Merge with previous span if possible.
-  SpanMap::iterator prev_it = spans_.find(span->start_ - 1);
-  if (prev_it != spans_.end() && IsInFreeList(prev_it->second)) {
-    std::unique_ptr<Span> prev = RemoveFromFreeList(prev_it->second);
-    DCHECK_EQ(prev->start_ + prev->length_, span->start_);
-    UnregisterSpan(prev.get());
-    if (span->length_ > 1)
-      spans_.erase(span->start_);
-    span->start_ -= prev->length_;
-    span->length_ += prev->length_;
-    spans_[span->start_] = span.get();
-  }
-
-  // Merge with next span if possible.
-  SpanMap::iterator next_it = spans_.find(span->start_ + span->length_);
-  if (next_it != spans_.end() && IsInFreeList(next_it->second)) {
-    std::unique_ptr<Span> next = RemoveFromFreeList(next_it->second);
-    DCHECK_EQ(next->start_, span->start_ + span->length_);
-    UnregisterSpan(next.get());
-    if (span->length_ > 1)
-      spans_.erase(span->start_ + span->length_ - 1);
-    span->length_ += next->length_;
-    spans_[span->start_ + span->length_ - 1] = span.get();
-  }
-
-  InsertIntoFreeList(std::move(span));
-}
-
-std::unique_ptr<DiscardableSharedMemoryHeap::Span>
-DiscardableSharedMemoryHeap::Split(Span* span, size_t blocks) {
-  DCHECK(blocks);
-  DCHECK_LT(blocks, span->length_);
-
-  std::unique_ptr<Span> leftover(new Span(
-      span->shared_memory_, span->start_ + blocks, span->length_ - blocks));
-  DCHECK(leftover->length_ == 1 ||
-         spans_.find(leftover->start_) == spans_.end());
-  RegisterSpan(leftover.get());
-  spans_[span->start_ + blocks - 1] = span;
-  span->length_ = blocks;
-  return leftover;
-}
-
-std::unique_ptr<DiscardableSharedMemoryHeap::Span>
-DiscardableSharedMemoryHeap::SearchFreeLists(size_t blocks, size_t slack) {
-  DCHECK(blocks);
-
-  size_t length = blocks;
-  size_t max_length = blocks + slack;
-
-  // Search array of free lists for a suitable span.
-  while (length - 1 < arraysize(free_spans_) - 1) {
-    const base::LinkedList<Span>& free_spans = free_spans_[length - 1];
-    if (!free_spans.empty()) {
-      // Return the most recently used span located in tail.
-      return Carve(free_spans.tail()->value(), blocks);
-    }
-
-    // Return early after surpassing |max_length|.
-    if (++length > max_length)
-      return nullptr;
-  }
-
-  const base::LinkedList<Span>& overflow_free_spans =
-      free_spans_[arraysize(free_spans_) - 1];
-
-  // Search overflow free list for a suitable span. Starting with the most
-  // recently used span located in tail and moving towards head.
-  for (base::LinkNode<Span>* node = overflow_free_spans.tail();
-       node != overflow_free_spans.end(); node = node->previous()) {
-    Span* span = node->value();
-    if (span->length_ >= blocks && span->length_ <= max_length)
-      return Carve(span, blocks);
-  }
-
-  return nullptr;
-}
-
-void DiscardableSharedMemoryHeap::ReleaseFreeMemory() {
-  // Erase all free segments after rearranging the segments in such a way
-  // that used segments precede all free segments.
-  memory_segments_.erase(
-      std::partition(
-          memory_segments_.begin(), memory_segments_.end(),
-          [](const ScopedMemorySegment* segment) { return segment->IsUsed(); }),
-      memory_segments_.end());
-}
-
-void DiscardableSharedMemoryHeap::ReleasePurgedMemory() {
-  // Erase all purged segments after rearranging the segments in such a way
-  // that resident segments precede all purged segments.
-  memory_segments_.erase(
-      std::partition(memory_segments_.begin(), memory_segments_.end(),
-                     [](const ScopedMemorySegment* segment) {
-                       return segment->IsResident();
-                     }),
-      memory_segments_.end());
-}
-
-size_t DiscardableSharedMemoryHeap::GetSize() const {
-  return num_blocks_ * block_size_;
-}
-
-size_t DiscardableSharedMemoryHeap::GetSizeOfFreeLists() const {
-  return num_free_blocks_ * block_size_;
-}
-
-bool DiscardableSharedMemoryHeap::OnMemoryDump(
-    base::trace_event::ProcessMemoryDump* pmd) {
-  std::for_each(
-      memory_segments_.begin(), memory_segments_.end(),
-      [pmd](const ScopedMemorySegment* segment) {
-        segment->OnMemoryDump(pmd);
-      });
-  return true;
-}
-
-void DiscardableSharedMemoryHeap::InsertIntoFreeList(
-    std::unique_ptr<DiscardableSharedMemoryHeap::Span> span) {
-  DCHECK(!IsInFreeList(span.get()));
-  size_t index = std::min(span->length_, arraysize(free_spans_)) - 1;
-  free_spans_[index].Append(span.release());
-}
-
-std::unique_ptr<DiscardableSharedMemoryHeap::Span>
-DiscardableSharedMemoryHeap::RemoveFromFreeList(Span* span) {
-  DCHECK(IsInFreeList(span));
-  span->RemoveFromList();
-  return base::WrapUnique(span);
-}
-
-std::unique_ptr<DiscardableSharedMemoryHeap::Span>
-DiscardableSharedMemoryHeap::Carve(Span* span, size_t blocks) {
-  std::unique_ptr<Span> serving = RemoveFromFreeList(span);
-
-  const int extra = serving->length_ - blocks;
-  if (extra) {
-    std::unique_ptr<Span> leftover(
-        new Span(serving->shared_memory_, serving->start_ + blocks, extra));
-    leftover->set_is_locked(false);
-    DCHECK(extra == 1 || spans_.find(leftover->start_) == spans_.end());
-    RegisterSpan(leftover.get());
-
-    // No need to coalesce as the previous span of |leftover| was just split
-    // and the next span of |leftover| was not previously coalesced with
-    // |span|.
-    InsertIntoFreeList(std::move(leftover));
-
-    serving->length_ = blocks;
-    spans_[serving->start_ + blocks - 1] = serving.get();
-  }
-
-  // |serving| is no longer in the free list, remove its length from
-  // |num_free_blocks_|.
-  DCHECK_GE(num_free_blocks_, serving->length_);
-  num_free_blocks_ -= serving->length_;
-
-  return serving;
-}
-
-void DiscardableSharedMemoryHeap::RegisterSpan(Span* span) {
-  spans_[span->start_] = span;
-  if (span->length_ > 1)
-    spans_[span->start_ + span->length_ - 1] = span;
-}
-
-void DiscardableSharedMemoryHeap::UnregisterSpan(Span* span) {
-  DCHECK(spans_.find(span->start_) != spans_.end());
-  DCHECK_EQ(spans_[span->start_], span);
-  spans_.erase(span->start_);
-  if (span->length_ > 1) {
-    DCHECK(spans_.find(span->start_ + span->length_ - 1) != spans_.end());
-    DCHECK_EQ(spans_[span->start_ + span->length_ - 1], span);
-    spans_.erase(span->start_ + span->length_ - 1);
-  }
-}
-
-bool DiscardableSharedMemoryHeap::IsMemoryUsed(
-    const base::DiscardableSharedMemory* shared_memory,
-    size_t size) {
-  size_t offset =
-      reinterpret_cast<size_t>(shared_memory->memory()) / block_size_;
-  size_t length = size / block_size_;
-  DCHECK(spans_.find(offset) != spans_.end());
-  Span* span = spans_[offset];
-  DCHECK_LE(span->length_, length);
-  // Memory is used if first span is not in free list or shorter than segment.
-  return !IsInFreeList(span) || span->length_ != length;
-}
-
-bool DiscardableSharedMemoryHeap::IsMemoryResident(
-    const base::DiscardableSharedMemory* shared_memory) {
-  return shared_memory->IsMemoryResident();
-}
-
-void DiscardableSharedMemoryHeap::ReleaseMemory(
-    const base::DiscardableSharedMemory* shared_memory,
-    size_t size) {
-  size_t offset =
-      reinterpret_cast<size_t>(shared_memory->memory()) / block_size_;
-  size_t end = offset + size / block_size_;
-  while (offset < end) {
-    DCHECK(spans_.find(offset) != spans_.end());
-    Span* span = spans_[offset];
-    DCHECK_EQ(span->shared_memory_, shared_memory);
-    span->shared_memory_ = nullptr;
-    UnregisterSpan(span);
-
-    offset += span->length_;
-
-    DCHECK_GE(num_blocks_, span->length_);
-    num_blocks_ -= span->length_;
-
-    // If |span| is in the free list, remove it and update |num_free_blocks_|.
-    if (IsInFreeList(span)) {
-      DCHECK_GE(num_free_blocks_, span->length_);
-      num_free_blocks_ -= span->length_;
-      RemoveFromFreeList(span);
-    }
-  }
-}
-
-void DiscardableSharedMemoryHeap::OnMemoryDump(
-    const base::DiscardableSharedMemory* shared_memory,
-    size_t size,
-    int32_t segment_id,
-    base::trace_event::ProcessMemoryDump* pmd) {
-  size_t allocated_objects_count = 0;
-  size_t allocated_objects_size_in_blocks = 0;
-  size_t locked_objects_size_in_blocks = 0;
-  size_t offset =
-      reinterpret_cast<size_t>(shared_memory->memory()) / block_size_;
-  size_t end = offset + size / block_size_;
-  while (offset < end) {
-    Span* span = spans_[offset];
-    if (!IsInFreeList(span)) {
-      allocated_objects_size_in_blocks += span->length_;
-      locked_objects_size_in_blocks += span->is_locked_ ? span->length_ : 0;
-      allocated_objects_count++;
-    }
-    offset += span->length_;
-  }
-  size_t allocated_objects_size_in_bytes =
-      allocated_objects_size_in_blocks * block_size_;
-  size_t locked_objects_size_in_bytes =
-      locked_objects_size_in_blocks * block_size_;
-
-  std::string segment_dump_name =
-      base::StringPrintf("discardable/segment_%d", segment_id);
-  base::trace_event::MemoryAllocatorDump* segment_dump =
-      pmd->CreateAllocatorDump(segment_dump_name);
-  // The size is added here so that telemetry picks up the size. Usually it is
-  // just enough to add it to the global dump.
-  segment_dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
-                          base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                          allocated_objects_size_in_bytes);
-  segment_dump->AddScalar("virtual_size",
-                          base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                          size);
-
-  base::trace_event::MemoryAllocatorDump* obj_dump =
-      pmd->CreateAllocatorDump(segment_dump_name + "/allocated_objects");
-  obj_dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameObjectCount,
-                      base::trace_event::MemoryAllocatorDump::kUnitsObjects,
-                      allocated_objects_count);
-  obj_dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
-                      base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                      allocated_objects_size_in_bytes);
-  obj_dump->AddScalar("locked_size",
-                      base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                      locked_objects_size_in_bytes);
-
-  // Emit an ownership edge towards a global allocator dump node. This allows
-  // to avoid double-counting segments when both browser and child process emit
-  // them. In the special case of single-process-mode, this will be the only
-  // dumper active and the single ownership edge will become a no-op in the UI.
-  // The global dump is created as a weak dump so that the segment is removed if
-  // the browser does not dump it (segment was purged).
-  const uint64_t tracing_process_id =
-      base::trace_event::MemoryDumpManager::GetInstance()
-          ->GetTracingProcessId();
-  base::trace_event::MemoryAllocatorDumpGuid shared_segment_guid =
-      GetSegmentGUIDForTracing(tracing_process_id, segment_id);
-  pmd->CreateWeakSharedGlobalAllocatorDump(shared_segment_guid);
-
-  // The size is added to the global dump so that it gets propagated to both the
-  // dumps associated.
-  pmd->GetSharedGlobalAllocatorDump(shared_segment_guid)
-      ->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
-                  base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                  allocated_objects_size_in_bytes);
-
-  // By creating an edge with a higher |importance| (w.r.t. browser-side dumps)
-  // the tracing UI will account the effective size of the segment to the child.
-  const int kImportance = 2;
-  pmd->AddOwnershipEdge(segment_dump->guid(), shared_segment_guid, kImportance);
-}
-
-// static
-base::trace_event::MemoryAllocatorDumpGuid
-DiscardableSharedMemoryHeap::GetSegmentGUIDForTracing(
-    uint64_t tracing_process_id,
-    int32_t segment_id) {
-  return base::trace_event::MemoryAllocatorDumpGuid(base::StringPrintf(
-      "discardable-x-process/%" PRIx64 "/%d", tracing_process_id, segment_id));
-}
-
-base::trace_event::MemoryAllocatorDump*
-DiscardableSharedMemoryHeap::CreateMemoryAllocatorDump(
-    Span* span,
-    const char* name,
-    base::trace_event::ProcessMemoryDump* pmd) const {
-  if (!span->shared_memory()) {
-    base::trace_event::MemoryAllocatorDump* dump =
-        pmd->CreateAllocatorDump(name);
-    dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
-                    base::trace_event::MemoryAllocatorDump::kUnitsBytes, 0u);
-    return dump;
-  }
-
-  ScopedVector<ScopedMemorySegment>::const_iterator it =
-      std::find_if(memory_segments_.begin(), memory_segments_.end(),
-                   [span](const ScopedMemorySegment* segment) {
-                     return segment->ContainsSpan(span);
-                   });
-  DCHECK(it != memory_segments_.end());
-  return (*it)->CreateMemoryAllocatorDump(span, block_size_, name, pmd);
-}
-
-}  // namespace content
diff --git a/chromium/content/common/discardable_shared_memory_heap.h b/chromium/content/common/discardable_shared_memory_heap.h
deleted file mode 100644
index 6df1a16e76f..00000000000
--- a/chromium/content/common/discardable_shared_memory_heap.h
+++ /dev/null
@@ -1,186 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_DISCARDABLE_SHARED_MEMORY_HEAP_H_
-#define CONTENT_COMMON_DISCARDABLE_SHARED_MEMORY_HEAP_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include <memory>
-
-#include "base/callback.h"
-#include "base/containers/hash_tables.h"
-#include "base/containers/linked_list.h"
-#include "base/macros.h"
-#include "base/memory/scoped_vector.h"
-#include "base/trace_event/process_memory_dump.h"
-#include "content/common/content_export.h"
-
-namespace base {
-class DiscardableSharedMemory;
-}
-
-namespace content {
-
-// Implements a heap of discardable shared memory. An array of free lists
-// is used to keep track of free blocks.
-class CONTENT_EXPORT DiscardableSharedMemoryHeap {
- public:
-  class CONTENT_EXPORT Span : public base::LinkNode<Span> {
-   public:
-    ~Span();
-
-    base::DiscardableSharedMemory* shared_memory() { return shared_memory_; }
-    size_t start() const { return start_; }
-    size_t length() const { return length_; }
-    void set_is_locked(bool is_locked) { is_locked_ = is_locked; }
-
-   private:
-    friend class DiscardableSharedMemoryHeap;
-
-    Span(base::DiscardableSharedMemory* shared_memory,
-         size_t start,
-         size_t length);
-
-    base::DiscardableSharedMemory* shared_memory_;
-    size_t start_;
-    size_t length_;
-    bool is_locked_;
-
-    DISALLOW_COPY_AND_ASSIGN(Span);
-  };
-
-  explicit DiscardableSharedMemoryHeap(size_t block_size);
-  ~DiscardableSharedMemoryHeap();
-
-  // Grow heap using |shared_memory| and return a span for this new memory.
-  // |shared_memory| must be aligned to the block size and |size| must be a
-  // multiple of the block size. |deleted_callback| is called when
-  // |shared_memory| has been deleted.
-  std::unique_ptr<Span> Grow(
-      std::unique_ptr<base::DiscardableSharedMemory> shared_memory,
-      size_t size,
-      int32_t id,
-      const base::Closure& deleted_callback);
-
-  // Merge |span| into the free lists. This will coalesce |span| with
-  // neighboring free spans when possible.
-  void MergeIntoFreeLists(std::unique_ptr<Span> span);
-
-  // Split an allocated span into two spans, one of length |blocks| followed
-  // by another span of length "span->length - blocks" blocks. Modifies |span|
-  // to point to the first span of length |blocks|. Return second span.
-  std::unique_ptr<Span> Split(Span* span, size_t blocks);
-
-  // Search free lists for span that satisfies the request for |blocks| of
-  // memory. If found, the span is removed from the free list and returned.
-  // |slack| determines the fitness requirement. Only spans that are less
-  // or equal to |blocks| + |slack| are considered, worse fitting spans are
-  // ignored.
-  std::unique_ptr<Span> SearchFreeLists(size_t blocks, size_t slack);
-
-  // Release free shared memory segments.
-  void ReleaseFreeMemory();
-
-  // Release shared memory segments that have been purged.
-  void ReleasePurgedMemory();
-
-  // Returns total bytes of memory in heap.
-  size_t GetSize() const;
-
-  // Returns bytes of memory currently in the free lists.
-  size_t GetSizeOfFreeLists() const;
-
-  // Dumps memory statistics for chrome://tracing.
-  bool OnMemoryDump(base::trace_event::ProcessMemoryDump* pmd);
-
-  // Returns a unique identifier for a given tuple of (process id, segment id)
-  // that can be used to match memory dumps across different processes.
-  static base::trace_event::MemoryAllocatorDumpGuid GetSegmentGUIDForTracing(
-      uint64_t tracing_process_id,
-      int32_t segment_id);
-
-  // Returns a MemoryAllocatorDump for a given span on |pmd| with the size of
-  // the span.
-  base::trace_event::MemoryAllocatorDump* CreateMemoryAllocatorDump(
-      Span* span,
-      const char* name,
-      base::trace_event::ProcessMemoryDump* pmd) const;
-
- private:
-  class ScopedMemorySegment {
-   public:
-    ScopedMemorySegment(
-        DiscardableSharedMemoryHeap* heap,
-        std::unique_ptr<base::DiscardableSharedMemory> shared_memory,
-        size_t size,
-        int32_t id,
-        const base::Closure& deleted_callback);
-    ~ScopedMemorySegment();
-
-    bool IsUsed() const;
-    bool IsResident() const;
-
-    bool ContainsSpan(Span* span) const;
-
-    base::trace_event::MemoryAllocatorDump* CreateMemoryAllocatorDump(
-        Span* span,
-        size_t block_size,
-        const char* name,
-        base::trace_event::ProcessMemoryDump* pmd) const;
-
-    // Used for dumping memory statistics from the segment to chrome://tracing.
-    void OnMemoryDump(base::trace_event::ProcessMemoryDump* pmd) const;
-
-   private:
-    DiscardableSharedMemoryHeap* const heap_;
-    std::unique_ptr<base::DiscardableSharedMemory> shared_memory_;
-    const size_t size_;
-    const int32_t id_;
-    const base::Closure deleted_callback_;
-
-    DISALLOW_COPY_AND_ASSIGN(ScopedMemorySegment);
-  };
-
-  void InsertIntoFreeList(std::unique_ptr<Span> span);
-  std::unique_ptr<Span> RemoveFromFreeList(Span* span);
-  std::unique_ptr<Span> Carve(Span* span, size_t blocks);
-  void RegisterSpan(Span* span);
-  void UnregisterSpan(Span* span);
-  bool IsMemoryUsed(const base::DiscardableSharedMemory* shared_memory,
-                    size_t size);
-  bool IsMemoryResident(const base::DiscardableSharedMemory* shared_memory);
-  void ReleaseMemory(const base::DiscardableSharedMemory* shared_memory,
-                     size_t size);
-
-  // Dumps memory statistics about a memory segment for chrome://tracing.
-  void OnMemoryDump(const base::DiscardableSharedMemory* shared_memory,
-                    size_t size,
-                    int32_t segment_id,
-                    base::trace_event::ProcessMemoryDump* pmd);
-
-  size_t block_size_;
-  size_t num_blocks_;
-  size_t num_free_blocks_;
-
-  // Vector of memory segments.
-  ScopedVector<ScopedMemorySegment> memory_segments_;
-
-  // Mapping from first/last block of span to Span instance.
-  typedef base::hash_map<size_t, Span*> SpanMap;
-  SpanMap spans_;
-
-  // Array of linked-lists with free discardable memory regions. For i < 256,
-  // where the 1st entry is located at index 0 of the array, the kth entry
-  // is a free list of runs that consist of k blocks. The 256th entry is a
-  // free list of runs that have length >= 256 blocks.
-  base::LinkedList<Span> free_spans_[256];
-
-  DISALLOW_COPY_AND_ASSIGN(DiscardableSharedMemoryHeap);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_DISCARDABLE_SHARED_MEMORY_HEAP_H_
diff --git a/chromium/content/common/discardable_shared_memory_heap_perftest.cc b/chromium/content/common/discardable_shared_memory_heap_perftest.cc
deleted file mode 100644
index 8dc3d588dd2..00000000000
--- a/chromium/content/common/discardable_shared_memory_heap_perftest.cc
+++ /dev/null
@@ -1,101 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/discardable_shared_memory_heap.h"
-
-#include <stddef.h>
-#include <algorithm>
-#include <cmath>
-#include <cstdlib>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/callback_helpers.h"
-#include "base/memory/discardable_shared_memory.h"
-#include "base/memory/scoped_vector.h"
-#include "base/process/process_metrics.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "testing/perf/perf_test.h"
-
-namespace content {
-namespace {
-
-const int kTimeLimitMs = 2000;
-const int kTimeCheckInterval = 8192;
-
-void NullTask() {
-}
-
-TEST(DiscardableSharedMemoryHeapTest, SearchFreeLists) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-
-  const size_t kBlocks = 4096;
-  const size_t kSegments = 16;
-  size_t segment_size = block_size * kBlocks;
-  int next_discardable_shared_memory_id = 0;
-
-  for (size_t i = 0; i < kSegments; ++i) {
-    std::unique_ptr<base::DiscardableSharedMemory> memory(
-        new base::DiscardableSharedMemory);
-    ASSERT_TRUE(memory->CreateAndMap(segment_size));
-    heap.MergeIntoFreeLists(heap.Grow(std::move(memory), segment_size,
-                                      next_discardable_shared_memory_id++,
-                                      base::Bind(NullTask)));
-  }
-
-  unsigned kSeed = 1;
-  // Use kSeed as seed for random number generator.
-  srand(kSeed);
-
-  // Pre-compute random values.
-  int random_span[kTimeCheckInterval];
-  size_t random_blocks[kTimeCheckInterval];
-  for (int i = 0; i < kTimeCheckInterval; ++i) {
-    random_span[i] = std::rand();
-    // Exponentially distributed block size.
-    const double kLambda = 2.0;
-    double v = static_cast<double>(std::rand()) / RAND_MAX;
-    random_blocks[i] = 1 + log(1.0 - v) / -kLambda * kBlocks;
-  }
-
-  ScopedVector<base::ScopedClosureRunner> spans;
-
-  base::TimeTicks start = base::TimeTicks::Now();
-  base::TimeTicks end = start + base::TimeDelta::FromMilliseconds(kTimeLimitMs);
-  base::TimeDelta accumulator;
-  int count = 0;
-  while (start < end) {
-    for (int i = 0; i < kTimeCheckInterval; ++i) {
-      // Search for a perfect fit if greater than kBlocks.
-      size_t slack =
-          random_blocks[i] < kBlocks ? kBlocks - random_blocks[i] : 0;
-      std::unique_ptr<DiscardableSharedMemoryHeap::Span> span =
-          heap.SearchFreeLists(random_blocks[i], slack);
-      if (span) {
-        spans.push_back(new base::ScopedClosureRunner(
-            base::Bind(&DiscardableSharedMemoryHeap::MergeIntoFreeLists,
-                       base::Unretained(&heap), base::Passed(&span))));
-      } else if (!spans.empty()) {
-        // Merge a random span back into the free list.
-        std::swap(spans[random_span[i] % spans.size()], spans.back());
-        spans.pop_back();
-      }
-
-      ++count;
-    }
-
-    base::TimeTicks now = base::TimeTicks::Now();
-    accumulator += now - start;
-    start = now;
-  }
-
-  spans.clear();
-
-  perf_test::PrintResult("search_free_list", "", "",
-                         count / accumulator.InSecondsF(), "runs/s", true);
-}
-
-}  // namespace
-}  // namespace content
diff --git a/chromium/content/common/discardable_shared_memory_heap_unittest.cc b/chromium/content/common/discardable_shared_memory_heap_unittest.cc
deleted file mode 100644
index f391ff3d2ee..00000000000
--- a/chromium/content/common/discardable_shared_memory_heap_unittest.cc
+++ /dev/null
@@ -1,339 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/discardable_shared_memory_heap.h"
-
-#include <stddef.h>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/memory/discardable_shared_memory.h"
-#include "base/process/process_metrics.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace content {
-namespace {
-
-void NullTask() {
-}
-
-TEST(DiscardableSharedMemoryHeapTest, Basic) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-
-  // Initial size should be 0.
-  EXPECT_EQ(0u, heap.GetSize());
-
-  // Initial size of free lists should be 0.
-  EXPECT_EQ(0u, heap.GetSizeOfFreeLists());
-
-  // Free lists are initially empty.
-  EXPECT_FALSE(heap.SearchFreeLists(1, 0));
-
-  const size_t kBlocks = 10;
-  size_t memory_size = block_size * kBlocks;
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(memory_size));
-
-  // Create new span for memory.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> new_span(
-      heap.Grow(std::move(memory), memory_size,
-                next_discardable_shared_memory_id++, base::Bind(NullTask)));
-
-  // Size should match |memory_size|.
-  EXPECT_EQ(memory_size, heap.GetSize());
-
-  // Size of free lists should still be 0.
-  EXPECT_EQ(0u, heap.GetSizeOfFreeLists());
-
-  // Free list should still be empty as |new_span| is currently in use.
-  EXPECT_FALSE(heap.SearchFreeLists(1, 0));
-
-  // Done using |new_span|. Merge it into the free lists.
-  heap.MergeIntoFreeLists(std::move(new_span));
-
-  // Size of free lists should now match |memory_size|.
-  EXPECT_EQ(memory_size, heap.GetSizeOfFreeLists());
-
-  // Free lists should not contain a span that is larger than kBlocks.
-  EXPECT_FALSE(heap.SearchFreeLists(kBlocks + 1, 0));
-
-  // Free lists should contain a span that satisfies the request for kBlocks.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span =
-      heap.SearchFreeLists(kBlocks, 0);
-  ASSERT_TRUE(span);
-
-  // Free lists should be empty again.
-  EXPECT_FALSE(heap.SearchFreeLists(1, 0));
-
-  // Merge it into the free lists again.
-  heap.MergeIntoFreeLists(std::move(span));
-}
-
-TEST(DiscardableSharedMemoryHeapTest, SplitAndMerge) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-
-  const size_t kBlocks = 6;
-  size_t memory_size = block_size * kBlocks;
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(memory_size));
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> new_span(
-      heap.Grow(std::move(memory), memory_size,
-                next_discardable_shared_memory_id++, base::Bind(NullTask)));
-
-  // Split span into two.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> leftover =
-      heap.Split(new_span.get(), 3);
-  ASSERT_TRUE(leftover);
-
-  // Merge |leftover| into free lists.
-  heap.MergeIntoFreeLists(std::move(leftover));
-
-  // Some of the memory is still in use.
-  EXPECT_FALSE(heap.SearchFreeLists(kBlocks, 0));
-
-  // Merge |span| into free lists.
-  heap.MergeIntoFreeLists(std::move(new_span));
-
-  // Remove a 2 page span from free lists.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span1 =
-      heap.SearchFreeLists(2, kBlocks);
-  ASSERT_TRUE(span1);
-
-  // Remove another 2 page span from free lists.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span2 =
-      heap.SearchFreeLists(2, kBlocks);
-  ASSERT_TRUE(span2);
-
-  // Merge |span1| back into free lists.
-  heap.MergeIntoFreeLists(std::move(span1));
-
-  // Some of the memory is still in use.
-  EXPECT_FALSE(heap.SearchFreeLists(kBlocks, 0));
-
-  // Merge |span2| back into free lists.
-  heap.MergeIntoFreeLists(std::move(span2));
-
-  // All memory has been returned to the free lists.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> large_span =
-      heap.SearchFreeLists(kBlocks, 0);
-  ASSERT_TRUE(large_span);
-
-  // Merge it into the free lists again.
-  heap.MergeIntoFreeLists(std::move(large_span));
-}
-
-TEST(DiscardableSharedMemoryHeapTest, MergeSingleBlockSpan) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-
-  const size_t kBlocks = 6;
-  size_t memory_size = block_size * kBlocks;
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(memory_size));
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> new_span(
-      heap.Grow(std::move(memory), memory_size,
-                next_discardable_shared_memory_id++, base::Bind(NullTask)));
-
-  // Split span into two.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> leftover =
-      heap.Split(new_span.get(), 5);
-  ASSERT_TRUE(leftover);
-
-  // Merge |new_span| into free lists.
-  heap.MergeIntoFreeLists(std::move(new_span));
-
-  // Merge |leftover| into free lists.
-  heap.MergeIntoFreeLists(std::move(leftover));
-}
-
-TEST(DiscardableSharedMemoryHeapTest, Grow) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory1(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory1->CreateAndMap(block_size));
-  heap.MergeIntoFreeLists(heap.Grow(std::move(memory1), block_size,
-                                    next_discardable_shared_memory_id++,
-                                    base::Bind(NullTask)));
-
-  // Remove a span from free lists.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span1 =
-      heap.SearchFreeLists(1, 0);
-  EXPECT_TRUE(span1);
-
-  // No more memory available.
-  EXPECT_FALSE(heap.SearchFreeLists(1, 0));
-
-  // Grow free lists using new memory.
-  std::unique_ptr<base::DiscardableSharedMemory> memory2(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory2->CreateAndMap(block_size));
-  heap.MergeIntoFreeLists(heap.Grow(std::move(memory2), block_size,
-                                    next_discardable_shared_memory_id++,
-                                    base::Bind(NullTask)));
-
-  // Memory should now be available.
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span2 =
-      heap.SearchFreeLists(1, 0);
-  EXPECT_TRUE(span2);
-
-  // Merge spans into the free lists again.
-  heap.MergeIntoFreeLists(std::move(span1));
-  heap.MergeIntoFreeLists(std::move(span2));
-}
-
-TEST(DiscardableSharedMemoryHeapTest, ReleaseFreeMemory) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(block_size));
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span =
-      heap.Grow(std::move(memory), block_size,
-                next_discardable_shared_memory_id++, base::Bind(NullTask));
-
-  // Free lists should be empty.
-  EXPECT_EQ(0u, heap.GetSizeOfFreeLists());
-
-  heap.ReleaseFreeMemory();
-
-  // Size should still match |block_size|.
-  EXPECT_EQ(block_size, heap.GetSize());
-
-  heap.MergeIntoFreeLists(std::move(span));
-  heap.ReleaseFreeMemory();
-
-  // Memory should have been released.
-  EXPECT_EQ(0u, heap.GetSize());
-  EXPECT_EQ(0u, heap.GetSizeOfFreeLists());
-}
-
-TEST(DiscardableSharedMemoryHeapTest, ReleasePurgedMemory) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(block_size));
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span =
-      heap.Grow(std::move(memory), block_size,
-                next_discardable_shared_memory_id++, base::Bind(NullTask));
-
-  // Unlock memory so it can be purged.
-  span->shared_memory()->Unlock(0, 0);
-
-  // Purge and release shared memory.
-  bool rv = span->shared_memory()->Purge(base::Time::Now());
-  EXPECT_TRUE(rv);
-  heap.ReleasePurgedMemory();
-
-  // Shared memory backing for |span| should be gone.
-  EXPECT_FALSE(span->shared_memory());
-
-  // Size should be 0.
-  EXPECT_EQ(0u, heap.GetSize());
-}
-
-TEST(DiscardableSharedMemoryHeapTest, Slack) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-
-  const size_t kBlocks = 6;
-  size_t memory_size = block_size * kBlocks;
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(memory_size));
-  heap.MergeIntoFreeLists(heap.Grow(std::move(memory), memory_size,
-                                    next_discardable_shared_memory_id++,
-                                    base::Bind(NullTask)));
-
-  // No free span that is less or equal to 3 + 1.
-  EXPECT_FALSE(heap.SearchFreeLists(3, 1));
-
-  // No free span that is less or equal to 3 + 2.
-  EXPECT_FALSE(heap.SearchFreeLists(3, 2));
-
-  // No free span that is less or equal to 1 + 4.
-  EXPECT_FALSE(heap.SearchFreeLists(1, 4));
-
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span =
-      heap.SearchFreeLists(1, 5);
-  EXPECT_TRUE(span);
-
-  heap.MergeIntoFreeLists(std::move(span));
-}
-
-void OnDeleted(bool* deleted) {
-  *deleted = true;
-}
-
-TEST(DiscardableSharedMemoryHeapTest, DeletedCallback) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(block_size));
-  bool deleted = false;
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span = heap.Grow(
-      std::move(memory), block_size, next_discardable_shared_memory_id++,
-      base::Bind(OnDeleted, base::Unretained(&deleted)));
-
-  heap.MergeIntoFreeLists(std::move(span));
-  heap.ReleaseFreeMemory();
-
-  EXPECT_TRUE(deleted);
-}
-
-TEST(DiscardableSharedMemoryHeapTest, CreateMemoryAllocatorDumpTest) {
-  size_t block_size = base::GetPageSize();
-  DiscardableSharedMemoryHeap heap(block_size);
-  int next_discardable_shared_memory_id = 0;
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  ASSERT_TRUE(memory->CreateAndMap(block_size));
-  std::unique_ptr<DiscardableSharedMemoryHeap::Span> span =
-      heap.Grow(std::move(memory), block_size,
-                next_discardable_shared_memory_id++, base::Bind(NullTask));
-
-  // Check if allocator dump is created when span exists.
-  std::unique_ptr<base::trace_event::ProcessMemoryDump> pmd(
-      new base::trace_event::ProcessMemoryDump(
-          nullptr, {base::trace_event::MemoryDumpLevelOfDetail::DETAILED}));
-  EXPECT_TRUE(heap.CreateMemoryAllocatorDump(span.get(), "discardable/test1",
-                                             pmd.get()));
-
-  // Unlock, Purge and release shared memory.
-  span->shared_memory()->Unlock(0, 0);
-  bool rv = span->shared_memory()->Purge(base::Time::Now());
-  EXPECT_TRUE(rv);
-  heap.ReleasePurgedMemory();
-
-  // Check that allocator dump is created after memory is purged.
-  EXPECT_TRUE(heap.CreateMemoryAllocatorDump(span.get(), "discardable/test2",
-                                             pmd.get()));
-}
-
-}  // namespace
-}  // namespace content
diff --git a/chromium/content/common/drag_traits.h b/chromium/content/common/drag_traits.h
index 927881585f2..5f9d151a4c4 100644
--- a/chromium/content/common/drag_traits.h
+++ b/chromium/content/common/drag_traits.h
@@ -42,6 +42,7 @@ IPC_STRUCT_TRAITS_END()
 IPC_STRUCT_TRAITS_BEGIN(content::DropData::FileSystemFileInfo)
   IPC_STRUCT_TRAITS_MEMBER(url)
   IPC_STRUCT_TRAITS_MEMBER(size)
+  IPC_STRUCT_TRAITS_MEMBER(filesystem_id)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::DropData::Metadata)
diff --git a/chromium/content/common/fileapi/webblob_messages.h b/chromium/content/common/fileapi/webblob_messages.h
index 85dbf8c976c..3b22b7f588e 100644
--- a/chromium/content/common/fileapi/webblob_messages.h
+++ b/chromium/content/common/fileapi/webblob_messages.h
@@ -29,8 +29,7 @@
 
 IPC_ENUM_TRAITS_MAX_VALUE(storage::IPCBlobItemRequestStrategy,
                           storage::IPCBlobItemRequestStrategy::LAST)
-IPC_ENUM_TRAITS_MAX_VALUE(storage::IPCBlobCreationCancelCode,
-                          storage::IPCBlobCreationCancelCode::LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(storage::BlobStatus, storage::BlobStatus::LAST)
 
 IPC_STRUCT_TRAITS_BEGIN(storage::BlobItemBytesRequest)
   IPC_STRUCT_TRAITS_MEMBER(request_number)
@@ -48,21 +47,17 @@ IPC_STRUCT_TRAITS_BEGIN(storage::BlobItemBytesResponse)
   IPC_STRUCT_TRAITS_MEMBER(time_file_modified)
 IPC_STRUCT_TRAITS_END()
 
-// This message is to tell the browser that we will be building a blob.
-IPC_MESSAGE_CONTROL4(BlobStorageMsg_RegisterBlobUUID,
-                     std::string /* uuid */,
-                     std::string /* content_type */,
-                     std::string /* content_disposition */,
-                     std::set<std::string> /* referenced_blob_uuids */)
-
-// The DataElements are used to:
+// This message is to tell the browser that we will be building a blob. The
+// DataElements are used to:
 // * describe & transport non-memory resources (blobs, files, etc)
 // * describe the size of memory items
 // * 'shortcut' transport the memory up to the IPC limit so the browser can use
 //   it if it's not currently full.
 // See https://bit.ly/BlobStorageRefactor
-IPC_MESSAGE_CONTROL2(BlobStorageMsg_StartBuildingBlob,
+IPC_MESSAGE_CONTROL4(BlobStorageMsg_RegisterBlob,
                      std::string /* uuid */,
+                     std::string /* content_type */,
+                     std::string /* content_disposition */,
                      std::vector<storage::DataElement> /* item_descriptions */)
 
 IPC_MESSAGE_CONTROL4(
@@ -77,11 +72,9 @@ IPC_MESSAGE_CONTROL2(
     std::string /* uuid */,
     std::vector<storage::BlobItemBytesResponse> /* responses */)
 
-IPC_MESSAGE_CONTROL2(BlobStorageMsg_CancelBuildingBlob,
+IPC_MESSAGE_CONTROL2(BlobStorageMsg_SendBlobStatus,
                      std::string /* uuid */,
-                     storage::IPCBlobCreationCancelCode /* code */)
-
-IPC_MESSAGE_CONTROL1(BlobStorageMsg_DoneBuildingBlob, std::string /* uuid */)
+                     storage::BlobStatus /* code */)
 
 IPC_MESSAGE_CONTROL1(BlobHostMsg_IncrementRefCount,
                      std::string /* uuid */)
diff --git a/chromium/content/common/font_list_mac.mm b/chromium/content/common/font_list_mac.mm
index 8c7d889b853..d4768ae25b9 100644
--- a/chromium/content/common/font_list_mac.mm
+++ b/chromium/content/common/font_list_mac.mm
@@ -16,17 +16,29 @@ std::unique_ptr<base::ListValue> GetFontList_SlowBlocking() {
   base::mac::ScopedNSAutoreleasePool autorelease_pool;
   std::unique_ptr<base::ListValue> font_list(new base::ListValue);
   NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
+  NSMutableDictionary* fonts_dict = [NSMutableDictionary dictionary];
   NSArray* fonts = [fontManager availableFontFamilies];
+
   for (NSString* family_name in fonts) {
     NSString* localized_family_name =
         [fontManager localizedNameForFamily:family_name face:nil];
+    fonts_dict[family_name] = localized_family_name;
+  }
+
+  // Sort family names based on localized names.
+  NSArray* sortedFonts = [fonts_dict
+      keysSortedByValueUsingSelector:@selector(localizedStandardCompare:)];
+
+  for (NSString* family_name in sortedFonts) {
+    NSString* localized_family_name = fonts_dict[family_name];
     base::ListValue* font_item = new base::ListValue();
     base::string16 family = base::SysNSStringToUTF16(family_name);
-    font_item->Append(new base::StringValue(family));
     base::string16 loc_family = base::SysNSStringToUTF16(localized_family_name);
+    font_item->Append(new base::StringValue(family));
     font_item->Append(new base::StringValue(loc_family));
     font_list->Append(font_item);
   }
+
   return font_list;
 }
 
diff --git a/chromium/content/common/frame.mojom b/chromium/content/common/frame.mojom
index 9ec96441b37..f751a31a5db 100644
--- a/chromium/content/common/frame.mojom
+++ b/chromium/content/common/frame.mojom
@@ -4,16 +4,20 @@
 
 module content.mojom;
 
-import "services/shell/public/interfaces/interface_provider.mojom";
+import "services/service_manager/public/interfaces/interface_provider.mojom";
+
+// The name of the InterfaceProviderSpec in service manifests used by the
+// frame tree to expose frame-specific interfaces between renderer and browser.
+const string kNavigation_FrameSpec = "navigation:frame";
 
 // Implemented by the frame provider (e.g. renderer processes).
 interface Frame {
-  GetInterfaceProvider(shell.mojom.InterfaceProvider& interfaces);
+  GetInterfaceProvider(service_manager.mojom.InterfaceProvider& interfaces);
 };
 
 // Implemented by the frame server (i.e. the browser process).
 interface FrameHost {
-  GetInterfaceProvider(shell.mojom.InterfaceProvider& interfaces);
+  GetInterfaceProvider(service_manager.mojom.InterfaceProvider& interfaces);
 };
 
 // Implemented by a service that provides implementations of the Frame
diff --git a/chromium/content/common/frame_messages.h b/chromium/content/common/frame_messages.h
index 2329016c258..47c2f4007d4 100644
--- a/chromium/content/common/frame_messages.h
+++ b/chromium/content/common/frame_messages.h
@@ -51,6 +51,7 @@
 #include "ui/gfx/geometry/rect_f.h"
 #include "ui/gfx/ipc/gfx_param_traits.h"
 #include "ui/gfx/ipc/skia/gfx_skia_param_traits.h"
+#include "ui/gfx/range/range.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
@@ -171,6 +172,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::FrameOwnerProperties)
   IPC_STRUCT_TRAITS_MEMBER(margin_width)
   IPC_STRUCT_TRAITS_MEMBER(margin_height)
   IPC_STRUCT_TRAITS_MEMBER(allow_fullscreen)
+  IPC_STRUCT_TRAITS_MEMBER(allow_payment_request)
   IPC_STRUCT_TRAITS_MEMBER(required_csp)
   IPC_STRUCT_TRAITS_MEMBER(delegated_permissions)
 IPC_STRUCT_TRAITS_END()
@@ -201,7 +203,6 @@ IPC_STRUCT_BEGIN(FrameHostMsg_DidFailProvisionalLoadWithError_Params)
 IPC_STRUCT_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::FrameNavigateParams)
-  IPC_STRUCT_TRAITS_MEMBER(page_id)
   IPC_STRUCT_TRAITS_MEMBER(nav_entry_id)
   IPC_STRUCT_TRAITS_MEMBER(frame_unique_name)
   IPC_STRUCT_TRAITS_MEMBER(item_sequence_number)
@@ -212,8 +213,6 @@ IPC_STRUCT_TRAITS_BEGIN(content::FrameNavigateParams)
   IPC_STRUCT_TRAITS_MEMBER(transition)
   IPC_STRUCT_TRAITS_MEMBER(redirects)
   IPC_STRUCT_TRAITS_MEMBER(should_update_history)
-  IPC_STRUCT_TRAITS_MEMBER(searchable_form_url)
-  IPC_STRUCT_TRAITS_MEMBER(searchable_form_encoding)
   IPC_STRUCT_TRAITS_MEMBER(contents_mime_type)
   IPC_STRUCT_TRAITS_MEMBER(socket_address)
 IPC_STRUCT_TRAITS_END()
@@ -300,6 +299,12 @@ IPC_STRUCT_BEGIN_WITH_PARENT(FrameHostMsg_DidCommitProvisionalLoad_Params,
 
   // True if the navigation originated as an srcdoc attribute.
   IPC_STRUCT_MEMBER(bool, is_srcdoc)
+
+  // See WebSearchableFormData for a description of these.
+  // Not used by PlzNavigate: in that case these fields are sent to the browser
+  // in BeginNavigationParams.
+  IPC_STRUCT_MEMBER(GURL, searchable_form_url)
+  IPC_STRUCT_MEMBER(std::string, searchable_form_encoding)
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameMsg_PostMessage_Params)
@@ -350,6 +355,8 @@ IPC_STRUCT_TRAITS_BEGIN(content::BeginNavigationParams)
   IPC_STRUCT_TRAITS_MEMBER(has_user_gesture)
   IPC_STRUCT_TRAITS_MEMBER(skip_service_worker)
   IPC_STRUCT_TRAITS_MEMBER(request_context_type)
+  IPC_STRUCT_TRAITS_MEMBER(searchable_form_url)
+  IPC_STRUCT_TRAITS_MEMBER(searchable_form_encoding)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::StartNavigationParams)
@@ -369,9 +376,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::RequestNavigationParams)
   IPC_STRUCT_TRAITS_MEMBER(redirects)
   IPC_STRUCT_TRAITS_MEMBER(redirect_response)
   IPC_STRUCT_TRAITS_MEMBER(can_load_local_resources)
-  IPC_STRUCT_TRAITS_MEMBER(request_time)
   IPC_STRUCT_TRAITS_MEMBER(page_state)
-  IPC_STRUCT_TRAITS_MEMBER(page_id)
   IPC_STRUCT_TRAITS_MEMBER(nav_entry_id)
   IPC_STRUCT_TRAITS_MEMBER(is_same_document_history_load)
   IPC_STRUCT_TRAITS_MEMBER(is_history_navigation_in_new_child)
@@ -411,6 +416,7 @@ IPC_STRUCT_BEGIN(FrameHostMsg_OpenURL_Params)
   IPC_STRUCT_MEMBER(bool, uses_post)
   IPC_STRUCT_MEMBER(scoped_refptr<content::ResourceRequestBodyImpl>,
                     resource_request_body)
+  IPC_STRUCT_MEMBER(std::string, extra_headers)
   IPC_STRUCT_MEMBER(content::Referrer, referrer)
   IPC_STRUCT_MEMBER(WindowOpenDisposition, disposition)
   IPC_STRUCT_MEMBER(bool, should_replace_current_entry)
@@ -761,10 +767,6 @@ IPC_MESSAGE_ROUTED2(FrameMsg_DidUpdateOrigin,
 // support cross-process focused frame changes.
 IPC_MESSAGE_ROUTED0(FrameMsg_SetFocusedFrame)
 
-// Notifies this frame or proxy that it is no longer focused. This is used when
-// a frame in the embedder that the guest cannot see (<webview>) gains focus.
-IPC_MESSAGE_ROUTED0(FrameMsg_ClearFocusedFrame)
-
 // Sent to a frame proxy when its real frame is preparing to enter fullscreen
 // in another process.  Actually entering fullscreen will be done separately as
 // part of ViewMsg_Resize, once the browser process has resized the tab for
@@ -779,6 +781,9 @@ IPC_MESSAGE_ROUTED1(FrameMsg_SetTextTrackSettings,
 // Posts a message from a frame in another process to the current renderer.
 IPC_MESSAGE_ROUTED1(FrameMsg_PostMessageEvent, FrameMsg_PostMessage_Params)
 
+// Tells the RenderFrame to clear the focused element (if any).
+IPC_MESSAGE_ROUTED0(FrameMsg_ClearFocusedElement)
+
 #if defined(OS_ANDROID)
 // Request the distance to the nearest find result in a frame from the point at
 // (x, y), defined in fractions of the content document's width and height. The
@@ -916,6 +921,10 @@ IPC_MESSAGE_ROUTED0(FrameMsg_EnableViewSourceMode)
 // ScopedPageLoadDeferrer is on the stack for SwapOut.
 IPC_MESSAGE_ROUTED0(FrameMsg_SuppressFurtherDialogs)
 
+// Tells the frame to consider itself to have received a user gesture (based
+// on a user gesture proceed by a descendant).
+IPC_MESSAGE_ROUTED0(FrameMsg_SetHasReceivedUserGesture)
+
 IPC_MESSAGE_ROUTED1(FrameMsg_RunFileChooserResponse,
                     std::vector<content::FileChooserFileInfo>)
 
@@ -924,7 +933,7 @@ IPC_MESSAGE_ROUTED1(FrameMsg_RunFileChooserResponse,
 
 // Blink and JavaScript error messages to log to the console
 // or debugger UI.
-IPC_MESSAGE_ROUTED4(FrameHostMsg_AddMessageToConsole,
+IPC_MESSAGE_ROUTED4(FrameHostMsg_DidAddMessageToConsole,
                     int32_t,        /* log level */
                     base::string16, /* msg */
                     int32_t,        /* line number */
@@ -1066,9 +1075,6 @@ IPC_MESSAGE_ROUTED0(FrameHostMsg_DidAccessInitialDocument)
 // window.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_DidChangeOpener, int /* opener_routing_id */)
 
-// Notifies the browser that a page id was assigned.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_DidAssignPageId, int32_t /* page_id */)
-
 // Notifies the browser that sandbox flags have changed for a subframe of this
 // frame.
 IPC_MESSAGE_ROUTED2(FrameHostMsg_DidChangeSandboxFlags,
@@ -1116,6 +1122,15 @@ IPC_SYNC_MESSAGE_CONTROL3_1(FrameHostMsg_Are3DAPIsBlocked,
                             content::ThreeDAPIType /* requester */,
                             bool /* blocked */)
 
+// Message sent from renderer to the browser when focus changes inside the
+// frame. The first parameter says whether the newly focused element needs
+// keyboard input (true for textfields, text areas and content editable divs).
+// The second parameter is the node bounds relative to local root's
+// RenderWidgetHostView.
+IPC_MESSAGE_ROUTED2(FrameHostMsg_FocusedNodeChanged,
+                    bool /* is_editable_node */,
+                    gfx::Rect /* node_bounds */)
+
 #if defined(ENABLE_PLUGINS)
 // Notification sent from a renderer to the browser that a Pepper plugin
 // instance is created in the DOM.
@@ -1288,12 +1303,24 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_FrameRectChanged, gfx::Rect /* frame_rect */)
 // Informs the child that the frame has changed visibility.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_VisibilityChanged, bool /* visible */)
 
+// Indicates that a child of this frame recieved a user gesture, and this
+// frame should in turn consider itself to have received a user gesture.
+IPC_MESSAGE_ROUTED0(FrameHostMsg_SetHasReceivedUserGesture)
+
 // Used to tell the parent that the user right clicked on an area of the
 // content area, and a context menu should be shown for it. The params
 // object contains information about the node(s) that were selected when the
 // user right clicked.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_ContextMenu, content::ContextMenuParams)
 
+// Notification that the text selection has changed.
+// Note: The second parameter is the character based offset of the
+// base::string16 text in the document.
+IPC_MESSAGE_ROUTED3(FrameHostMsg_SelectionChanged,
+                    base::string16 /* text covers the selection range */,
+                    uint32_t /* the offset of the text in the document */,
+                    gfx::Range /* selection range in the document */)
+
 // Response for FrameMsg_JavaScriptExecuteRequest, sent when a reply was
 // requested. The ID is the parameter supplied to
 // FrameMsg_JavaScriptExecuteRequest. The result has the value returned by the
diff --git a/chromium/content/common/frame_owner_properties.cc b/chromium/content/common/frame_owner_properties.cc
index e84de423701..f3de3f0921c 100644
--- a/chromium/content/common/frame_owner_properties.cc
+++ b/chromium/content/common/frame_owner_properties.cc
@@ -10,7 +10,8 @@ FrameOwnerProperties::FrameOwnerProperties()
     : scrolling_mode(blink::WebFrameOwnerProperties::ScrollingMode::Auto),
       margin_width(-1),
       margin_height(-1),
-      allow_fullscreen(false) {}
+      allow_fullscreen(false),
+      allow_payment_request(false) {}
 
 FrameOwnerProperties::FrameOwnerProperties(const FrameOwnerProperties& other) =
     default;
@@ -21,6 +22,7 @@ FrameOwnerProperties::FrameOwnerProperties(
       margin_width(web_frame_owner_properties.marginWidth),
       margin_height(web_frame_owner_properties.marginHeight),
       allow_fullscreen(web_frame_owner_properties.allowFullscreen),
+      allow_payment_request(web_frame_owner_properties.allowPaymentRequest),
       required_csp(web_frame_owner_properties.requiredCsp.utf8()),
       delegated_permissions(
           web_frame_owner_properties.delegatedPermissions.begin(),
@@ -36,6 +38,7 @@ blink::WebFrameOwnerProperties FrameOwnerProperties::ToWebFrameOwnerProperties()
   result.marginWidth = margin_width;
   result.marginHeight = margin_height;
   result.allowFullscreen = allow_fullscreen;
+  result.allowPaymentRequest = allow_payment_request;
   result.requiredCsp = blink::WebString::fromUTF8(required_csp);
   result.delegatedPermissions =
       blink::WebVector<blink::WebPermissionType>(delegated_permissions);
@@ -48,6 +51,7 @@ bool FrameOwnerProperties::operator==(const FrameOwnerProperties& other) const {
          margin_width == other.margin_width &&
          margin_height == other.margin_height &&
          allow_fullscreen == other.allow_fullscreen &&
+         allow_payment_request == other.allow_payment_request &&
          required_csp == other.required_csp &&
          std::equal(delegated_permissions.begin(), delegated_permissions.end(),
                     other.delegated_permissions.begin());
diff --git a/chromium/content/common/frame_owner_properties.h b/chromium/content/common/frame_owner_properties.h
index 157c82334dd..2ead2790a57 100644
--- a/chromium/content/common/frame_owner_properties.h
+++ b/chromium/content/common/frame_owner_properties.h
@@ -34,6 +34,7 @@ struct CONTENT_EXPORT FrameOwnerProperties {
   int margin_width;
   int margin_height;
   bool allow_fullscreen;
+  bool allow_payment_request;
 
   // An experimental attribute to be used by a parent frame to enforce CSP on a
   // subframe. This is different from replicated CSP headers kept in
diff --git a/chromium/content/common/gamepad_param_traits.h b/chromium/content/common/gamepad_param_traits.h
index 99576803b62..a06e79f7d9d 100644
--- a/chromium/content/common/gamepad_param_traits.h
+++ b/chromium/content/common/gamepad_param_traits.h
@@ -18,8 +18,6 @@ namespace blink { class WebGamepad; }
 
 namespace IPC {
 
-class Message;
-
 template <>
 struct ParamTraits<blink::WebGamepad> {
   typedef blink::WebGamepad param_type;
diff --git a/chromium/content/common/gpu/client/context_provider_command_buffer.cc b/chromium/content/common/gpu/client/context_provider_command_buffer.cc
index e717ac253b3..74bbf375cae 100644
--- a/chromium/content/common/gpu/client/context_provider_command_buffer.cc
+++ b/chromium/content/common/gpu/client/context_provider_command_buffer.cc
@@ -13,8 +13,10 @@
 
 #include "base/callback_helpers.h"
 #include "base/command_line.h"
+#include "base/optional.h"
 #include "base/strings/stringprintf.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "base/trace_event/memory_dump_manager.h"
 #include "cc/output/context_cache_controller.h"
 #include "cc/output/managed_memory_policy.h"
 #include "content/common/gpu/client/command_buffer_metrics.h"
@@ -27,7 +29,11 @@
 #include "gpu/ipc/client/command_buffer_proxy_impl.h"
 #include "gpu/ipc/client/gpu_channel_host.h"
 #include "gpu/skia_bindings/grcontext_for_gles2_interface.h"
+#include "third_party/skia/include/core/SkTraceMemoryDump.h"
 #include "third_party/skia/include/gpu/GrContext.h"
+#include "ui/gl/trace_util.h"
+
+class SkDiscardableMemory;
 
 namespace {
 
@@ -47,7 +53,96 @@ class AutoSet {
   bool* b_;
   const bool set_;
 };
-}
+
+// Derives from SkTraceMemoryDump and implements graphics specific memory
+// backing functionality.
+class SkiaGpuTraceMemoryDump : public SkTraceMemoryDump {
+ public:
+  // This should never outlive the provided ProcessMemoryDump, as it should
+  // always be scoped to a single OnMemoryDump funciton call.
+  explicit SkiaGpuTraceMemoryDump(base::trace_event::ProcessMemoryDump* pmd,
+                                  uint64_t share_group_tracing_guid)
+      : pmd_(pmd), share_group_tracing_guid_(share_group_tracing_guid) {}
+
+  // Overridden from SkTraceMemoryDump:
+  void dumpNumericValue(const char* dump_name,
+                        const char* value_name,
+                        const char* units,
+                        uint64_t value) override {
+    auto* dump = GetOrCreateAllocatorDump(dump_name);
+    dump->AddScalar(value_name, units, value);
+  }
+
+  void setMemoryBacking(const char* dump_name,
+                        const char* backing_type,
+                        const char* backing_object_id) override {
+    const uint64_t tracing_process_id =
+        base::trace_event::MemoryDumpManager::GetInstance()
+            ->GetTracingProcessId();
+
+    // For uniformity, skia provides this value as a string. Convert back to a
+    // uint32_t.
+    uint32_t gl_id =
+        std::strtoul(backing_object_id, nullptr /* str_end */, 10 /* base */);
+
+    // Constants used by SkiaGpuTraceMemoryDump to identify different memory
+    // types.
+    const char* kGLTextureBackingType = "gl_texture";
+    const char* kGLBufferBackingType = "gl_buffer";
+    const char* kGLRenderbufferBackingType = "gl_renderbuffer";
+
+    // Populated in if statements below.
+    base::trace_event::MemoryAllocatorDumpGuid guid;
+
+    if (strcmp(backing_type, kGLTextureBackingType) == 0) {
+      guid = gl::GetGLTextureClientGUIDForTracing(share_group_tracing_guid_,
+                                                  gl_id);
+    } else if (strcmp(backing_type, kGLBufferBackingType) == 0) {
+      guid = gl::GetGLBufferGUIDForTracing(tracing_process_id, gl_id);
+    } else if (strcmp(backing_type, kGLRenderbufferBackingType) == 0) {
+      guid = gl::GetGLRenderbufferGUIDForTracing(tracing_process_id, gl_id);
+    }
+
+    if (!guid.empty()) {
+      pmd_->CreateSharedGlobalAllocatorDump(guid);
+
+      auto* dump = GetOrCreateAllocatorDump(dump_name);
+
+      const int kImportance = 2;
+      pmd_->AddOwnershipEdge(dump->guid(), guid, kImportance);
+    }
+  }
+
+  void setDiscardableMemoryBacking(
+      const char* dump_name,
+      const SkDiscardableMemory& discardable_memory_object) override {
+    // We don't use this class for dumping discardable memory.
+    NOTREACHED();
+  }
+
+  LevelOfDetail getRequestedDetails() const override {
+    // TODO(ssid): Use MemoryDumpArgs to create light dumps when requested
+    // (crbug.com/499731).
+    return kObjectsBreakdowns_LevelOfDetail;
+  }
+
+ private:
+  // Helper to create allocator dumps.
+  base::trace_event::MemoryAllocatorDump* GetOrCreateAllocatorDump(
+      const char* dump_name) {
+    auto* dump = pmd_->GetAllocatorDump(dump_name);
+    if (!dump)
+      dump = pmd_->CreateAllocatorDump(dump_name);
+    return dump;
+  }
+
+  base::trace_event::ProcessMemoryDump* pmd_;
+  uint64_t share_group_tracing_guid_;
+
+  DISALLOW_COPY_AND_ASSIGN(SkiaGpuTraceMemoryDump);
+};
+
+}  // namespace
 
 namespace content {
 
@@ -102,6 +197,9 @@ ContextProviderCommandBuffer::~ContextProviderCommandBuffer() {
     command_buffer_->SetLock(nullptr);
     // Disconnect lost callbacks during destruction.
     gles2_impl_->SetLostContextCallback(base::Closure());
+    // Unregister memory dump provider.
+    base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
+        this);
   }
 }
 
@@ -131,6 +229,11 @@ bool ContextProviderCommandBuffer::BindToCurrentThread() {
   // Early outs should report failure.
   AutoSet set_bind_failed(&bind_failed_, true);
 
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner =
+      default_task_runner_;
+  if (!task_runner)
+    task_runner = base::ThreadTaskRunnerHandle::Get();
+
   // It's possible to be running BindToCurrentThread on two contexts
   // on different threads at the same time, but which will be in the same share
   // group. To ensure they end up in the same group, hold the lock on the
@@ -152,10 +255,6 @@ bool ContextProviderCommandBuffer::BindToCurrentThread() {
 
     // This command buffer is a client-side proxy to the command buffer in the
     // GPU process.
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner =
-        default_task_runner_;
-    if (!task_runner)
-      task_runner = base::ThreadTaskRunnerHandle::Get();
     command_buffer_ = gpu::CommandBufferProxyImpl::Create(
         std::move(channel_), surface_handle_, shared_command_buffer, stream_id_,
         stream_priority_, attributes_, active_url_, task_runner);
@@ -217,8 +316,8 @@ bool ContextProviderCommandBuffer::BindToCurrentThread() {
 
     shared_providers_->list.push_back(this);
 
-    cache_controller_.reset(new cc::ContextCacheController(
-        gles2_impl_.get(), std::move(task_runner)));
+    cache_controller_.reset(
+        new cc::ContextCacheController(gles2_impl_.get(), task_runner));
   }
   set_bind_failed.Reset();
   bind_succeeded_ = true;
@@ -252,6 +351,8 @@ bool ContextProviderCommandBuffer::BindToCurrentThread() {
     command_buffer_->SetLock(&context_lock_);
     cache_controller_->SetLock(&context_lock_);
   }
+  base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
+      this, "ContextProviderCommandBuffer", std::move(task_runner));
   return true;
 }
 
@@ -342,4 +443,23 @@ void ContextProviderCommandBuffer::SetLostContextCallback(
   lost_context_callback_ = lost_context_callback;
 }
 
+bool ContextProviderCommandBuffer::OnMemoryDump(
+    const base::trace_event::MemoryDumpArgs& args,
+    base::trace_event::ProcessMemoryDump* pmd) {
+  DCHECK(bind_succeeded_);
+  if (!gr_context_)
+    return false;
+
+  base::Optional<base::AutoLock> hold;
+  if (support_locking_)
+    hold.emplace(context_lock_);
+
+  context_thread_checker_.DetachFromThread();
+  SkiaGpuTraceMemoryDump trace_memory_dump(
+      pmd, gles2_impl_->ShareGroupTracingGUID());
+  gr_context_->get()->dumpMemoryStatistics(&trace_memory_dump);
+  context_thread_checker_.DetachFromThread();
+  return true;
+}
+
 }  // namespace content
diff --git a/chromium/content/common/gpu/client/context_provider_command_buffer.h b/chromium/content/common/gpu/client/context_provider_command_buffer.h
index edc279bbdd0..7e2900fbba1 100644
--- a/chromium/content/common/gpu/client/context_provider_command_buffer.h
+++ b/chromium/content/common/gpu/client/context_provider_command_buffer.h
@@ -14,6 +14,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_checker.h"
+#include "base/trace_event/memory_dump_provider.h"
 #include "cc/output/context_provider.h"
 #include "content/common/content_export.h"
 #include "content/common/gpu/client/command_buffer_metrics.h"
@@ -40,12 +41,12 @@ class GrContextForGLES2Interface;
 }
 
 namespace content {
-class WebGraphicsContext3DCommandBufferImpl;
 
 // Implementation of cc::ContextProvider that provides a GL implementation over
 // command buffer to the GPU process.
 class CONTENT_EXPORT ContextProviderCommandBuffer
-    : NON_EXPORTED_BASE(public cc::ContextProvider) {
+    : NON_EXPORTED_BASE(public cc::ContextProvider),
+      public base::trace_event::MemoryDumpProvider {
  public:
   ContextProviderCommandBuffer(
       scoped_refptr<gpu::GpuChannelHost> channel,
@@ -78,6 +79,10 @@ class CONTENT_EXPORT ContextProviderCommandBuffer
   void SetLostContextCallback(
       const LostContextCallback& lost_context_callback) override;
 
+  // base::trace_event::MemoryDumpProvider implementation.
+  bool OnMemoryDump(const base::trace_event::MemoryDumpArgs& args,
+                    base::trace_event::ProcessMemoryDump* pmd) override;
+
   // Set the default task runner for command buffers to use for handling IPCs.
   // If not specified, this will be the ThreadTaskRunner for the thread on
   // which BindToThread is called.
diff --git a/chromium/content/common/gpu_host_messages.h b/chromium/content/common/gpu_host_messages.h
index 2e09001fe30..f8561565fea 100644
--- a/chromium/content/common/gpu_host_messages.h
+++ b/chromium/content/common/gpu_host_messages.h
@@ -74,6 +74,7 @@ IPC_STRUCT_TRAITS_BEGIN(gpu::GpuPreferences)
 #endif
 #if defined(OS_WIN)
   IPC_STRUCT_TRAITS_MEMBER(enable_accelerated_vpx_decode)
+  IPC_STRUCT_TRAITS_MEMBER(enable_low_latency_dxva)
   IPC_STRUCT_TRAITS_MEMBER(enable_zero_copy_dxgi_video)
   IPC_STRUCT_TRAITS_MEMBER(enable_nv12_dxgi_video)
 #endif
@@ -85,18 +86,18 @@ IPC_STRUCT_TRAITS_BEGIN(gpu::GpuPreferences)
   IPC_STRUCT_TRAITS_MEMBER(enable_gpu_command_logging)
   IPC_STRUCT_TRAITS_MEMBER(enable_gpu_debugging)
   IPC_STRUCT_TRAITS_MEMBER(enable_gpu_service_logging_gpu)
+  IPC_STRUCT_TRAITS_MEMBER(enable_gpu_driver_debug_logging)
   IPC_STRUCT_TRAITS_MEMBER(disable_gpu_program_cache)
   IPC_STRUCT_TRAITS_MEMBER(enforce_gl_minimums)
   IPC_STRUCT_TRAITS_MEMBER(force_gpu_mem_available)
   IPC_STRUCT_TRAITS_MEMBER(gpu_program_cache_size)
   IPC_STRUCT_TRAITS_MEMBER(disable_gpu_shader_disk_cache)
-  IPC_STRUCT_TRAITS_MEMBER(enable_share_group_async_texture_upload)
   IPC_STRUCT_TRAITS_MEMBER(enable_threaded_texture_mailboxes)
   IPC_STRUCT_TRAITS_MEMBER(gl_shader_interm_output)
   IPC_STRUCT_TRAITS_MEMBER(emulate_shader_precision)
   IPC_STRUCT_TRAITS_MEMBER(enable_gpu_service_logging)
   IPC_STRUCT_TRAITS_MEMBER(enable_gpu_service_tracing)
-  IPC_STRUCT_TRAITS_MEMBER(enable_unsafe_es3_apis)
+  IPC_STRUCT_TRAITS_MEMBER(enable_es3_apis)
   IPC_STRUCT_TRAITS_MEMBER(use_passthrough_cmd_decoder)
 IPC_STRUCT_TRAITS_END()
 
diff --git a/chromium/content/common/host_discardable_shared_memory_manager.cc b/chromium/content/common/host_discardable_shared_memory_manager.cc
deleted file mode 100644
index e349fca4171..00000000000
--- a/chromium/content/common/host_discardable_shared_memory_manager.cc
+++ /dev/null
@@ -1,580 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/host_discardable_shared_memory_manager.h"
-
-#include <algorithm>
-#include <utility>
-
-#include "base/atomic_sequence_num.h"
-#include "base/bind.h"
-#include "base/callback.h"
-#include "base/debug/crash_logging.h"
-#include "base/lazy_instance.h"
-#include "base/macros.h"
-#include "base/memory/discardable_memory.h"
-#include "base/memory/memory_coordinator_client_registry.h"
-#include "base/memory/ptr_util.h"
-#include "base/numerics/safe_math.h"
-#include "base/process/memory.h"
-#include "base/strings/string_number_conversions.h"
-#include "base/strings/stringprintf.h"
-#include "base/sys_info.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "base/trace_event/memory_allocator_dump.h"
-#include "base/trace_event/memory_dump_manager.h"
-#include "base/trace_event/process_memory_dump.h"
-#include "base/trace_event/trace_event.h"
-#include "build/build_config.h"
-#include "content/common/child_process_host_impl.h"
-#include "content/common/discardable_shared_memory_heap.h"
-#include "content/public/common/child_process_host.h"
-
-#if defined(OS_LINUX)
-#include "base/files/file_path.h"
-#include "base/files/file_util.h"
-#include "base/metrics/histogram_macros.h"
-#endif
-
-namespace content {
-namespace {
-
-class DiscardableMemoryImpl : public base::DiscardableMemory {
- public:
-  DiscardableMemoryImpl(
-      std::unique_ptr<base::DiscardableSharedMemory> shared_memory,
-      const base::Closure& deleted_callback)
-      : shared_memory_(std::move(shared_memory)),
-        deleted_callback_(deleted_callback),
-        is_locked_(true) {}
-
-  ~DiscardableMemoryImpl() override {
-    if (is_locked_)
-      shared_memory_->Unlock(0, 0);
-
-    deleted_callback_.Run();
-  }
-
-  // Overridden from base::DiscardableMemory:
-  bool Lock() override {
-    DCHECK(!is_locked_);
-
-    if (shared_memory_->Lock(0, 0) != base::DiscardableSharedMemory::SUCCESS)
-      return false;
-
-    is_locked_ = true;
-    return true;
-  }
-  void Unlock() override {
-    DCHECK(is_locked_);
-
-    shared_memory_->Unlock(0, 0);
-    is_locked_ = false;
-  }
-  void* data() const override {
-    DCHECK(is_locked_);
-    return shared_memory_->memory();
-  }
-
-  base::trace_event::MemoryAllocatorDump* CreateMemoryAllocatorDump(
-      const char* name,
-      base::trace_event::ProcessMemoryDump* pmd) const override {
-    // The memory could have been purged, but we still create a dump with
-    // mapped_size. So, the size can be inaccurate.
-    base::trace_event::MemoryAllocatorDump* dump =
-        pmd->CreateAllocatorDump(name);
-    dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
-                    base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                    shared_memory_->mapped_size());
-    return dump;
-  }
-
- private:
-  std::unique_ptr<base::DiscardableSharedMemory> shared_memory_;
-  const base::Closure deleted_callback_;
-  bool is_locked_;
-
-  DISALLOW_COPY_AND_ASSIGN(DiscardableMemoryImpl);
-};
-
-// Returns the default memory limit to use for discardable memory, taking
-// the amount physical memory available and other platform specific constraints
-// into account.
-int64_t GetDefaultMemoryLimit() {
-  const int kMegabyte = 1024 * 1024;
-
-#if defined(OS_ANDROID)
-  // Limits the number of FDs used to 32, assuming a 4MB allocation size.
-  int64_t max_default_memory_limit = 128 * kMegabyte;
-#else
-  int64_t max_default_memory_limit = 512 * kMegabyte;
-#endif
-
-  // Use 1/8th of discardable memory on low-end devices.
-  if (base::SysInfo::IsLowEndDevice())
-    max_default_memory_limit /= 8;
-
-#if defined(OS_LINUX)
-  base::FilePath shmem_dir;
-  if (base::GetShmemTempDir(false, &shmem_dir)) {
-    int64_t shmem_dir_amount_of_free_space =
-        base::SysInfo::AmountOfFreeDiskSpace(shmem_dir);
-    DCHECK_GT(shmem_dir_amount_of_free_space, 0);
-    int64_t shmem_dir_amount_of_free_space_mb =
-        shmem_dir_amount_of_free_space / kMegabyte;
-
-    UMA_HISTOGRAM_CUSTOM_COUNTS("Memory.ShmemDir.AmountOfFreeSpace",
-                                shmem_dir_amount_of_free_space_mb, 1,
-                                4 * 1024,  // 4 GB
-                                50);
-
-    if (shmem_dir_amount_of_free_space_mb < 64) {
-      LOG(WARNING) << "Less than 64MB of free space in temporary directory for "
-                      "shared memory files: "
-                   << shmem_dir_amount_of_free_space_mb;
-    }
-
-    // Allow 1/2 of available shmem dir space to be used for discardable memory.
-    max_default_memory_limit =
-        std::min(max_default_memory_limit, shmem_dir_amount_of_free_space / 2);
-  }
-#endif
-
-  // Allow 25% of physical memory to be used for discardable memory.
-  return std::min(max_default_memory_limit,
-                  base::SysInfo::AmountOfPhysicalMemory() / 4);
-}
-
-base::LazyInstance<HostDiscardableSharedMemoryManager>
-    g_discardable_shared_memory_manager = LAZY_INSTANCE_INITIALIZER;
-
-const int kEnforceMemoryPolicyDelayMs = 1000;
-
-// Global atomic to generate unique discardable shared memory IDs.
-base::StaticAtomicSequenceNumber g_next_discardable_shared_memory_id;
-
-}  // namespace
-
-HostDiscardableSharedMemoryManager::MemorySegment::MemorySegment(
-    std::unique_ptr<base::DiscardableSharedMemory> memory)
-    : memory_(std::move(memory)) {}
-
-HostDiscardableSharedMemoryManager::MemorySegment::~MemorySegment() {
-}
-
-HostDiscardableSharedMemoryManager::HostDiscardableSharedMemoryManager()
-    : default_memory_limit_(GetDefaultMemoryLimit()),
-      memory_limit_(default_memory_limit_),
-      bytes_allocated_(0),
-      memory_pressure_listener_(new base::MemoryPressureListener(
-          base::Bind(&HostDiscardableSharedMemoryManager::OnMemoryPressure,
-                     base::Unretained(this)))),
-      // Current thread might not have a task runner in tests.
-      enforce_memory_policy_task_runner_(base::ThreadTaskRunnerHandle::Get()),
-      enforce_memory_policy_pending_(false),
-      weak_ptr_factory_(this) {
-  DCHECK_NE(memory_limit_, 0u);
-  enforce_memory_policy_callback_ =
-      base::Bind(&HostDiscardableSharedMemoryManager::EnforceMemoryPolicy,
-                 weak_ptr_factory_.GetWeakPtr());
-  base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
-      this, "HostDiscardableSharedMemoryManager",
-      base::ThreadTaskRunnerHandle::Get());
-  base::MemoryCoordinatorClientRegistry::GetInstance()->Register(this);
-}
-
-HostDiscardableSharedMemoryManager::~HostDiscardableSharedMemoryManager() {
-  base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
-      this);
-}
-
-HostDiscardableSharedMemoryManager*
-HostDiscardableSharedMemoryManager::current() {
-  return g_discardable_shared_memory_manager.Pointer();
-}
-
-std::unique_ptr<base::DiscardableMemory>
-HostDiscardableSharedMemoryManager::AllocateLockedDiscardableMemory(
-    size_t size) {
-  DCHECK_NE(size, 0u);
-
-  DiscardableSharedMemoryId new_id =
-      g_next_discardable_shared_memory_id.GetNext();
-  base::ProcessHandle current_process_handle = base::GetCurrentProcessHandle();
-
-  // Note: Use DiscardableSharedMemoryHeap for in-process allocation
-  // of discardable memory if the cost of each allocation is too high.
-  base::SharedMemoryHandle handle;
-  AllocateLockedDiscardableSharedMemory(current_process_handle,
-                                        ChildProcessHost::kInvalidUniqueID,
-                                        size, new_id, &handle);
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory(handle));
-  if (!memory->Map(size))
-    base::TerminateBecauseOutOfMemory(size);
-  // Close file descriptor to avoid running out.
-  memory->Close();
-  return base::MakeUnique<DiscardableMemoryImpl>(
-      std::move(memory),
-      base::Bind(
-          &HostDiscardableSharedMemoryManager::DeletedDiscardableSharedMemory,
-          base::Unretained(this), new_id, ChildProcessHost::kInvalidUniqueID));
-}
-
-bool HostDiscardableSharedMemoryManager::OnMemoryDump(
-    const base::trace_event::MemoryDumpArgs& args,
-    base::trace_event::ProcessMemoryDump* pmd) {
-  if (args.level_of_detail ==
-      base::trace_event::MemoryDumpLevelOfDetail::BACKGROUND) {
-    base::trace_event::MemoryAllocatorDump* total_dump =
-        pmd->CreateAllocatorDump("discardable");
-    total_dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
-                          base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                          GetBytesAllocated());
-    return true;
-  }
-
-  base::AutoLock lock(lock_);
-  for (const auto& process_entry : processes_) {
-    const int child_process_id = process_entry.first;
-    const MemorySegmentMap& process_segments = process_entry.second;
-    for (const auto& segment_entry : process_segments) {
-      const int segment_id = segment_entry.first;
-      const MemorySegment* segment = segment_entry.second.get();
-      if (!segment->memory()->mapped_size())
-        continue;
-
-      // The "size" will be inherited form the shared global dump.
-      std::string dump_name = base::StringPrintf(
-          "discardable/process_%x/segment_%d", child_process_id, segment_id);
-      base::trace_event::MemoryAllocatorDump* dump =
-          pmd->CreateAllocatorDump(dump_name);
-
-      dump->AddScalar("virtual_size",
-                      base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                      segment->memory()->mapped_size());
-
-      // Host can only tell if whole segment is locked or not.
-      dump->AddScalar(
-          "locked_size", base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-          segment->memory()->IsMemoryLocked() ? segment->memory()->mapped_size()
-                                              : 0u);
-
-      // Create the cross-process ownership edge. If the child creates a
-      // corresponding dump for the same segment, this will avoid to
-      // double-count them in tracing. If, instead, no other process will emit a
-      // dump with the same guid, the segment will be accounted to the browser.
-      const uint64_t child_tracing_process_id =
-          ChildProcessHostImpl::ChildProcessUniqueIdToTracingProcessId(
-              child_process_id);
-      base::trace_event::MemoryAllocatorDumpGuid shared_segment_guid =
-          DiscardableSharedMemoryHeap::GetSegmentGUIDForTracing(
-              child_tracing_process_id, segment_id);
-      pmd->CreateSharedGlobalAllocatorDump(shared_segment_guid);
-      pmd->AddOwnershipEdge(dump->guid(), shared_segment_guid);
-
-#if defined(COUNT_RESIDENT_BYTES_SUPPORTED)
-      if (args.level_of_detail ==
-          base::trace_event::MemoryDumpLevelOfDetail::DETAILED) {
-        size_t resident_size =
-            base::trace_event::ProcessMemoryDump::CountResidentBytes(
-                segment->memory()->memory(), segment->memory()->mapped_size());
-
-        // This is added to the global dump since it has to be attributed to
-        // both the allocator dumps involved.
-        pmd->GetSharedGlobalAllocatorDump(shared_segment_guid)
-            ->AddScalar("resident_size",
-                        base::trace_event::MemoryAllocatorDump::kUnitsBytes,
-                        static_cast<uint64_t>(resident_size));
-      }
-#endif  // defined(COUNT_RESIDENT_BYTES_SUPPORTED)
-    }
-  }
-  return true;
-}
-
-void HostDiscardableSharedMemoryManager::
-    AllocateLockedDiscardableSharedMemoryForChild(
-        base::ProcessHandle process_handle,
-        int child_process_id,
-        size_t size,
-        DiscardableSharedMemoryId id,
-        base::SharedMemoryHandle* shared_memory_handle) {
-  AllocateLockedDiscardableSharedMemory(process_handle, child_process_id, size,
-                                        id, shared_memory_handle);
-}
-
-void HostDiscardableSharedMemoryManager::ChildDeletedDiscardableSharedMemory(
-    DiscardableSharedMemoryId id,
-    int child_process_id) {
-  DeletedDiscardableSharedMemory(id, child_process_id);
-}
-
-void HostDiscardableSharedMemoryManager::ProcessRemoved(int child_process_id) {
-  base::AutoLock lock(lock_);
-
-  ProcessMap::iterator process_it = processes_.find(child_process_id);
-  if (process_it == processes_.end())
-    return;
-
-  size_t bytes_allocated_before_releasing_memory = bytes_allocated_;
-
-  for (auto& segment_it : process_it->second)
-    ReleaseMemory(segment_it.second->memory());
-
-  processes_.erase(process_it);
-
-  if (bytes_allocated_ != bytes_allocated_before_releasing_memory)
-    BytesAllocatedChanged(bytes_allocated_);
-}
-
-void HostDiscardableSharedMemoryManager::SetMemoryLimit(size_t limit) {
-  base::AutoLock lock(lock_);
-
-  memory_limit_ = limit;
-  ReduceMemoryUsageUntilWithinMemoryLimit();
-}
-
-void HostDiscardableSharedMemoryManager::EnforceMemoryPolicy() {
-  base::AutoLock lock(lock_);
-
-  enforce_memory_policy_pending_ = false;
-  ReduceMemoryUsageUntilWithinMemoryLimit();
-}
-
-size_t HostDiscardableSharedMemoryManager::GetBytesAllocated() {
-  base::AutoLock lock(lock_);
-
-  return bytes_allocated_;
-}
-
-void HostDiscardableSharedMemoryManager::OnMemoryStateChange(
-    base::MemoryState state) {
-  switch (state) {
-    case base::MemoryState::NORMAL:
-      SetMemoryLimit(default_memory_limit_);
-      break;
-    case base::MemoryState::THROTTLED:
-      SetMemoryLimit(0);
-      break;
-    case base::MemoryState::SUSPENDED:
-      // Note that SUSPENDED never occurs in the main browser process so far.
-      // Fall through.
-    case base::MemoryState::UNKNOWN:
-      NOTREACHED();
-      break;
-  }
-}
-
-void HostDiscardableSharedMemoryManager::AllocateLockedDiscardableSharedMemory(
-    base::ProcessHandle process_handle,
-    int client_process_id,
-    size_t size,
-    DiscardableSharedMemoryId id,
-    base::SharedMemoryHandle* shared_memory_handle) {
-  base::AutoLock lock(lock_);
-
-  // Make sure |id| is not already in use.
-  MemorySegmentMap& process_segments = processes_[client_process_id];
-  if (process_segments.find(id) != process_segments.end()) {
-    LOG(ERROR) << "Invalid discardable shared memory ID";
-    *shared_memory_handle = base::SharedMemory::NULLHandle();
-    return;
-  }
-
-  // Memory usage must be reduced to prevent the addition of |size| from
-  // taking usage above the limit. Usage should be reduced to 0 in cases
-  // where |size| is greater than the limit.
-  size_t limit = 0;
-  // Note: the actual mapped size can be larger than requested and cause
-  // |bytes_allocated_| to temporarily be larger than |memory_limit_|. The
-  // error is minimized by incrementing |bytes_allocated_| with the actual
-  // mapped size rather than |size| below.
-  if (size < memory_limit_)
-    limit = memory_limit_ - size;
-
-  if (bytes_allocated_ > limit)
-    ReduceMemoryUsageUntilWithinLimit(limit);
-
-  std::unique_ptr<base::DiscardableSharedMemory> memory(
-      new base::DiscardableSharedMemory);
-  if (!memory->CreateAndMap(size)) {
-    *shared_memory_handle = base::SharedMemory::NULLHandle();
-    return;
-  }
-
-  if (!memory->ShareToProcess(process_handle, shared_memory_handle)) {
-    LOG(ERROR) << "Cannot share discardable memory segment";
-    *shared_memory_handle = base::SharedMemory::NULLHandle();
-    return;
-  }
-
-  // Close file descriptor to avoid running out.
-  memory->Close();
-
-  base::CheckedNumeric<size_t> checked_bytes_allocated = bytes_allocated_;
-  checked_bytes_allocated += memory->mapped_size();
-  if (!checked_bytes_allocated.IsValid()) {
-    *shared_memory_handle = base::SharedMemory::NULLHandle();
-    return;
-  }
-
-  bytes_allocated_ = checked_bytes_allocated.ValueOrDie();
-  BytesAllocatedChanged(bytes_allocated_);
-
-  scoped_refptr<MemorySegment> segment(new MemorySegment(std::move(memory)));
-  process_segments[id] = segment.get();
-  segments_.push_back(segment.get());
-  std::push_heap(segments_.begin(), segments_.end(), CompareMemoryUsageTime);
-
-  if (bytes_allocated_ > memory_limit_)
-    ScheduleEnforceMemoryPolicy();
-}
-
-void HostDiscardableSharedMemoryManager::DeletedDiscardableSharedMemory(
-    DiscardableSharedMemoryId id,
-    int client_process_id) {
-  base::AutoLock lock(lock_);
-
-  MemorySegmentMap& process_segments = processes_[client_process_id];
-
-  MemorySegmentMap::iterator segment_it = process_segments.find(id);
-  if (segment_it == process_segments.end()) {
-    LOG(ERROR) << "Invalid discardable shared memory ID";
-    return;
-  }
-
-  size_t bytes_allocated_before_releasing_memory = bytes_allocated_;
-
-  ReleaseMemory(segment_it->second->memory());
-
-  process_segments.erase(segment_it);
-
-  if (bytes_allocated_ != bytes_allocated_before_releasing_memory)
-    BytesAllocatedChanged(bytes_allocated_);
-}
-
-void HostDiscardableSharedMemoryManager::OnMemoryPressure(
-    base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level) {
-  base::AutoLock lock(lock_);
-
-  switch (memory_pressure_level) {
-    case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_NONE:
-      break;
-    case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_MODERATE:
-      // Purge memory until usage is within half of |memory_limit_|.
-      ReduceMemoryUsageUntilWithinLimit(memory_limit_ / 2);
-      break;
-    case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_CRITICAL:
-      // Purge everything possible when pressure is critical.
-      ReduceMemoryUsageUntilWithinLimit(0);
-      break;
-  }
-}
-
-void
-HostDiscardableSharedMemoryManager::ReduceMemoryUsageUntilWithinMemoryLimit() {
-  lock_.AssertAcquired();
-
-  if (bytes_allocated_ <= memory_limit_)
-    return;
-
-  ReduceMemoryUsageUntilWithinLimit(memory_limit_);
-  if (bytes_allocated_ > memory_limit_)
-    ScheduleEnforceMemoryPolicy();
-}
-
-void HostDiscardableSharedMemoryManager::ReduceMemoryUsageUntilWithinLimit(
-    size_t limit) {
-  TRACE_EVENT1("renderer_host",
-               "HostDiscardableSharedMemoryManager::"
-               "ReduceMemoryUsageUntilWithinLimit",
-               "bytes_allocated",
-               bytes_allocated_);
-
-  // Usage time of currently locked segments are updated to this time and
-  // we stop eviction attempts as soon as we come across a segment that we've
-  // previously tried to evict but was locked.
-  base::Time current_time = Now();
-
-  lock_.AssertAcquired();
-  size_t bytes_allocated_before_purging = bytes_allocated_;
-  while (!segments_.empty()) {
-    if (bytes_allocated_ <= limit)
-      break;
-
-    // Stop eviction attempts when the LRU segment is currently in use.
-    if (segments_.front()->memory()->last_known_usage() >= current_time)
-      break;
-
-    std::pop_heap(segments_.begin(), segments_.end(), CompareMemoryUsageTime);
-    scoped_refptr<MemorySegment> segment = segments_.back();
-    segments_.pop_back();
-
-    // Simply drop the reference and continue if memory has already been
-    // unmapped. This happens when a memory segment has been deleted by
-    // the client.
-    if (!segment->memory()->mapped_size())
-      continue;
-
-    // Attempt to purge LRU segment. When successful, released the memory.
-    if (segment->memory()->Purge(current_time)) {
-      ReleaseMemory(segment->memory());
-      continue;
-    }
-
-    // Add memory segment (with updated usage timestamp) back on heap after
-    // failed attempt to purge it.
-    segments_.push_back(segment.get());
-    std::push_heap(segments_.begin(), segments_.end(), CompareMemoryUsageTime);
-  }
-
-  if (bytes_allocated_ != bytes_allocated_before_purging)
-    BytesAllocatedChanged(bytes_allocated_);
-}
-
-void HostDiscardableSharedMemoryManager::ReleaseMemory(
-    base::DiscardableSharedMemory* memory) {
-  lock_.AssertAcquired();
-
-  size_t size = memory->mapped_size();
-  DCHECK_GE(bytes_allocated_, size);
-  bytes_allocated_ -= size;
-
-  // This will unmap the memory segment and drop our reference. The result
-  // is that the memory will be released to the OS if the child process is
-  // no longer referencing it.
-  // Note: We intentionally leave the segment in the |segments| vector to
-  // avoid reconstructing the heap. The element will be removed from the heap
-  // when its last usage time is older than all other segments.
-  memory->Unmap();
-  memory->Close();
-}
-
-void HostDiscardableSharedMemoryManager::BytesAllocatedChanged(
-    size_t new_bytes_allocated) const {
-  static const char kTotalDiscardableMemoryAllocatedKey[] =
-      "total-discardable-memory-allocated";
-  base::debug::SetCrashKeyValue(kTotalDiscardableMemoryAllocatedKey,
-                                base::Uint64ToString(new_bytes_allocated));
-}
-
-base::Time HostDiscardableSharedMemoryManager::Now() const {
-  return base::Time::Now();
-}
-
-void HostDiscardableSharedMemoryManager::ScheduleEnforceMemoryPolicy() {
-  lock_.AssertAcquired();
-
-  if (enforce_memory_policy_pending_)
-    return;
-
-  enforce_memory_policy_pending_ = true;
-  DCHECK(enforce_memory_policy_task_runner_);
-  enforce_memory_policy_task_runner_->PostDelayedTask(
-      FROM_HERE, enforce_memory_policy_callback_,
-      base::TimeDelta::FromMilliseconds(kEnforceMemoryPolicyDelayMs));
-}
-
-}  // namespace content
diff --git a/chromium/content/common/host_discardable_shared_memory_manager.h b/chromium/content/common/host_discardable_shared_memory_manager.h
deleted file mode 100644
index 59a939a0297..00000000000
--- a/chromium/content/common/host_discardable_shared_memory_manager.h
+++ /dev/null
@@ -1,154 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_HOST_DISCARDABLE_SHARED_MEMORY_MANAGER_H_
-#define CONTENT_COMMON_HOST_DISCARDABLE_SHARED_MEMORY_MANAGER_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include <memory>
-#include <vector>
-
-#include "base/callback.h"
-#include "base/containers/hash_tables.h"
-#include "base/format_macros.h"
-#include "base/macros.h"
-#include "base/memory/discardable_memory_allocator.h"
-#include "base/memory/discardable_shared_memory.h"
-#include "base/memory/memory_coordinator_client.h"
-#include "base/memory/memory_pressure_listener.h"
-#include "base/memory/ref_counted.h"
-#include "base/memory/shared_memory.h"
-#include "base/memory/weak_ptr.h"
-#include "base/process/process_handle.h"
-#include "base/synchronization/lock.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "base/trace_event/memory_dump_provider.h"
-#include "content/common/content_export.h"
-
-namespace content {
-typedef int32_t DiscardableSharedMemoryId;
-
-// Implementation of DiscardableMemoryAllocator that allocates and manages
-// discardable memory segments for the browser process and child processes.
-// This class is thread-safe and instances can safely be used on any thread.
-class CONTENT_EXPORT HostDiscardableSharedMemoryManager
-    : public base::DiscardableMemoryAllocator,
-      public base::trace_event::MemoryDumpProvider,
-      public base::MemoryCoordinatorClient {
- public:
-  HostDiscardableSharedMemoryManager();
-  ~HostDiscardableSharedMemoryManager() override;
-
-  // Returns a singleton instance.
-  static HostDiscardableSharedMemoryManager* current();
-
-  // Overridden from base::DiscardableMemoryAllocator:
-  std::unique_ptr<base::DiscardableMemory> AllocateLockedDiscardableMemory(
-      size_t size) override;
-
-  // Overridden from base::trace_event::MemoryDumpProvider:
-  bool OnMemoryDump(const base::trace_event::MemoryDumpArgs& args,
-                    base::trace_event::ProcessMemoryDump* pmd) override;
-
-  // This allocates a discardable memory segment for |process_handle|.
-  // A valid shared memory handle is returned on success.
-  void AllocateLockedDiscardableSharedMemoryForChild(
-      base::ProcessHandle process_handle,
-      int child_process_id,
-      size_t size,
-      DiscardableSharedMemoryId id,
-      base::SharedMemoryHandle* shared_memory_handle);
-
-  // Call this to notify the manager that child process associated with
-  // |child_process_id| has deleted discardable memory segment with |id|.
-  void ChildDeletedDiscardableSharedMemory(DiscardableSharedMemoryId id,
-                                           int child_process_id);
-
-  // Call this to notify the manager that child process associated with
-  // |child_process_id| has been removed. The manager will use this to release
-  // memory segments allocated for child process to the OS.
-  void ProcessRemoved(int child_process_id);
-
-  // The maximum number of bytes of memory that may be allocated. This will
-  // cause memory usage to be reduced if currently above |limit|.
-  void SetMemoryLimit(size_t limit);
-
-  // Reduce memory usage if above current memory limit.
-  void EnforceMemoryPolicy();
-
-  // Returns bytes of allocated discardable memory.
-  size_t GetBytesAllocated();
-
- private:
-  class MemorySegment : public base::RefCountedThreadSafe<MemorySegment> {
-   public:
-    MemorySegment(std::unique_ptr<base::DiscardableSharedMemory> memory);
-
-    base::DiscardableSharedMemory* memory() const { return memory_.get(); }
-
-   private:
-    friend class base::RefCountedThreadSafe<MemorySegment>;
-
-    ~MemorySegment();
-
-    std::unique_ptr<base::DiscardableSharedMemory> memory_;
-
-    DISALLOW_COPY_AND_ASSIGN(MemorySegment);
-  };
-
-  static bool CompareMemoryUsageTime(const scoped_refptr<MemorySegment>& a,
-                                     const scoped_refptr<MemorySegment>& b) {
-    // In this system, LRU memory segment is evicted first.
-    return a->memory()->last_known_usage() > b->memory()->last_known_usage();
-  }
-
-  // base::MemoryCoordinatorClient implementation:
-  void OnMemoryStateChange(base::MemoryState state) override;
-
-  void AllocateLockedDiscardableSharedMemory(
-      base::ProcessHandle process_handle,
-      int client_process_id,
-      size_t size,
-      DiscardableSharedMemoryId id,
-      base::SharedMemoryHandle* shared_memory_handle);
-  void DeletedDiscardableSharedMemory(DiscardableSharedMemoryId id,
-                                      int client_process_id);
-  void OnMemoryPressure(
-      base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level);
-  void ReduceMemoryUsageUntilWithinMemoryLimit();
-  void ReduceMemoryUsageUntilWithinLimit(size_t limit);
-  void ReleaseMemory(base::DiscardableSharedMemory* memory);
-  void BytesAllocatedChanged(size_t new_bytes_allocated) const;
-
-  // Virtual for tests.
-  virtual base::Time Now() const;
-  virtual void ScheduleEnforceMemoryPolicy();
-
-  base::Lock lock_;
-  typedef base::hash_map<DiscardableSharedMemoryId,
-                         scoped_refptr<MemorySegment>> MemorySegmentMap;
-  typedef base::hash_map<int, MemorySegmentMap> ProcessMap;
-  ProcessMap processes_;
-  // Note: The elements in |segments_| are arranged in such a way that they form
-  // a heap. The LRU memory segment always first.
-  typedef std::vector<scoped_refptr<MemorySegment>> MemorySegmentVector;
-  MemorySegmentVector segments_;
-  size_t default_memory_limit_;
-  size_t memory_limit_;
-  size_t bytes_allocated_;
-  std::unique_ptr<base::MemoryPressureListener> memory_pressure_listener_;
-  scoped_refptr<base::SingleThreadTaskRunner>
-      enforce_memory_policy_task_runner_;
-  base::Closure enforce_memory_policy_callback_;
-  bool enforce_memory_policy_pending_;
-  base::WeakPtrFactory<HostDiscardableSharedMemoryManager> weak_ptr_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(HostDiscardableSharedMemoryManager);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_HOST_DISCARDABLE_SHARED_MEMORY_MANAGER_H_
diff --git a/chromium/content/common/host_discardable_shared_memory_manager_unittest.cc b/chromium/content/common/host_discardable_shared_memory_manager_unittest.cc
deleted file mode 100644
index fcd39baa994..00000000000
--- a/chromium/content/common/host_discardable_shared_memory_manager_unittest.cc
+++ /dev/null
@@ -1,288 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/host_discardable_shared_memory_manager.h"
-
-#include <stddef.h>
-#include <stdint.h>
-#include <string.h>
-
-#include "base/threading/simple_thread.h"
-#include "content/public/common/child_process_host.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace content {
-namespace {
-
-class TestDiscardableSharedMemory : public base::DiscardableSharedMemory {
- public:
-  TestDiscardableSharedMemory() {}
-
-  explicit TestDiscardableSharedMemory(base::SharedMemoryHandle handle)
-      : DiscardableSharedMemory(handle) {}
-
-  void SetNow(base::Time now) { now_ = now; }
-
- private:
-  // Overriden from base::DiscardableSharedMemory:
-  base::Time Now() const override { return now_; }
-
-  base::Time now_;
-};
-
-class TestHostDiscardableSharedMemoryManager
-    : public HostDiscardableSharedMemoryManager {
- public:
-  TestHostDiscardableSharedMemoryManager()
-      : enforce_memory_policy_pending_(false) {}
-
-  void SetNow(base::Time now) { now_ = now; }
-
-  void set_enforce_memory_policy_pending(bool enforce_memory_policy_pending) {
-    enforce_memory_policy_pending_ = enforce_memory_policy_pending;
-  }
-  bool enforce_memory_policy_pending() const {
-    return enforce_memory_policy_pending_;
-  }
-
- private:
-  // Overriden from HostDiscardableSharedMemoryManager:
-  base::Time Now() const override { return now_; }
-  void ScheduleEnforceMemoryPolicy() override {
-    enforce_memory_policy_pending_ = true;
-  }
-
-  base::Time now_;
-  bool enforce_memory_policy_pending_;
-};
-
-class HostDiscardableSharedMemoryManagerTest : public testing::Test {
- protected:
-  // Overridden from testing::Test:
-  void SetUp() override {
-    manager_.reset(new TestHostDiscardableSharedMemoryManager);
-  }
-
-  // HostDiscardableSharedMemoryManager requires a message loop.
-  base::MessageLoop message_loop_;
-  std::unique_ptr<TestHostDiscardableSharedMemoryManager> manager_;
-};
-
-TEST_F(HostDiscardableSharedMemoryManagerTest, AllocateForChild) {
-  const int kDataSize = 1024;
-  uint8_t data[kDataSize];
-  memset(data, 0x80, kDataSize);
-
-  base::SharedMemoryHandle shared_handle;
-  manager_->AllocateLockedDiscardableSharedMemoryForChild(
-      base::GetCurrentProcessHandle(), ChildProcessHost::kInvalidUniqueID,
-      kDataSize, 0, &shared_handle);
-  ASSERT_TRUE(base::SharedMemory::IsHandleValid(shared_handle));
-
-  TestDiscardableSharedMemory memory(shared_handle);
-  bool rv = memory.Map(kDataSize);
-  ASSERT_TRUE(rv);
-
-  memcpy(memory.memory(), data, kDataSize);
-  memory.SetNow(base::Time::FromDoubleT(1));
-  memory.Unlock(0, 0);
-
-  ASSERT_EQ(base::DiscardableSharedMemory::SUCCESS, memory.Lock(0, 0));
-  EXPECT_EQ(memcmp(data, memory.memory(), kDataSize), 0);
-  memory.Unlock(0, 0);
-}
-
-TEST_F(HostDiscardableSharedMemoryManagerTest, Purge) {
-  const int kDataSize = 1024;
-
-  base::SharedMemoryHandle shared_handle1;
-  manager_->AllocateLockedDiscardableSharedMemoryForChild(
-      base::GetCurrentProcessHandle(), ChildProcessHost::kInvalidUniqueID,
-      kDataSize, 1, &shared_handle1);
-  ASSERT_TRUE(base::SharedMemory::IsHandleValid(shared_handle1));
-
-  TestDiscardableSharedMemory memory1(shared_handle1);
-  bool rv = memory1.Map(kDataSize);
-  ASSERT_TRUE(rv);
-
-  base::SharedMemoryHandle shared_handle2;
-  manager_->AllocateLockedDiscardableSharedMemoryForChild(
-      base::GetCurrentProcessHandle(), ChildProcessHost::kInvalidUniqueID,
-      kDataSize, 2, &shared_handle2);
-  ASSERT_TRUE(base::SharedMemory::IsHandleValid(shared_handle2));
-
-  TestDiscardableSharedMemory memory2(shared_handle2);
-  rv = memory2.Map(kDataSize);
-  ASSERT_TRUE(rv);
-
-  // Enough memory for both allocations.
-  manager_->SetNow(base::Time::FromDoubleT(1));
-  manager_->SetMemoryLimit(memory1.mapped_size() + memory2.mapped_size());
-
-  memory1.SetNow(base::Time::FromDoubleT(2));
-  memory1.Unlock(0, 0);
-  memory2.SetNow(base::Time::FromDoubleT(2));
-  memory2.Unlock(0, 0);
-
-  // Manager should not have to schedule another call to EnforceMemoryPolicy().
-  manager_->SetNow(base::Time::FromDoubleT(3));
-  manager_->EnforceMemoryPolicy();
-  EXPECT_FALSE(manager_->enforce_memory_policy_pending());
-
-  // Memory should still be resident.
-  EXPECT_TRUE(memory1.IsMemoryResident());
-  EXPECT_TRUE(memory2.IsMemoryResident());
-
-  auto lock_rv = memory1.Lock(0, 0);
-  EXPECT_EQ(base::DiscardableSharedMemory::SUCCESS, lock_rv);
-  lock_rv = memory2.Lock(0, 0);
-  EXPECT_EQ(base::DiscardableSharedMemory::SUCCESS, lock_rv);
-
-  memory1.SetNow(base::Time::FromDoubleT(4));
-  memory1.Unlock(0, 0);
-  memory2.SetNow(base::Time::FromDoubleT(5));
-  memory2.Unlock(0, 0);
-
-  // Just enough memory for one allocation.
-  manager_->SetNow(base::Time::FromDoubleT(6));
-  manager_->SetMemoryLimit(memory2.mapped_size());
-  EXPECT_FALSE(manager_->enforce_memory_policy_pending());
-
-  // LRU allocation should still be resident.
-  EXPECT_FALSE(memory1.IsMemoryResident());
-  EXPECT_TRUE(memory2.IsMemoryResident());
-
-  lock_rv = memory1.Lock(0, 0);
-  EXPECT_EQ(base::DiscardableSharedMemory::FAILED, lock_rv);
-  lock_rv = memory2.Lock(0, 0);
-  EXPECT_EQ(base::DiscardableSharedMemory::SUCCESS, lock_rv);
-}
-
-TEST_F(HostDiscardableSharedMemoryManagerTest, EnforceMemoryPolicy) {
-  const int kDataSize = 1024;
-
-  base::SharedMemoryHandle shared_handle;
-  manager_->AllocateLockedDiscardableSharedMemoryForChild(
-      base::GetCurrentProcessHandle(), ChildProcessHost::kInvalidUniqueID,
-      kDataSize, 0, &shared_handle);
-  ASSERT_TRUE(base::SharedMemory::IsHandleValid(shared_handle));
-
-  TestDiscardableSharedMemory memory(shared_handle);
-  bool rv = memory.Map(kDataSize);
-  ASSERT_TRUE(rv);
-
-  // Not enough memory for one allocation.
-  manager_->SetNow(base::Time::FromDoubleT(1));
-  manager_->SetMemoryLimit(memory.mapped_size() - 1);
-  // We need to enforce memory policy as our memory usage is currently above
-  // the limit.
-  EXPECT_TRUE(manager_->enforce_memory_policy_pending());
-
-  manager_->set_enforce_memory_policy_pending(false);
-  manager_->SetNow(base::Time::FromDoubleT(2));
-  manager_->EnforceMemoryPolicy();
-  // Still need to enforce memory policy as nothing can be purged.
-  EXPECT_TRUE(manager_->enforce_memory_policy_pending());
-
-  memory.SetNow(base::Time::FromDoubleT(3));
-  memory.Unlock(0, 0);
-
-  manager_->set_enforce_memory_policy_pending(false);
-  manager_->SetNow(base::Time::FromDoubleT(4));
-  manager_->EnforceMemoryPolicy();
-  // Memory policy should have successfully been enforced.
-  EXPECT_FALSE(manager_->enforce_memory_policy_pending());
-
-  EXPECT_EQ(base::DiscardableSharedMemory::FAILED, memory.Lock(0, 0));
-}
-
-TEST_F(HostDiscardableSharedMemoryManagerTest,
-       ReduceMemoryAfterSegmentHasBeenDeleted) {
-  const int kDataSize = 1024;
-
-  base::SharedMemoryHandle shared_handle1;
-  manager_->AllocateLockedDiscardableSharedMemoryForChild(
-      base::GetCurrentProcessHandle(), ChildProcessHost::kInvalidUniqueID,
-      kDataSize, 1, &shared_handle1);
-  ASSERT_TRUE(base::SharedMemory::IsHandleValid(shared_handle1));
-
-  TestDiscardableSharedMemory memory1(shared_handle1);
-  bool rv = memory1.Map(kDataSize);
-  ASSERT_TRUE(rv);
-
-  base::SharedMemoryHandle shared_handle2;
-  manager_->AllocateLockedDiscardableSharedMemoryForChild(
-      base::GetCurrentProcessHandle(), ChildProcessHost::kInvalidUniqueID,
-      kDataSize, 2, &shared_handle2);
-  ASSERT_TRUE(base::SharedMemory::IsHandleValid(shared_handle2));
-
-  TestDiscardableSharedMemory memory2(shared_handle2);
-  rv = memory2.Map(kDataSize);
-  ASSERT_TRUE(rv);
-
-  // Unlock and delete segment 1.
-  memory1.SetNow(base::Time::FromDoubleT(1));
-  memory1.Unlock(0, 0);
-  memory1.Unmap();
-  memory1.Close();
-  manager_->ChildDeletedDiscardableSharedMemory(
-      1, ChildProcessHost::kInvalidUniqueID);
-
-  // Make sure the manager is able to reduce memory after the segment 1 was
-  // deleted.
-  manager_->SetNow(base::Time::FromDoubleT(2));
-  manager_->SetMemoryLimit(0);
-
-  // Unlock segment 2.
-  memory2.SetNow(base::Time::FromDoubleT(3));
-  memory2.Unlock(0, 0);
-}
-
-class HostDiscardableSharedMemoryManagerScheduleEnforceMemoryPolicyTest
-    : public testing::Test {
- protected:
-  // Overridden from testing::Test:
-  void SetUp() override {
-    manager_.reset(new HostDiscardableSharedMemoryManager);
-  }
-
-  // HostDiscardableSharedMemoryManager requires a message loop.
-  base::MessageLoop message_loop_;
-  std::unique_ptr<HostDiscardableSharedMemoryManager> manager_;
-};
-
-class SetMemoryLimitRunner : public base::DelegateSimpleThread::Delegate {
- public:
-  SetMemoryLimitRunner(HostDiscardableSharedMemoryManager* manager,
-                       size_t limit)
-      : manager_(manager), limit_(limit) {}
-  ~SetMemoryLimitRunner() override {}
-
-  void Run() override { manager_->SetMemoryLimit(limit_); }
-
- private:
-  HostDiscardableSharedMemoryManager* const manager_;
-  const size_t limit_;
-};
-
-TEST_F(HostDiscardableSharedMemoryManagerScheduleEnforceMemoryPolicyTest,
-       SetMemoryLimitOnSimpleThread) {
-  const int kDataSize = 1024;
-
-  base::SharedMemoryHandle shared_handle;
-  manager_->AllocateLockedDiscardableSharedMemoryForChild(
-      base::GetCurrentProcessHandle(), ChildProcessHost::kInvalidUniqueID,
-      kDataSize, 0, &shared_handle);
-  ASSERT_TRUE(base::SharedMemory::IsHandleValid(shared_handle));
-
-  // Set the memory limit to a value that will require EnforceMemoryPolicy()
-  // to be schedule on a thread without a message loop.
-  SetMemoryLimitRunner runner(manager_.get(), kDataSize - 1);
-  base::DelegateSimpleThread thread(&runner, "memory_limit_setter");
-  thread.Start();
-  thread.Join();
-}
-
-}  // namespace
-}  // namespace content
diff --git a/chromium/content/common/host_zoom.mojom b/chromium/content/common/host_zoom.mojom
new file mode 100644
index 00000000000..1ae98adc440
--- /dev/null
+++ b/chromium/content/common/host_zoom.mojom
@@ -0,0 +1,12 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "url/mojo/url.mojom";
+
+interface HostZoom {
+  // Sets the host zoom level for the given url, called just before commit.
+  SetHostZoomLevel(url.mojom.Url url, double zoom_level);
+};
diff --git a/chromium/content/common/indexed_db/OWNERS b/chromium/content/common/indexed_db/OWNERS
index 442406e4f56..5169d173cb4 100644
--- a/chromium/content/common/indexed_db/OWNERS
+++ b/chromium/content/common/indexed_db/OWNERS
@@ -2,3 +2,7 @@ file://content/browser/indexed_db/OWNERS
 
 per-file *_messages*.h=set noparent
 per-file *_messages*.h=file://ipc/SECURITY_OWNERS
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
+per-file *_struct_traits*.*=set noparent
+per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/chromium/content/common/indexed_db/indexed_db.mojom b/chromium/content/common/indexed_db/indexed_db.mojom
new file mode 100644
index 00000000000..ad69a5abd75
--- /dev/null
+++ b/chromium/content/common/indexed_db/indexed_db.mojom
@@ -0,0 +1,240 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// TODO: This will move to //third_party/WebKit when //content/child/indexed_db
+// is deleted but for now this will depend on //content/common types and so
+// so belongs here.
+
+module indexed_db.mojom;
+
+import "mojo/common/common_custom_types.mojom";
+import "url/mojo/origin.mojom";
+
+[Native]
+enum CursorDirection;
+
+[Native]
+enum DataLoss;
+
+[Native]
+struct Key;
+
+[Native]
+struct KeyPath;
+
+[Native]
+struct KeyRange;
+
+[Native]
+enum PutMode;
+
+[Native]
+enum TaskType;
+
+[Native]
+enum TransactionMode;
+
+struct IndexMetadata {
+  int64 id;
+  mojo.common.mojom.String16 name;
+  KeyPath key_path;
+  bool unique;
+  bool multi_entry;
+};
+
+struct ObjectStoreMetadata {
+  int64 id;
+  mojo.common.mojom.String16 name;
+  KeyPath key_path;
+  bool auto_increment;
+  int64 max_index_id;
+  array<IndexMetadata> indexes;
+};
+
+struct DatabaseMetadata {
+  int64 id;
+  mojo.common.mojom.String16 name;
+  int64 version;
+  int64 max_object_store_id;
+  array<ObjectStoreMetadata> object_stores;
+};
+
+struct IndexKeys {
+  int64 index_id;
+  array<Key> index_keys;
+};
+
+struct FileInfo {
+  mojo.common.mojom.FilePath path;
+  mojo.common.mojom.String16 name;
+  mojo.common.mojom.Time last_modified;
+};
+
+struct BlobInfo {
+  string uuid;
+  mojo.common.mojom.String16 mime_type;
+  uint64 size;
+  FileInfo? file;
+};
+
+struct Value {
+  string bits;
+  array<BlobInfo> blob_or_file_info;
+};
+
+struct ReturnValue {
+  Value value;
+  Key primary_key;
+  KeyPath key_path;
+};
+
+// The Callbacks interface is used to return results for individual requests.
+// Some requests may return multiple results before completion, such as
+// UpgradeNeeded before SuccessDatabase.
+//
+// TODO(https://crbug.com/627484): Many of these could be replaced with
+// replies associated with particular messages.
+interface Callbacks {
+  Error(int32 code, mojo.common.mojom.String16 message);
+
+  // Factory::GetDatabaseNames
+  SuccessStringList(array<mojo.common.mojom.String16> value);
+
+  // Factory::Open / DeleteDatabase
+  Blocked(int64 existing_version);
+
+  // Factory::Open
+  UpgradeNeeded(associated Database database, int64 old_version,
+                DataLoss data_loss, string data_loss_message,
+                DatabaseMetadata db_metadata);
+  SuccessDatabase(associated Database? database, DatabaseMetadata metadata);
+
+  // Database::OpenCursor
+  SuccessCursor(int32 cursor_id, Key key, Key primary_key, Value? value);
+
+  // Database::Get / Cursor::Advance
+  SuccessValue(ReturnValue? value);
+
+  // Database::GetAll
+  SuccessArray(array<ReturnValue> values);
+
+  // Database::Put / Cursor::Update
+  SuccessKey(Key key);
+
+  // Database::Count / DeleteRange
+  // Factory::DeleteDatabase
+  SuccessInteger(int64 value);
+
+  // Cursor::Continue / Advance
+  Success();
+};
+
+// The DatabaseCallbacks interface is used to notification of events out of
+// band to individual requests. A single instance is used for the lifetime of
+// a database connection.
+interface DatabaseCallbacks {
+  ForcedClose();
+  VersionChange(int64 old_version, int64 new_version);
+  Abort(int64 transaction_id, int32 code,
+        mojo.common.mojom.String16 message);
+  Complete(int64 transaction_id);
+};
+
+interface Database {
+  CreateObjectStore(int64 transaction_id,
+                    int64 object_store_id,
+                    mojo.common.mojom.String16 name,
+                    KeyPath key_path,
+                    bool auto_increment);
+  DeleteObjectStore(int64 transaction_id,
+                    int64 object_store_id);
+  RenameObjectStore(int64 transaction_id,
+                    int64 object_store_id,
+                    mojo.common.mojom.String16 new_name);
+  CreateTransaction(int64 transaction_id,
+                    array<int64> object_store_ids,
+                    TransactionMode mode);
+  Close();
+  VersionChangeIgnored();
+  AddObserver(int64 transaction_id,
+              int32 observer_id,
+              bool include_transaction,
+              bool no_records,
+              bool values,
+              uint16 operation_types);
+  RemoveObservers(array<int32> observers);
+  Get(int64 transaction_id,
+      int64 object_store_id,
+      int64 index_id,
+      KeyRange key_range,
+      bool key_only,
+      associated Callbacks callbacks);
+  GetAll(int64 transaction_id,
+         int64 object_store_id,
+         int64 index_id,
+         KeyRange key_range,
+         bool key_only,
+         int64 max_count,
+         associated Callbacks callbacks);
+  Put(int64 transaction_id,
+      int64 object_store_id,
+      Value value,
+      Key key,
+      PutMode mode,
+      array<IndexKeys> index_keys,
+      associated Callbacks callbacks);
+  SetIndexKeys(int64 transaction_id,
+               int64 object_store_id,
+               Key primary_key,
+               array<IndexKeys> index_keys);
+  SetIndexesReady(int64 transaction_id,
+                  int64 object_store_id,
+                  array<int64> index_ids);
+  OpenCursor(int64 transaction_id,
+             int64 object_store_id,
+             int64 index_id,
+             KeyRange key_range,
+             CursorDirection direction,
+             bool key_only,
+             TaskType task_type,
+             associated Callbacks callbacks);
+  Count(int64 transaction_id,
+        int64 object_store_id,
+        int64 index_id,
+        KeyRange key_range,
+        associated Callbacks callbacks);
+  DeleteRange(int64 transaction_id,
+              int64 object_store_id,
+              KeyRange key_range,
+              associated Callbacks callbacks);
+  Clear(int64 transaction_id,
+        int64 object_store_id,
+        associated Callbacks callbacks);
+  CreateIndex(int64 transaction_id,
+              int64 object_store_id,
+              int64 index_id,
+              mojo.common.mojom.String16 name,
+              KeyPath key_path,
+              bool unique,
+              bool multi_entry);
+  DeleteIndex(int64 transaction_id,
+              int64 object_store_id,
+              int64 index_id);
+  RenameIndex(int64 transaction_id,
+              int64 object_store_id,
+              int64 index_id,
+              mojo.common.mojom.String16 new_name);
+  Abort(int64 transaction_id);
+  Commit(int64 transaction_id);
+  AckReceivedBlobs(array<string> uuids);
+};
+
+interface Factory {
+  GetDatabaseNames(associated Callbacks callbacks, url.mojom.Origin origin);
+  Open(int32 worker_thread, associated Callbacks callbacks,
+       associated DatabaseCallbacks database_callbacks, url.mojom.Origin origin,
+       mojo.common.mojom.String16 name, int64 version, int64 transaction_id);
+  DeleteDatabase(associated Callbacks callbacks, url.mojom.Origin origin,
+                 mojo.common.mojom.String16 name);
+};
diff --git a/chromium/content/common/indexed_db/indexed_db.typemap b/chromium/content/common/indexed_db/indexed_db.typemap
new file mode 100644
index 00000000000..de11446bfa6
--- /dev/null
+++ b/chromium/content/common/indexed_db/indexed_db.typemap
@@ -0,0 +1,31 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/common/indexed_db/indexed_db.mojom"
+public_headers = [
+  "//content/common/indexed_db/indexed_db_key.h",
+  "//content/common/indexed_db/indexed_db_key_path.h",
+  "//content/common/indexed_db/indexed_db_key_range.h",
+  "//content/common/indexed_db/indexed_db_metadata.h",
+  "//third_party/WebKit/public/platform/modules/indexeddb/WebIDBTypes.h",
+]
+traits_headers = [
+  "//content/common/indexed_db/indexed_db_messages.h",
+  "//content/common/indexed_db/indexed_db_param_traits.h",
+  "//content/common/indexed_db/indexed_db_struct_traits.h",
+]
+type_mappings = [
+  "indexed_db.mojom.CursorDirection=blink::WebIDBCursorDirection",
+  "indexed_db.mojom.DatabaseMetadata=content::IndexedDBDatabaseMetadata",
+  "indexed_db.mojom.DataLoss=blink::WebIDBDataLoss",
+  "indexed_db.mojom.IndexKeys=content::IndexedDBIndexKeys",
+  "indexed_db.mojom.IndexMetadata=content::IndexedDBIndexMetadata",
+  "indexed_db.mojom.Key=content::IndexedDBKey",
+  "indexed_db.mojom.KeyPath=content::IndexedDBKeyPath",
+  "indexed_db.mojom.KeyRange=content::IndexedDBKeyRange",
+  "indexed_db.mojom.ObjectStoreMetadata=content::IndexedDBObjectStoreMetadata",
+  "indexed_db.mojom.PutMode=blink::WebIDBPutMode",
+  "indexed_db.mojom.TaskType=blink::WebIDBTaskType",
+  "indexed_db.mojom.TransactionMode=blink::WebIDBTransactionMode",
+]
diff --git a/chromium/content/common/indexed_db/indexed_db_key.h b/chromium/content/common/indexed_db/indexed_db_key.h
index 85ff6e99a08..4e1b4eb1256 100644
--- a/chromium/content/common/indexed_db/indexed_db_key.h
+++ b/chromium/content/common/indexed_db/indexed_db_key.h
@@ -77,6 +77,9 @@ class CONTENT_EXPORT IndexedDBKey {
   size_t size_estimate_;
 };
 
+// An index id, and corresponding set of keys to insert.
+using IndexedDBIndexKeys = std::pair<int64_t, std::vector<IndexedDBKey>>;
+
 }  // namespace content
 
 #endif  // CONTENT_COMMON_INDEXED_DB_INDEXED_DB_KEY_H_
diff --git a/chromium/content/common/indexed_db/indexed_db_messages.h b/chromium/content/common/indexed_db/indexed_db_messages.h
index 0bb208dd500..f1c1b9ab9ec 100644
--- a/chromium/content/common/indexed_db/indexed_db_messages.h
+++ b/chromium/content/common/indexed_db/indexed_db_messages.h
@@ -21,15 +21,11 @@
 #include "ipc/ipc_message_utils.h"
 #include "ipc/ipc_param_traits.h"
 #include "third_party/WebKit/public/platform/modules/indexeddb/WebIDBTypes.h"
-#include "url/origin.h"
 
 // Singly-included section for typedefs in multiply-included file.
 #ifndef CONTENT_COMMON_INDEXED_DB_INDEXED_DB_MESSAGES_H_
 #define CONTENT_COMMON_INDEXED_DB_INDEXED_DB_MESSAGES_H_
 
-// An index id, and corresponding set of keys to insert.
-
-typedef std::pair<int64_t, std::vector<content::IndexedDBKey>> IndexKeys;
 // IPC_MESSAGE macros fail on the std::map, when expanding. We need to define
 // a type to avoid that.
 // Map observer_id to corresponding set of indices in observations.
@@ -54,110 +50,6 @@ IPC_ENUM_TRAITS_MAX_VALUE(blink::WebIDBDataLoss, blink::WebIDBDataLossTotal)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebIDBOperationType,
                           blink::WebIDBOperationTypeLast)
 
-// Used to enumerate indexed databases.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_FactoryGetDatabaseNames_Params)
-  // The response should have these ids.
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The origin doing the initiating.
-  IPC_STRUCT_MEMBER(url::Origin, origin)
-IPC_STRUCT_END()
-
-// Used to open an indexed database.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_FactoryOpen_Params)
-  // The response should have these ids.
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  // Identifier of the request
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // Identifier for database callbacks
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_callbacks_id)
-  // The origin doing the initiating.
-  IPC_STRUCT_MEMBER(url::Origin, origin)
-  // The name of the database.
-  IPC_STRUCT_MEMBER(base::string16, name)
-  // The transaction id used if a database upgrade is needed.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The requested version of the database.
-  IPC_STRUCT_MEMBER(int64_t, version)
-IPC_STRUCT_END()
-
-// Used to delete an indexed database.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_FactoryDeleteDatabase_Params)
-  // The response should have these ids.
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The origin doing the initiating.
-  IPC_STRUCT_MEMBER(url::Origin, origin)
-  // The name of the database.
-  IPC_STRUCT_MEMBER(base::string16, name)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseCreateTransaction_Params)
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  // The database the object store belongs to.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction id as minted by the frontend.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The scope of the transaction.
-  IPC_STRUCT_MEMBER(std::vector<int64_t>, object_store_ids)
-  // The transaction mode.
-  IPC_STRUCT_MEMBER(blink::WebIDBTransactionMode, mode)
-IPC_STRUCT_END()
-
-// Used to create an object store.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseCreateObjectStore_Params)
-  // The database the object store belongs to.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction its associated with.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The storage id of the object store.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The name of the object store.
-  IPC_STRUCT_MEMBER(base::string16, name)
-  // The keyPath of the object store.
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyPath, key_path)
-  // Whether the object store created should have a key generator.
-  IPC_STRUCT_MEMBER(bool, auto_increment)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseGet_Params)
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  // The id any response should contain.
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The database the object store belongs to.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction its associated with.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The object store's id.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The index's id.
-  IPC_STRUCT_MEMBER(int64_t, index_id)
-  // The serialized key range.
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyRange, key_range)
-  // If this is just retrieving the key
-  IPC_STRUCT_MEMBER(bool, key_only)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseGetAll_Params)
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  // The id any response should contain.
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The database the object store belongs to.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction its associated with.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The object store's id.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The index id.
-  IPC_STRUCT_MEMBER(int64_t, index_id)
-  // The serialized key range.
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyRange, key_range)
-  // If this is just retrieving the key
-  IPC_STRUCT_MEMBER(bool, key_only)
-  // The max number of values to retrieve.
-  IPC_STRUCT_MEMBER(int64_t, max_count)
-IPC_STRUCT_END()
-
 IPC_STRUCT_BEGIN(IndexedDBMsg_BlobOrFileInfo)
 IPC_STRUCT_MEMBER(bool, is_file)
 IPC_STRUCT_MEMBER(std::string, uuid)
@@ -182,138 +74,6 @@ IPC_STRUCT_BEGIN_WITH_PARENT(IndexedDBMsg_ReturnValue, IndexedDBMsg_Value)
   IPC_STRUCT_MEMBER(content::IndexedDBKeyPath, key_path)
 IPC_STRUCT_END()
 
-// WebIDBDatabase::observe() message.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseObserve_Params)
-  // The database the observer observers on.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction it's associated with.
-  IPC_STRUCT_MEMBER(int32_t, transaction_id)
-  IPC_STRUCT_MEMBER(int32_t, observer_id)
-  IPC_STRUCT_MEMBER(bool, include_transaction)
-  IPC_STRUCT_MEMBER(bool, no_records)
-  IPC_STRUCT_MEMBER(bool, values)
-  IPC_STRUCT_MEMBER(uint16_t, operation_types)
-IPC_STRUCT_END()
-
-// Used to set a value in an object store.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabasePut_Params)
-  // The id any response should contain.
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The database the object store belongs to.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction it's associated with.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The object store's id.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The index's id.
-  IPC_STRUCT_MEMBER(int64_t, index_id)
-  // The value to set.
-  IPC_STRUCT_MEMBER(IndexedDBMsg_Value, value)
-  // The key to set it on (may not be "valid"/set in some cases).
-  IPC_STRUCT_MEMBER(content::IndexedDBKey, key)
-  // Whether this is an add or a put.
-  IPC_STRUCT_MEMBER(blink::WebIDBPutMode, put_mode)
-  // The index ids and the list of keys for each index.
-  IPC_STRUCT_MEMBER(std::vector<IndexKeys>, index_keys)
-IPC_STRUCT_END()
-
-// Used to open both cursors and object cursors in IndexedDB.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseOpenCursor_Params)
-  // The response should have these ids.
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The database the object store belongs to.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction this request belongs to.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The object store.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The index if any.
-  IPC_STRUCT_MEMBER(int64_t, index_id)
-  // The serialized key range.
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyRange, key_range)
-  // The direction of this cursor.
-  IPC_STRUCT_MEMBER(blink::WebIDBCursorDirection, direction)
-  // If this is just retrieving the key
-  IPC_STRUCT_MEMBER(bool, key_only)
-  // The priority of this cursor.
-  IPC_STRUCT_MEMBER(blink::WebIDBTaskType, task_type)
-IPC_STRUCT_END()
-
-// Used to open both cursors and object cursors in IndexedDB.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseCount_Params)
-  // The response should have these ids.
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The transaction this request belongs to.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The IPC id of the database.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The object store.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The index if any.
-  IPC_STRUCT_MEMBER(int64_t, index_id)
-  // The serialized key range.
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyRange, key_range)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseDeleteRange_Params)
-  // The response should have these ids.
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  // The IPC id of the database.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction this request belongs to.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The object store.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The serialized key range.
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyRange, key_range)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseSetIndexKeys_Params)
-  // The IPC id of the database.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The transaction this request belongs to.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The object store's id.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The object store key that we're setting index keys for.
-  IPC_STRUCT_MEMBER(content::IndexedDBKey, primary_key)
-  // The index ids and the list of keys for each index.
-  IPC_STRUCT_MEMBER(std::vector<IndexKeys>, index_keys)
-IPC_STRUCT_END()
-
-// Used to create an index.
-IPC_STRUCT_BEGIN(IndexedDBHostMsg_DatabaseCreateIndex_Params)
-  // The transaction this is associated with.
-  IPC_STRUCT_MEMBER(int64_t, transaction_id)
-  // The database being used.
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  // The object store the index belongs to.
-  IPC_STRUCT_MEMBER(int64_t, object_store_id)
-  // The storage id of the index.
-  IPC_STRUCT_MEMBER(int64_t, index_id)
-  // The name of the index.
-  IPC_STRUCT_MEMBER(base::string16, name)
-  // The keyPath of the index.
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyPath, key_path)
-  // Whether the index created has unique keys.
-  IPC_STRUCT_MEMBER(bool, unique)
-  // Whether the index created produces keys for each array entry.
-  IPC_STRUCT_MEMBER(bool, multi_entry)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBMsg_CallbacksSuccessIDBCursor_Params)
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_cursor_id)
-  IPC_STRUCT_MEMBER(content::IndexedDBKey, key)
-  IPC_STRUCT_MEMBER(content::IndexedDBKey, primary_key)
-  IPC_STRUCT_MEMBER(IndexedDBMsg_Value, value)
-IPC_STRUCT_END()
-
 IPC_STRUCT_BEGIN(IndexedDBMsg_CallbacksSuccessCursorContinue_Params)
   IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
   IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
@@ -332,54 +92,12 @@ IPC_STRUCT_BEGIN(IndexedDBMsg_CallbacksSuccessCursorPrefetch_Params)
   IPC_STRUCT_MEMBER(std::vector<IndexedDBMsg_Value>, values)
 IPC_STRUCT_END()
 
-IPC_STRUCT_BEGIN(IndexedDBMsg_CallbacksSuccessArray_Params)
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  IPC_STRUCT_MEMBER(std::vector<IndexedDBMsg_ReturnValue>, values)
-IPC_STRUCT_END()
-
 IPC_STRUCT_BEGIN(IndexedDBMsg_CallbacksSuccessValue_Params)
   IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
   IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
   IPC_STRUCT_MEMBER(IndexedDBMsg_ReturnValue, value)
 IPC_STRUCT_END()
 
-IPC_STRUCT_BEGIN(IndexedDBIndexMetadata)
-  IPC_STRUCT_MEMBER(int64_t, id)
-  IPC_STRUCT_MEMBER(base::string16, name)
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyPath, key_path)
-  IPC_STRUCT_MEMBER(bool, unique)
-  IPC_STRUCT_MEMBER(bool, multi_entry)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBObjectStoreMetadata)
-  IPC_STRUCT_MEMBER(int64_t, id)
-  IPC_STRUCT_MEMBER(base::string16, name)
-  IPC_STRUCT_MEMBER(content::IndexedDBKeyPath, key_path)
-  IPC_STRUCT_MEMBER(bool, auto_increment)
-  IPC_STRUCT_MEMBER(int64_t, max_index_id)
-  IPC_STRUCT_MEMBER(std::vector<IndexedDBIndexMetadata>, indexes)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBDatabaseMetadata)
-  IPC_STRUCT_MEMBER(int64_t, id)
-  IPC_STRUCT_MEMBER(base::string16, name)
-  IPC_STRUCT_MEMBER(int64_t, version)
-  IPC_STRUCT_MEMBER(int64_t, max_object_store_id)
-  IPC_STRUCT_MEMBER(std::vector<IndexedDBObjectStoreMetadata>, object_stores)
-IPC_STRUCT_END()
-
-IPC_STRUCT_BEGIN(IndexedDBMsg_CallbacksUpgradeNeeded_Params)
-  IPC_STRUCT_MEMBER(int32_t, ipc_thread_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_callbacks_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_callbacks_id)
-  IPC_STRUCT_MEMBER(int32_t, ipc_database_id)
-  IPC_STRUCT_MEMBER(int64_t, old_version)
-  IPC_STRUCT_MEMBER(blink::WebIDBDataLoss, data_loss)
-  IPC_STRUCT_MEMBER(std::string, data_loss_message)
-  IPC_STRUCT_MEMBER(IndexedDBDatabaseMetadata, idb_metadata)
-IPC_STRUCT_END()
-
 IPC_STRUCT_BEGIN(IndexedDBMsg_Observation)
   IPC_STRUCT_MEMBER(int64_t, object_store_id)
   IPC_STRUCT_MEMBER(blink::WebIDBOperationType, type)
@@ -398,9 +116,6 @@ IPC_STRUCT_END()
 // thread_id is the first int.
 
 // IDBCallback message handlers.
-IPC_MESSAGE_CONTROL1(IndexedDBMsg_CallbacksSuccessIDBCursor,
-                     IndexedDBMsg_CallbacksSuccessIDBCursor_Params)
-
 IPC_MESSAGE_CONTROL1(IndexedDBMsg_CallbacksSuccessCursorContinue,
                      IndexedDBMsg_CallbacksSuccessCursorContinue_Params)
 
@@ -410,20 +125,6 @@ IPC_MESSAGE_CONTROL1(IndexedDBMsg_CallbacksSuccessCursorAdvance,
 IPC_MESSAGE_CONTROL1(IndexedDBMsg_CallbacksSuccessCursorPrefetch,
                      IndexedDBMsg_CallbacksSuccessCursorPrefetch_Params)
 
-IPC_MESSAGE_CONTROL1(IndexedDBMsg_CallbacksSuccessArray,
-                     IndexedDBMsg_CallbacksSuccessArray_Params)
-
-IPC_MESSAGE_CONTROL5(IndexedDBMsg_CallbacksSuccessIDBDatabase,
-                     int32_t /* ipc_thread_id */,
-                     int32_t /* ipc_callbacks_id */,
-                     int32_t /* ipc_database_callbacks_id */,
-                     int32_t /* ipc_database_id */,
-                     IndexedDBDatabaseMetadata)
-IPC_MESSAGE_CONTROL3(IndexedDBMsg_CallbacksSuccessIndexedDBKey,
-                     int32_t /* ipc_thread_id */,
-                     int32_t /* ipc_callbacks_id */,
-                     content::IndexedDBKey /* indexed_db_key */)
-
 IPC_MESSAGE_CONTROL1(IndexedDBMsg_CallbacksSuccessValue,
                      IndexedDBMsg_CallbacksSuccessValue_Params)
 
@@ -431,47 +132,15 @@ IPC_MESSAGE_CONTROL3(IndexedDBMsg_CallbacksSuccessInteger,
                      int32_t /* ipc_thread_id */,
                      int32_t /* ipc_callbacks_id */,
                      int64_t /* value */)
-IPC_MESSAGE_CONTROL2(IndexedDBMsg_CallbacksSuccessUndefined,
-                     int32_t /* ipc_thread_id */,
-                     int32_t /* ipc_callbacks_id */)
-IPC_MESSAGE_CONTROL3(IndexedDBMsg_CallbacksSuccessStringList,
-                     int32_t /* ipc_thread_id */,
-                     int32_t /* ipc_callbacks_id */,
-                     std::vector<base::string16> /* dom_string_list */)
 IPC_MESSAGE_CONTROL4(IndexedDBMsg_CallbacksError,
                      int32_t /* ipc_thread_id */,
                      int32_t /* ipc_callbacks_id */,
                      int /* code */,
                      base::string16 /* message */)
-IPC_MESSAGE_CONTROL3(IndexedDBMsg_CallbacksIntBlocked,
-                     int32_t /* ipc_thread_id */,
-                     int32_t /* ipc_callbacks_id */,
-                     int64_t /* existing_version */)
-IPC_MESSAGE_CONTROL1(IndexedDBMsg_CallbacksUpgradeNeeded,
-                     IndexedDBMsg_CallbacksUpgradeNeeded_Params)
 
 // IDBDatabaseCallback message handlers
-IPC_MESSAGE_CONTROL2(IndexedDBMsg_DatabaseCallbacksForcedClose,
-                     int32_t, /* ipc_thread_id */
-                     int32_t) /* ipc_database_callbacks_id */
-IPC_MESSAGE_CONTROL4(IndexedDBMsg_DatabaseCallbacksVersionChange,
-                     int32_t, /* ipc_thread_id */
-                     int32_t, /* ipc_database_callbacks_id */
-                     int64_t, /* old_version */
-                     int64_t) /* new_version */
-IPC_MESSAGE_CONTROL5(IndexedDBMsg_DatabaseCallbacksAbort,
-                     int32_t,        /* ipc_thread_id */
-                     int32_t,        /* ipc_database_callbacks_id */
-                     int64_t,        /* transaction_id */
-                     int,            /* code */
-                     base::string16) /* message */
-IPC_MESSAGE_CONTROL3(IndexedDBMsg_DatabaseCallbacksComplete,
+IPC_MESSAGE_CONTROL2(IndexedDBMsg_DatabaseCallbacksChanges,
                      int32_t, /* ipc_thread_id */
-                     int32_t, /* ipc_database_callbacks_id */
-                     int64_t) /* transaction_id */
-IPC_MESSAGE_CONTROL3(IndexedDBMsg_DatabaseCallbacksChanges,
-                     int32_t, /* ipc_thread_id */
-                     int32_t, /* ipc_database_id */
                      IndexedDBMsg_ObserverChanges)
 
 // Indexed DB messages sent from the renderer to the browser.
@@ -504,135 +173,9 @@ IPC_MESSAGE_CONTROL3(IndexedDBHostMsg_CursorPrefetchReset,
                      int32_t, /* used_prefetches */
                      int32_t) /* used_prefetches */
 
-// WebIDBFactory::getDatabaseNames() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_FactoryGetDatabaseNames,
-                     IndexedDBHostMsg_FactoryGetDatabaseNames_Params)
-
-// WebIDBFactory::open() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_FactoryOpen,
-                     IndexedDBHostMsg_FactoryOpen_Params)
-
-// WebIDBFactory::deleteDatabase() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_FactoryDeleteDatabase,
-                     IndexedDBHostMsg_FactoryDeleteDatabase_Params)
-
 IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_AckReceivedBlobs,
                      std::vector<std::string>) /* uuids */
 
-// WebIDBDatabase::unobserve() message.
-IPC_MESSAGE_CONTROL2(IndexedDBHostMsg_DatabaseUnobserve,
-                     int32_t,              /* ipc_database_id */
-                     std::vector<int32_t>) /* list of observer_id */
-
-// WebIDBDatabase::createObjectStore() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseCreateObjectStore,
-                     IndexedDBHostMsg_DatabaseCreateObjectStore_Params)
-
-// WebIDBDatabase::deleteObjectStore() message.
-IPC_MESSAGE_CONTROL3(IndexedDBHostMsg_DatabaseDeleteObjectStore,
-                     int32_t, /* ipc_database_id */
-                     int64_t, /* transaction_id */
-                     int64_t) /* object_store_id */
-
-// WebIDBDatabase::renameObjectStore() message.
-IPC_MESSAGE_CONTROL4(IndexedDBHostMsg_DatabaseRenameObjectStore,
-                     int32_t,        /* ipc_database_id */
-                     int64_t,        /* transaction_id */
-                     int64_t,        /* object_store_id */
-                     base::string16) /* new_name */
-
-// WebIDBDatabase::createTransaction() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseCreateTransaction,
-                     IndexedDBHostMsg_DatabaseCreateTransaction_Params)
-
-// WebIDBDatabase::close() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseClose,
-                     int32_t /* ipc_database_id */)
-
-// WebIDBDatabase::versionChangeIgnored() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseVersionChangeIgnored,
-                     int32_t /* ipc_database_id */)
-
-// WebIDBDatabase::~WebIDBDatabase() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseDestroyed,
-                     int32_t /* ipc_database_id */)
-
-// WebIDBDatabase::get() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseGet,
-                     IndexedDBHostMsg_DatabaseGet_Params)
-
-// WebIDBDatabase::getAll() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseGetAll,
-                     IndexedDBHostMsg_DatabaseGetAll_Params)
-
-// WebIDBDatabase::observe() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseObserve,
-                     IndexedDBHostMsg_DatabaseObserve_Params)
-
-// WebIDBDatabase::put() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabasePut,
-                     IndexedDBHostMsg_DatabasePut_Params)
-
-// WebIDBDatabase::setIndexKeys() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseSetIndexKeys,
-                     IndexedDBHostMsg_DatabaseSetIndexKeys_Params)
-
-// WebIDBDatabase::setIndexesReady() message.
-IPC_MESSAGE_CONTROL4(IndexedDBHostMsg_DatabaseSetIndexesReady,
-                     int32_t,              /* ipc_database_id */
-                     int64_t,              /* transaction_id */
-                     int64_t,              /* object_store_id */
-                     std::vector<int64_t>) /* index_ids */
-
-// WebIDBDatabase::openCursor() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseOpenCursor,
-                     IndexedDBHostMsg_DatabaseOpenCursor_Params)
-
-// WebIDBDatabase::count() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseCount,
-                     IndexedDBHostMsg_DatabaseCount_Params)
-
-// WebIDBDatabase::deleteRange() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseDeleteRange,
-                     IndexedDBHostMsg_DatabaseDeleteRange_Params)
-
-// WebIDBDatabase::clear() message.
-IPC_MESSAGE_CONTROL5(IndexedDBHostMsg_DatabaseClear,
-                     int32_t, /* ipc_thread_id */
-                     int32_t, /* ipc_callbacks_id */
-                     int32_t, /* ipc_database_id */
-                     int64_t, /* transaction_id */
-                     int64_t) /* object_store_id */
-
-// WebIDBDatabase::createIndex() message.
-IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_DatabaseCreateIndex,
-                     IndexedDBHostMsg_DatabaseCreateIndex_Params)
-
-// WebIDBDatabase::deleteIndex() message.
-IPC_MESSAGE_CONTROL4(IndexedDBHostMsg_DatabaseDeleteIndex,
-                     int32_t, /* ipc_database_id */
-                     int64_t, /* transaction_id */
-                     int64_t, /* object_store_id */
-                     int64_t) /* index_id */
-
-// WebIDBDatabase::renameIndex() message.
-IPC_MESSAGE_CONTROL5(IndexedDBHostMsg_DatabaseRenameIndex,
-                     int32_t,        /* ipc_database_id */
-                     int64_t,        /* transaction_id */
-                     int64_t,        /* object_store_id */
-                     int64_t,        /* index_id */
-                     base::string16) /* new_name */
-
-// WebIDBDatabase::abort() message.
-IPC_MESSAGE_CONTROL2(IndexedDBHostMsg_DatabaseAbort,
-                     int32_t, /* ipc_database_id */
-                     int64_t) /* transaction_id */
-
-// WebIDBDatabase::commit() message.
-IPC_MESSAGE_CONTROL2(IndexedDBHostMsg_DatabaseCommit,
-                     int32_t, /* ipc_database_id */
-                     int64_t) /* transaction_id */
-
 // WebIDBDatabase::~WebIDBCursor() message.
 IPC_MESSAGE_CONTROL1(IndexedDBHostMsg_CursorDestroyed,
                      int32_t /* ipc_cursor_id */)
diff --git a/chromium/content/common/indexed_db/indexed_db_metadata.cc b/chromium/content/common/indexed_db/indexed_db_metadata.cc
new file mode 100644
index 00000000000..e049a646c2c
--- /dev/null
+++ b/chromium/content/common/indexed_db/indexed_db_metadata.cc
@@ -0,0 +1,72 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/indexed_db/indexed_db_metadata.h"
+
+namespace content {
+
+IndexedDBIndexMetadata::IndexedDBIndexMetadata() = default;
+
+IndexedDBIndexMetadata::IndexedDBIndexMetadata(const base::string16& name,
+                                               int64_t id,
+                                               const IndexedDBKeyPath& key_path,
+                                               bool unique,
+                                               bool multi_entry)
+    : name(name),
+      id(id),
+      key_path(key_path),
+      unique(unique),
+      multi_entry(multi_entry) {}
+
+IndexedDBIndexMetadata::IndexedDBIndexMetadata(
+    const IndexedDBIndexMetadata& other) = default;
+
+IndexedDBIndexMetadata::~IndexedDBIndexMetadata() = default;
+
+IndexedDBIndexMetadata& IndexedDBIndexMetadata::operator=(
+    const IndexedDBIndexMetadata& other) = default;
+
+IndexedDBObjectStoreMetadata::IndexedDBObjectStoreMetadata(
+    const base::string16& name,
+    int64_t id,
+    const IndexedDBKeyPath& key_path,
+    bool auto_increment,
+    int64_t max_index_id)
+    : name(name),
+      id(id),
+      key_path(key_path),
+      auto_increment(auto_increment),
+      max_index_id(max_index_id) {}
+
+IndexedDBObjectStoreMetadata::IndexedDBObjectStoreMetadata() = default;
+
+IndexedDBObjectStoreMetadata::IndexedDBObjectStoreMetadata(
+    const IndexedDBObjectStoreMetadata& other) = default;
+
+IndexedDBObjectStoreMetadata::~IndexedDBObjectStoreMetadata() = default;
+
+IndexedDBObjectStoreMetadata& IndexedDBObjectStoreMetadata::operator=(
+    const IndexedDBObjectStoreMetadata& other) = default;
+
+IndexedDBDatabaseMetadata::IndexedDBDatabaseMetadata() : version(NO_VERSION) {}
+
+IndexedDBDatabaseMetadata::IndexedDBDatabaseMetadata(
+    const base::string16& name,
+    int64_t id,
+    int64_t version,
+    int64_t max_object_store_id)
+    : name(name),
+      id(id),
+      version(version),
+      max_object_store_id(max_object_store_id) {}
+
+IndexedDBDatabaseMetadata::IndexedDBDatabaseMetadata(
+    const IndexedDBDatabaseMetadata& other) = default;
+
+IndexedDBDatabaseMetadata::~IndexedDBDatabaseMetadata() = default;
+
+IndexedDBDatabaseMetadata& IndexedDBDatabaseMetadata::operator=(
+    IndexedDBDatabaseMetadata& other) = default;
+
+}  // namespace content
diff --git a/chromium/content/common/indexed_db/indexed_db_metadata.h b/chromium/content/common/indexed_db/indexed_db_metadata.h
new file mode 100644
index 00000000000..6c943cfa6fe
--- /dev/null
+++ b/chromium/content/common/indexed_db/indexed_db_metadata.h
@@ -0,0 +1,82 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_METADATA_H_
+#define CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_METADATA_H_
+
+#include <stdint.h>
+
+#include <map>
+
+#include "base/strings/string16.h"
+#include "content/common/indexed_db/indexed_db_key_path.h"
+
+namespace content {
+
+struct CONTENT_EXPORT IndexedDBIndexMetadata {
+  static const int64_t kInvalidId = -1;
+
+  IndexedDBIndexMetadata();
+  IndexedDBIndexMetadata(const base::string16& name,
+                         int64_t id,
+                         const IndexedDBKeyPath& key_path,
+                         bool unique,
+                         bool multi_entry);
+  IndexedDBIndexMetadata(const IndexedDBIndexMetadata& other);
+  ~IndexedDBIndexMetadata();
+  IndexedDBIndexMetadata& operator=(const IndexedDBIndexMetadata& other);
+
+  base::string16 name;
+  int64_t id;
+  IndexedDBKeyPath key_path;
+  bool unique;
+  bool multi_entry;
+};
+
+struct CONTENT_EXPORT IndexedDBObjectStoreMetadata {
+  static const int64_t kInvalidId = -1;
+
+  IndexedDBObjectStoreMetadata();
+  IndexedDBObjectStoreMetadata(const base::string16& name,
+                               int64_t id,
+                               const IndexedDBKeyPath& key_path,
+                               bool auto_increment,
+                               int64_t max_index_id);
+  IndexedDBObjectStoreMetadata(const IndexedDBObjectStoreMetadata& other);
+  ~IndexedDBObjectStoreMetadata();
+  IndexedDBObjectStoreMetadata& operator=(
+      const IndexedDBObjectStoreMetadata& other);
+
+  base::string16 name;
+  int64_t id;
+  IndexedDBKeyPath key_path;
+  bool auto_increment;
+  int64_t max_index_id;
+
+  std::map<int64_t, IndexedDBIndexMetadata> indexes;
+};
+
+struct CONTENT_EXPORT IndexedDBDatabaseMetadata {
+  // TODO(jsbell): These can probably be collapsed into 0.
+  enum { NO_VERSION = -1, DEFAULT_VERSION = 0 };
+
+  IndexedDBDatabaseMetadata();
+  IndexedDBDatabaseMetadata(const base::string16& name,
+                            int64_t id,
+                            int64_t version,
+                            int64_t max_object_store_id);
+  IndexedDBDatabaseMetadata(const IndexedDBDatabaseMetadata& other);
+  ~IndexedDBDatabaseMetadata();
+  IndexedDBDatabaseMetadata& operator=(IndexedDBDatabaseMetadata& other);
+
+  base::string16 name;
+  int64_t id;
+  int64_t version;
+  int64_t max_object_store_id;
+
+  std::map<int64_t, IndexedDBObjectStoreMetadata> object_stores;
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_METADATA_H_
diff --git a/chromium/content/common/indexed_db/indexed_db_struct_traits.cc b/chromium/content/common/indexed_db/indexed_db_struct_traits.cc
new file mode 100644
index 00000000000..d304b0fca01
--- /dev/null
+++ b/chromium/content/common/indexed_db/indexed_db_struct_traits.cc
@@ -0,0 +1,86 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/indexed_db/indexed_db_param_traits.h"
+#include "content/common/indexed_db/indexed_db_struct_traits.h"
+#include "mojo/common/common_custom_types_struct_traits.h"
+
+namespace mojo {
+
+// static
+bool StructTraits<indexed_db::mojom::IndexKeysDataView,
+                  content::IndexedDBIndexKeys>::
+    Read(indexed_db::mojom::IndexKeysDataView data,
+         content::IndexedDBIndexKeys* out) {
+  out->first = data.index_id();
+  return data.ReadIndexKeys(&out->second);
+}
+
+// static
+bool StructTraits<indexed_db::mojom::IndexMetadataDataView,
+                  content::IndexedDBIndexMetadata>::
+    Read(indexed_db::mojom::IndexMetadataDataView data,
+         content::IndexedDBIndexMetadata* out) {
+  out->id = data.id();
+  if (!data.ReadName(&out->name))
+    return false;
+  if (!data.ReadKeyPath(&out->key_path))
+    return false;
+  out->unique = data.unique();
+  out->multi_entry = data.multi_entry();
+  return true;
+}
+
+// static
+bool StructTraits<indexed_db::mojom::ObjectStoreMetadataDataView,
+                  content::IndexedDBObjectStoreMetadata>::
+    Read(indexed_db::mojom::ObjectStoreMetadataDataView data,
+         content::IndexedDBObjectStoreMetadata* out) {
+  out->id = data.id();
+  if (!data.ReadName(&out->name))
+    return false;
+  if (!data.ReadKeyPath(&out->key_path))
+    return false;
+  out->auto_increment = data.auto_increment();
+  out->max_index_id = data.max_index_id();
+  ArrayDataView<indexed_db::mojom::IndexMetadataDataView> indexes;
+  data.GetIndexesDataView(&indexes);
+  for (size_t i = 0; i < indexes.size(); ++i) {
+    indexed_db::mojom::IndexMetadataDataView index;
+    indexes.GetDataView(i, &index);
+    DCHECK(!base::ContainsKey(out->indexes, index.id()));
+    if (!StructTraits<
+            indexed_db::mojom::IndexMetadataDataView,
+            content::IndexedDBIndexMetadata>::Read(index,
+                                                   &out->indexes[index.id()]))
+      return false;
+  }
+  return true;
+}
+
+// static
+bool StructTraits<indexed_db::mojom::DatabaseMetadataDataView,
+                  content::IndexedDBDatabaseMetadata>::
+    Read(indexed_db::mojom::DatabaseMetadataDataView data,
+         content::IndexedDBDatabaseMetadata* out) {
+  out->id = data.id();
+  if (!data.ReadName(&out->name))
+    return false;
+  out->version = data.version();
+  out->max_object_store_id = data.max_object_store_id();
+  ArrayDataView<indexed_db::mojom::ObjectStoreMetadataDataView> object_stores;
+  data.GetObjectStoresDataView(&object_stores);
+  for (size_t i = 0; i < object_stores.size(); ++i) {
+    indexed_db::mojom::ObjectStoreMetadataDataView object_store;
+    object_stores.GetDataView(i, &object_store);
+    DCHECK(!base::ContainsKey(out->object_stores, object_store.id()));
+    if (!StructTraits<indexed_db::mojom::ObjectStoreMetadataDataView,
+                      content::IndexedDBObjectStoreMetadata>::
+            Read(object_store, &out->object_stores[object_store.id()]))
+      return false;
+  }
+  return true;
+}
+
+}  // namespace mojo
diff --git a/chromium/content/common/indexed_db/indexed_db_struct_traits.h b/chromium/content/common/indexed_db/indexed_db_struct_traits.h
new file mode 100644
index 00000000000..9cdc49c302f
--- /dev/null
+++ b/chromium/content/common/indexed_db/indexed_db_struct_traits.h
@@ -0,0 +1,107 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_INDEXED_DB_INDEXED_DB_STRUCT_TRAITS_H_
+#define CONTENT_COMMON_INDEXED_DB_INDEXED_DB_STRUCT_TRAITS_H_
+
+#include "content/common/indexed_db/indexed_db.mojom.h"
+#include "content/common/indexed_db/indexed_db_metadata.h"
+
+namespace mojo {
+
+template <>
+struct StructTraits<indexed_db::mojom::IndexKeysDataView,
+                    content::IndexedDBIndexKeys> {
+  static int64_t index_id(const content::IndexedDBIndexKeys& index_keys) {
+    return index_keys.first;
+  }
+  static const std::vector<content::IndexedDBKey>& index_keys(
+      const content::IndexedDBIndexKeys& index_keys) {
+    return index_keys.second;
+  }
+  static bool Read(indexed_db::mojom::IndexKeysDataView data,
+                   content::IndexedDBIndexKeys* out);
+};
+
+template <>
+struct StructTraits<indexed_db::mojom::IndexMetadataDataView,
+                    content::IndexedDBIndexMetadata> {
+  static int64_t id(const content::IndexedDBIndexMetadata& metadata) {
+    return metadata.id;
+  }
+  static base::string16 name(const content::IndexedDBIndexMetadata& metadata) {
+    return metadata.name;
+  }
+  static const content::IndexedDBKeyPath& key_path(
+      const content::IndexedDBIndexMetadata& metadata) {
+    return metadata.key_path;
+  }
+  static bool unique(const content::IndexedDBIndexMetadata& metadata) {
+    return metadata.unique;
+  }
+  static bool multi_entry(const content::IndexedDBIndexMetadata& metadata) {
+    return metadata.multi_entry;
+  }
+  static bool Read(indexed_db::mojom::IndexMetadataDataView data,
+                   content::IndexedDBIndexMetadata* out);
+};
+
+template <>
+struct StructTraits<indexed_db::mojom::ObjectStoreMetadataDataView,
+                    content::IndexedDBObjectStoreMetadata> {
+  static int64_t id(const content::IndexedDBObjectStoreMetadata& metadata) {
+    return metadata.id;
+  }
+  static base::string16 name(
+      const content::IndexedDBObjectStoreMetadata& metadata) {
+    return metadata.name;
+  }
+  static const content::IndexedDBKeyPath& key_path(
+      const content::IndexedDBObjectStoreMetadata& metadata) {
+    return metadata.key_path;
+  }
+  static bool auto_increment(
+      const content::IndexedDBObjectStoreMetadata& metadata) {
+    return metadata.auto_increment;
+  }
+  static int64_t max_index_id(
+      const content::IndexedDBObjectStoreMetadata& metadata) {
+    return metadata.max_index_id;
+  }
+  static MapValuesArrayView<int64_t, content::IndexedDBIndexMetadata> indexes(
+      const content::IndexedDBObjectStoreMetadata& metadata) {
+    return MapValuesToArray(metadata.indexes);
+  }
+  static bool Read(indexed_db::mojom::ObjectStoreMetadataDataView data,
+                   content::IndexedDBObjectStoreMetadata* out);
+};
+
+template <>
+struct StructTraits<indexed_db::mojom::DatabaseMetadataDataView,
+                    content::IndexedDBDatabaseMetadata> {
+  static int64_t id(const content::IndexedDBDatabaseMetadata& metadata) {
+    return metadata.id;
+  }
+  static base::string16 name(
+      const content::IndexedDBDatabaseMetadata& metadata) {
+    return metadata.name;
+  }
+  static int64_t version(const content::IndexedDBDatabaseMetadata& metadata) {
+    return metadata.version;
+  }
+  static int64_t max_object_store_id(
+      const content::IndexedDBDatabaseMetadata& metadata) {
+    return metadata.max_object_store_id;
+  }
+  static MapValuesArrayView<int64_t, content::IndexedDBObjectStoreMetadata>
+  object_stores(const content::IndexedDBDatabaseMetadata& metadata) {
+    return MapValuesToArray(metadata.object_stores);
+  }
+  static bool Read(indexed_db::mojom::DatabaseMetadataDataView data,
+                   content::IndexedDBDatabaseMetadata* out);
+};
+
+}  // namespace mojo
+
+#endif  // CONTENT_COMMON_INDEXED_DB_INDEXED_DB_STRUCT_TRAITS_H_
diff --git a/chromium/content/common/indexed_db/typemaps.gni b/chromium/content/common/indexed_db/typemaps.gni
new file mode 100644
index 00000000000..04b6903653f
--- /dev/null
+++ b/chromium/content/common/indexed_db/typemaps.gni
@@ -0,0 +1,5 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+typemaps = [ "//content/common/indexed_db/indexed_db.typemap" ]
diff --git a/chromium/content/common/input/event_with_latency_info.h b/chromium/content/common/input/event_with_latency_info.h
index 021b3bfc8ac..541b7ce4589 100644
--- a/chromium/content/common/input/event_with_latency_info.h
+++ b/chromium/content/common/input/event_with_latency_info.h
@@ -8,7 +8,8 @@
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "content/common/content_export.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebGestureEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/events/blink/scoped_web_input_event.h"
 #include "ui/events/latency_info.h"
 
diff --git a/chromium/content/common/input/event_with_latency_info_unittest.cc b/chromium/content/common/input/event_with_latency_info_unittest.cc
index ca6baefe42a..5cd7030e335 100644
--- a/chromium/content/common/input/event_with_latency_info_unittest.cc
+++ b/chromium/content/common/input/event_with_latency_info_unittest.cc
@@ -7,7 +7,7 @@
 #include <limits>
 
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 
 using blink::WebGestureEvent;
 using blink::WebInputEvent;
diff --git a/chromium/content/common/input/gesture_event_stream_validator.cc b/chromium/content/common/input/gesture_event_stream_validator.cc
index ef808246faf..14028ca032e 100644
--- a/chromium/content/common/input/gesture_event_stream_validator.cc
+++ b/chromium/content/common/input/gesture_event_stream_validator.cc
@@ -6,7 +6,7 @@
 
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/events/blink/web_input_event_traits.h"
 
 using blink::WebInputEvent;
diff --git a/chromium/content/common/input/input_event_ack.cc b/chromium/content/common/input/input_event_ack.cc
index c7af9f85d25..92cf5eaed0c 100644
--- a/chromium/content/common/input/input_event_ack.cc
+++ b/chromium/content/common/input/input_event_ack.cc
@@ -9,37 +9,50 @@
 namespace content {
 
 InputEventAck::InputEventAck(
+    InputEventAckSource source,
     blink::WebInputEvent::Type type,
     InputEventAckState state,
     const ui::LatencyInfo& latency,
     std::unique_ptr<ui::DidOverscrollParams> overscroll,
     uint32_t unique_touch_event_id)
-    : type(type),
+    : source(source),
+      type(type),
       state(state),
       latency(latency),
       overscroll(std::move(overscroll)),
       unique_touch_event_id(unique_touch_event_id) {}
 
-InputEventAck::InputEventAck(blink::WebInputEvent::Type type,
+InputEventAck::InputEventAck(InputEventAckSource source,
+                             blink::WebInputEvent::Type type,
                              InputEventAckState state,
                              const ui::LatencyInfo& latency,
                              uint32_t unique_touch_event_id)
-    : InputEventAck(type, state, latency, nullptr, unique_touch_event_id) {}
-
-InputEventAck::InputEventAck(blink::WebInputEvent::Type type,
+    : InputEventAck(source,
+                    type,
+                    state,
+                    latency,
+                    nullptr,
+                    unique_touch_event_id) {}
+
+InputEventAck::InputEventAck(InputEventAckSource source,
+                             blink::WebInputEvent::Type type,
                              InputEventAckState state,
                              uint32_t unique_touch_event_id)
-    : InputEventAck(type, state, ui::LatencyInfo(), unique_touch_event_id) {}
-
-InputEventAck::InputEventAck(blink::WebInputEvent::Type type,
+    : InputEventAck(source,
+                    type,
+                    state,
+                    ui::LatencyInfo(),
+                    unique_touch_event_id) {}
+
+InputEventAck::InputEventAck(InputEventAckSource source,
+                             blink::WebInputEvent::Type type,
                              InputEventAckState state)
-    : InputEventAck(type, state, 0) {
-}
+    : InputEventAck(source, type, state, 0) {}
 
 InputEventAck::InputEventAck()
-    : InputEventAck(blink::WebInputEvent::Undefined,
-                    INPUT_EVENT_ACK_STATE_UNKNOWN) {
-}
+    : InputEventAck(InputEventAckSource::UNKNOWN,
+                    blink::WebInputEvent::Undefined,
+                    INPUT_EVENT_ACK_STATE_UNKNOWN) {}
 
 InputEventAck::~InputEventAck() {
 }
diff --git a/chromium/content/common/input/input_event_ack.h b/chromium/content/common/input/input_event_ack.h
index 66b003d4a5f..132ce7e9bea 100644
--- a/chromium/content/common/input/input_event_ack.h
+++ b/chromium/content/common/input/input_event_ack.h
@@ -10,8 +10,9 @@
 #include <memory>
 
 #include "content/common/content_export.h"
+#include "content/common/input/input_event_ack_source.h"
 #include "content/common/input/input_event_ack_state.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/events/blink/did_overscroll_params.h"
 #include "ui/events/latency_info.h"
 
@@ -19,22 +20,28 @@ namespace content {
 
 // InputEventAck.
 struct CONTENT_EXPORT InputEventAck {
-  InputEventAck(blink::WebInputEvent::Type type,
+  InputEventAck(InputEventAckSource source,
+                blink::WebInputEvent::Type type,
                 InputEventAckState state,
                 const ui::LatencyInfo& latency,
                 std::unique_ptr<ui::DidOverscrollParams> overscroll,
                 uint32_t unique_touch_event_id);
-  InputEventAck(blink::WebInputEvent::Type type,
+  InputEventAck(InputEventAckSource source,
+                blink::WebInputEvent::Type type,
                 InputEventAckState state,
                 const ui::LatencyInfo& latency,
                 uint32_t unique_touch_event_id);
-  InputEventAck(blink::WebInputEvent::Type type,
+  InputEventAck(InputEventAckSource source,
+                blink::WebInputEvent::Type type,
                 InputEventAckState state,
                 uint32_t unique_touch_event_id);
-  InputEventAck(blink::WebInputEvent::Type type, InputEventAckState state);
+  InputEventAck(InputEventAckSource source,
+                blink::WebInputEvent::Type type,
+                InputEventAckState state);
   InputEventAck();
   ~InputEventAck();
 
+  InputEventAckSource source;
   blink::WebInputEvent::Type type;
   InputEventAckState state;
   ui::LatencyInfo latency;
diff --git a/chromium/content/common/input/input_event_ack_source.h b/chromium/content/common/input/input_event_ack_source.h
new file mode 100644
index 00000000000..c0cea996e02
--- /dev/null
+++ b/chromium/content/common/input/input_event_ack_source.h
@@ -0,0 +1,21 @@
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_INPUT_INPUT_EVENT_ACK_SOURCE_H_
+#define CONTENT_COMMON_INPUT_INPUT_EVENT_ACK_SOURCE_H_
+
+namespace content {
+
+// Describes the source of where the input event ACK was
+// generated from inside the renderer.
+enum class InputEventAckSource {
+  UNKNOWN,
+  COMPOSITOR_THREAD,
+  MAIN_THREAD,
+  MAX = MAIN_THREAD
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_INPUT_INPUT_EVENT_ACK_SOURCE_H_
diff --git a/chromium/content/common/input/input_event_ack_state.h b/chromium/content/common/input/input_event_ack_state.h
index c8e8f833b86..55a392cef74 100644
--- a/chromium/content/common/input/input_event_ack_state.h
+++ b/chromium/content/common/input/input_event_ack_state.h
@@ -15,7 +15,9 @@ enum InputEventAckState {
   INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS,
   INPUT_EVENT_ACK_STATE_IGNORED,
   INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
-  INPUT_EVENT_ACK_STATE_MAX = INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING
+  INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING,
+  INPUT_EVENT_ACK_STATE_MAX =
+      INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING
 };
 
 }  // namespace content
diff --git a/chromium/content/common/input/input_event_stream_validator.cc b/chromium/content/common/input/input_event_stream_validator.cc
index 1a1ffd36184..8025fb8d5c7 100644
--- a/chromium/content/common/input/input_event_stream_validator.cc
+++ b/chromium/content/common/input/input_event_stream_validator.cc
@@ -7,7 +7,7 @@
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "content/public/common/content_switches.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/events/blink/web_input_event_traits.h"
 
 using blink::WebInputEvent;
diff --git a/chromium/content/common/input/input_param_traits_unittest.cc b/chromium/content/common/input/input_param_traits_unittest.cc
index 01acafc2772..dfcdbff8841 100644
--- a/chromium/content/common/input/input_param_traits_unittest.cc
+++ b/chromium/content/common/input/input_param_traits_unittest.cc
@@ -17,7 +17,8 @@
 #include "content/common/input_messages.h"
 #include "ipc/ipc_message.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebGestureEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 
 namespace content {
 namespace {
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders.h b/chromium/content/common/input/synthetic_web_input_event_builders.h
index 034ee49ca79..22558c9b997 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders.h
+++ b/chromium/content/common/input/synthetic_web_input_event_builders.h
@@ -7,7 +7,8 @@
 
 #include "base/time/time.h"
 #include "content/common/content_export.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebGestureEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 
 // Provides sensible creation of default WebInputEvents for testing purposes.
 
diff --git a/chromium/content/common/input/touch_event_stream_validator.h b/chromium/content/common/input/touch_event_stream_validator.h
index 7cd6aa02cbc..c58ab76c96f 100644
--- a/chromium/content/common/input/touch_event_stream_validator.h
+++ b/chromium/content/common/input/touch_event_stream_validator.h
@@ -9,7 +9,7 @@
 
 #include "base/macros.h"
 #include "content/common/content_export.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 
 namespace content {
 
diff --git a/chromium/content/common/input/web_touch_event_traits.h b/chromium/content/common/input/web_touch_event_traits.h
index 1f974aed43f..1cbe804af1a 100644
--- a/chromium/content/common/input/web_touch_event_traits.h
+++ b/chromium/content/common/input/web_touch_event_traits.h
@@ -6,7 +6,7 @@
 #define CONTENT_COMMON_INPUT_WEB_TOUCH_EVENT_TRAITS_H_
 
 #include "content/common/content_export.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/events/blink/scoped_web_input_event.h"
 
 namespace content {
diff --git a/chromium/content/common/input_messages.h b/chromium/content/common/input_messages.h
index 4c68ae82eb3..ba3c213463e 100644
--- a/chromium/content/common/input_messages.h
+++ b/chromium/content/common/input_messages.h
@@ -13,6 +13,7 @@
 #include "content/common/edit_command.h"
 #include "content/common/input/input_event.h"
 #include "content/common/input/input_event_ack.h"
+#include "content/common/input/input_event_ack_source.h"
 #include "content/common/input/input_event_ack_state.h"
 #include "content/common/input/input_event_dispatch_type.h"
 #include "content/common/input/input_param_traits.h"
@@ -25,7 +26,7 @@
 #include "content/common/input/synthetic_tap_gesture_params.h"
 #include "content/common/input/touch_action.h"
 #include "ipc/ipc_message_macros.h"
-#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/events/blink/did_overscroll_params.h"
 #include "ui/events/ipc/latency_info_param_traits.h"
 #include "ui/gfx/geometry/point.h"
@@ -44,6 +45,8 @@
 
 #define IPC_MESSAGE_START InputMsgStart
 
+IPC_ENUM_TRAITS_MAX_VALUE(content::InputEventAckSource,
+                          content::InputEventAckSource::MAX)
 IPC_ENUM_TRAITS_MAX_VALUE(
     content::SyntheticGestureParams::GestureSourceType,
     content::SyntheticGestureParams::GESTURE_SOURCE_TYPE_MAX)
@@ -115,6 +118,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::SyntheticPointerActionParams)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::InputEventAck)
+  IPC_STRUCT_TRAITS_MEMBER(source)
   IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(state)
   IPC_STRUCT_TRAITS_MEMBER(latency)
@@ -145,6 +149,12 @@ IPC_MESSAGE_ROUTED2(InputMsg_ExtendSelectionAndDelete,
                     int /* before */,
                     int /* after */)
 
+// Deletes text before and after the current cursor position, excluding the
+// selection.
+IPC_MESSAGE_ROUTED2(InputMsg_DeleteSurroundingText,
+                    int /* before */,
+                    int /* after */)
+
 // Selects between the given start and end offsets in the currently focused
 // editable field.
 IPC_MESSAGE_ROUTED2(InputMsg_SetEditableSelectionOffsets,
diff --git a/chromium/content/common/layer_tree_settings_factory.cc b/chromium/content/common/layer_tree_settings_factory.cc
index c6ebb32d762..5c33f1dcf10 100644
--- a/chromium/content/common/layer_tree_settings_factory.cc
+++ b/chromium/content/common/layer_tree_settings_factory.cc
@@ -10,21 +10,21 @@
 namespace content {
 
 // static
-void LayerTreeSettingsFactory::SetTopControlsSettings(
+void LayerTreeSettingsFactory::SetBrowserControlsSettings(
     cc::LayerTreeSettings& settings,
     const base::CommandLine& cmd) {
-  if (cmd.HasSwitch(cc::switches::kTopControlsShowThreshold)) {
+  if (cmd.HasSwitch(cc::switches::kBrowserControlsShowThreshold)) {
     std::string top_threshold_str =
-        cmd.GetSwitchValueASCII(cc::switches::kTopControlsShowThreshold);
+        cmd.GetSwitchValueASCII(cc::switches::kBrowserControlsShowThreshold);
     double show_threshold;
     if (base::StringToDouble(top_threshold_str, &show_threshold) &&
         show_threshold >= 0.f && show_threshold <= 1.f)
       settings.top_controls_show_threshold = show_threshold;
   }
 
-  if (cmd.HasSwitch(cc::switches::kTopControlsHideThreshold)) {
+  if (cmd.HasSwitch(cc::switches::kBrowserControlsHideThreshold)) {
     std::string top_threshold_str =
-        cmd.GetSwitchValueASCII(cc::switches::kTopControlsHideThreshold);
+        cmd.GetSwitchValueASCII(cc::switches::kBrowserControlsHideThreshold);
     double hide_threshold;
     if (base::StringToDouble(top_threshold_str, &hide_threshold) &&
         hide_threshold >= 0.f && hide_threshold <= 1.f)
diff --git a/chromium/content/common/layer_tree_settings_factory.h b/chromium/content/common/layer_tree_settings_factory.h
index b97a10d92a4..cc808f75672 100644
--- a/chromium/content/common/layer_tree_settings_factory.h
+++ b/chromium/content/common/layer_tree_settings_factory.h
@@ -18,8 +18,8 @@ class CONTENT_EXPORT LayerTreeSettingsFactory {
   // TODO(xingliu): Refactor LayerTreeSettings generation logic.
   // crbug.com/577985
  public:
-  static void SetTopControlsSettings(cc::LayerTreeSettings& settings,
-                                     const base::CommandLine& command_line);
+  static void SetBrowserControlsSettings(cc::LayerTreeSettings& settings,
+                                         const base::CommandLine& command_line);
 };
 
 }  // namespace content
diff --git a/chromium/content/common/media/OWNERS b/chromium/content/common/media/OWNERS
index 60a6a2318b3..ec46a767169 100644
--- a/chromium/content/common/media/OWNERS
+++ b/chromium/content/common/media/OWNERS
@@ -4,6 +4,9 @@ tommi@chromium.org
 per-file *_messages*.h=set noparent
 per-file *_messages*.h=file://ipc/SECURITY_OWNERS
 
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
+
 per-file *_param_traits*.*=set noparent
 per-file *_param_traits*.*=file://ipc/SECURITY_OWNERS
 
diff --git a/chromium/content/common/media/audio_messages.h b/chromium/content/common/media/audio_messages.h
index 582cc9653a1..5a3f6316ab0 100644
--- a/chromium/content/common/media/audio_messages.h
+++ b/chromium/content/common/media/audio_messages.h
@@ -26,11 +26,8 @@
 IPC_ENUM_TRAITS_MAX_VALUE(media::AudioInputIPCDelegateState,
                           media::AUDIO_INPUT_IPC_DELEGATE_STATE_LAST)
 
-IPC_ENUM_TRAITS_MAX_VALUE(media::AudioOutputIPCDelegateState,
-                          media::AUDIO_OUTPUT_IPC_DELEGATE_STATE_LAST)
-
 IPC_ENUM_TRAITS_MAX_VALUE(media::OutputDeviceStatus,
-                          media::OUTPUT_DEVICE_STATUS_LAST)
+                          media::OUTPUT_DEVICE_STATUS_MAX)
 
 IPC_STRUCT_BEGIN(AudioInputHostMsg_CreateStream_Config)
   IPC_STRUCT_MEMBER(media::AudioParameters, params)
@@ -73,10 +70,8 @@ IPC_MESSAGE_CONTROL5(
     uint32_t /* segment count */)
 
 // Notification message sent from AudioRendererHost to renderer for state
-// update after the renderer has requested a Create/Start/Close.
-IPC_MESSAGE_CONTROL2(AudioMsg_NotifyStreamStateChanged,
-                     int /* stream id */,
-                     media::AudioOutputIPCDelegateState /* new state */)
+// update on error.
+IPC_MESSAGE_CONTROL1(AudioMsg_NotifyStreamError, int /* stream id */)
 
 // Notification message sent from browser to renderer for state update.
 IPC_MESSAGE_CONTROL2(AudioInputMsg_NotifyStreamStateChanged,
diff --git a/chromium/content/common/media/cdm_messages.h b/chromium/content/common/media/cdm_messages.h
deleted file mode 100644
index 136edf1614f..00000000000
--- a/chromium/content/common/media/cdm_messages.h
+++ /dev/null
@@ -1,142 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// IPC messages for content decryption module (CDM) implementation.
-// Multiply-included message file, hence no include guard.
-
-#include <stdint.h>
-
-#include <string>
-#include <vector>
-
-#include "content/common/content_export.h"
-#include "content/common/media/cdm_messages_enums.h"
-#include "ipc/ipc_message_macros.h"
-#include "media/base/cdm_key_information.h"
-#include "media/base/media_keys.h"
-#include "url/gurl.h"
-
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-#define IPC_MESSAGE_START CdmMsgStart
-
-IPC_ENUM_TRAITS_MAX_VALUE(media::CdmKeyInformation::KeyStatus,
-                          media::CdmKeyInformation::KEY_STATUS_MAX)
-IPC_ENUM_TRAITS_MAX_VALUE(media::MediaKeys::Exception,
-                          media::MediaKeys::EXCEPTION_MAX)
-IPC_ENUM_TRAITS_MAX_VALUE(media::MediaKeys::SessionType,
-                          media::MediaKeys::SESSION_TYPE_MAX)
-IPC_ENUM_TRAITS_MAX_VALUE(media::MediaKeys::MessageType,
-                          media::MediaKeys::MESSAGE_TYPE_MAX)
-IPC_ENUM_TRAITS_MAX_VALUE(CdmHostMsg_CreateSession_InitDataType,
-                          INIT_DATA_TYPE_MAX)
-
-IPC_STRUCT_BEGIN(CdmHostMsg_InitializeCdm_Params)
-  IPC_STRUCT_MEMBER(std::string, key_system)
-  IPC_STRUCT_MEMBER(GURL, security_origin)
-  IPC_STRUCT_MEMBER(bool, use_hw_secure_codecs)
-IPC_STRUCT_END()
-
-IPC_STRUCT_TRAITS_BEGIN(media::CdmKeyInformation)
-  IPC_STRUCT_TRAITS_MEMBER(key_id)
-  IPC_STRUCT_TRAITS_MEMBER(status)
-  IPC_STRUCT_TRAITS_MEMBER(system_code)
-IPC_STRUCT_TRAITS_END()
-
-// Parameter structure for CdmHostMsg_CreateSessionAndGenerateRequest.
-IPC_STRUCT_BEGIN(CdmHostMsg_CreateSessionAndGenerateRequest_Params)
-  IPC_STRUCT_MEMBER(int, render_frame_id)
-  IPC_STRUCT_MEMBER(int, cdm_id)
-  IPC_STRUCT_MEMBER(uint32_t, promise_id)
-  IPC_STRUCT_MEMBER(media::MediaKeys::SessionType, session_type)
-  IPC_STRUCT_MEMBER(CdmHostMsg_CreateSession_InitDataType, init_data_type)
-  IPC_STRUCT_MEMBER(std::vector<uint8_t>, init_data)
-IPC_STRUCT_END()
-
-
-// Messages from render to browser.
-
-IPC_MESSAGE_CONTROL4(CdmHostMsg_InitializeCdm,
-                     int /* render_frame_id */,
-                     int /* cdm_id */,
-                     uint32_t /* promise_id */,
-                     CdmHostMsg_InitializeCdm_Params /* params */)
-
-IPC_MESSAGE_CONTROL4(CdmHostMsg_SetServerCertificate,
-                     int /* render_frame_id */,
-                     int /* cdm_id */,
-                     uint32_t /* promise_id */,
-                     std::vector<uint8_t> /* certificate */)
-
-IPC_MESSAGE_CONTROL1(CdmHostMsg_CreateSessionAndGenerateRequest,
-                     CdmHostMsg_CreateSessionAndGenerateRequest_Params)
-
-IPC_MESSAGE_CONTROL5(CdmHostMsg_LoadSession,
-                     int /* render_frame_id */,
-                     int /* cdm_id */,
-                     uint32_t /* promise_id */,
-                     media::MediaKeys::SessionType /* session_type */,
-                     std::string /* session_id */)
-
-IPC_MESSAGE_CONTROL5(CdmHostMsg_UpdateSession,
-                     int /* render_frame_id */,
-                     int /* cdm_id */,
-                     uint32_t /* promise_id */,
-                     std::string /* session_id */,
-                     std::vector<uint8_t> /* response */)
-
-IPC_MESSAGE_CONTROL4(CdmHostMsg_CloseSession,
-                     int /* render_frame_id */,
-                     int /* cdm_id */,
-                     uint32_t /* promise_id */,
-                     std::string /* session_id */)
-
-IPC_MESSAGE_CONTROL4(CdmHostMsg_RemoveSession,
-                     int /* render_frame_id */,
-                     int /* cdm_id */,
-                     uint32_t /* promise_id */,
-                     std::string /* session_id */)
-
-IPC_MESSAGE_CONTROL2(CdmHostMsg_DestroyCdm,
-                     int /* render_frame_id */,
-                     int /* cdm_id */)
-
-// Messages from browser to render.
-
-IPC_MESSAGE_ROUTED4(CdmMsg_SessionMessage,
-                    int /* cdm_id */,
-                    std::string /* session_id */,
-                    media::MediaKeys::MessageType /* message_type */,
-                    std::vector<uint8_t> /* message */)
-
-IPC_MESSAGE_ROUTED2(CdmMsg_SessionClosed,
-                    int /* cdm_id */,
-                    std::string /* session_id */)
-
-IPC_MESSAGE_ROUTED4(CdmMsg_SessionKeysChange,
-                    int /* cdm_id */,
-                    std::string /* session_id */,
-                    bool /* has_additional_usable_key */,
-                    std::vector<media::CdmKeyInformation> /* keys_info */)
-
-IPC_MESSAGE_ROUTED3(CdmMsg_SessionExpirationUpdate,
-                    int /* cdm_id */,
-                    std::string /* session_id */,
-                    base::Time /* new_expiry_time */)
-
-IPC_MESSAGE_ROUTED2(CdmMsg_ResolvePromise,
-                    int /* cdm_id */,
-                    uint32_t /* promise_id */)
-
-IPC_MESSAGE_ROUTED3(CdmMsg_ResolvePromiseWithSession,
-                    int /* cdm_id */,
-                    uint32_t /* promise_id */,
-                    std::string /* session_id */)
-
-IPC_MESSAGE_ROUTED5(CdmMsg_RejectPromise,
-                    int /* cdm_id */,
-                    uint32_t /* promise_id */,
-                    media::MediaKeys::Exception /* exception */,
-                    uint32_t /* system_code */,
-                    std::string /* error_message */)
diff --git a/chromium/content/common/media/cdm_messages_enums.h b/chromium/content/common/media/cdm_messages_enums.h
deleted file mode 100644
index c87eb137c7b..00000000000
--- a/chromium/content/common/media/cdm_messages_enums.h
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MEDIA_CDM_MESSAGES_ENUMS_H_
-#define CONTENT_COMMON_MEDIA_CDM_MESSAGES_ENUMS_H_
-
-// The Initialization Data Type when a request is generated.
-// TODO(ddorwin): Replace this with a generic constant. See crbug.com/417440#c9.
-enum CdmHostMsg_CreateSession_InitDataType {
-  INIT_DATA_TYPE_WEBM,
-  INIT_DATA_TYPE_CENC,
-  INIT_DATA_TYPE_MAX = INIT_DATA_TYPE_CENC
-};
-
-#endif  // CONTENT_COMMON_MEDIA_CDM_MESSAGES_ENUMS_H_
diff --git a/chromium/content/common/media/media_devices.h b/chromium/content/common/media/media_devices.h
index 39255d151a8..98fab1d4006 100644
--- a/chromium/content/common/media/media_devices.h
+++ b/chromium/content/common/media/media_devices.h
@@ -8,6 +8,8 @@
 #include <string>
 #include <vector>
 
+#include "content/common/content_export.h"
+
 namespace content {
 
 enum MediaDeviceType {
@@ -17,7 +19,8 @@ enum MediaDeviceType {
   NUM_MEDIA_DEVICE_TYPES,
 };
 
-struct MediaDeviceInfo {
+struct CONTENT_EXPORT MediaDeviceInfo {
+  MediaDeviceInfo() = default;
   MediaDeviceInfo(const std::string& device_id,
                   const std::string& label,
                   const std::string& group_id);
diff --git a/chromium/content/common/media/media_devices.mojom b/chromium/content/common/media/media_devices.mojom
new file mode 100644
index 00000000000..d53232e5802
--- /dev/null
+++ b/chromium/content/common/media/media_devices.mojom
@@ -0,0 +1,55 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module mojom;
+
+import "url/mojo/origin.mojom";
+
+[Native]
+enum MediaDeviceType;
+
+[Native]
+struct MediaDeviceInfo;
+
+// This object lives in the browser and is responsible for processing device
+// enumeration requests and managing subscriptions for device-change
+// notifications.
+interface MediaDevicesDispatcherHost {
+  // The reply always contains NUM_MEDIA_DEVICE_TYPES elements.
+  // The result is indexed by device type as defined in 
+  // content/common/media/media_devices.h.
+  EnumerateDevices(bool request_audio_input,
+                   bool request_video_input,
+                   bool request_audio_output,
+                   url.mojom.Origin security_origin)
+                       => (array<array<MediaDeviceInfo>> enumeration);
+
+  // Creates a subscription for device-change notifications for the calling
+  // frame/security origin. It is the responsibility of the caller to send
+  // |subscription_id| values that are unique per device type.
+  // Requests to create a subscription with an ID that already exists for type
+  // |type| are invalid and result in a renderer crash.
+  SubscribeDeviceChangeNotifications(MediaDeviceType type,
+                                     uint32 subscription_id,
+                                     url.mojom.Origin security_origin);
+
+  // Removes a subscription to device-change notifications for the calling
+  // frame. The caller is responsible for sending |subscription_id| values that
+  // that refer to existing subscriptions for type |type|. Requests to remove
+  // a nonexisting subscription with are invalid and result in a renderer crash.
+  UnsubscribeDeviceChangeNotifications(MediaDeviceType type,
+                                       uint32 subscription_id);
+};
+
+// This object lives in the renderer process and is used by the browser process
+// to pass device-change notifications to the renderer.
+interface MediaDevicesListener {
+  // Called to notify a change in the set of devices of type |type| for
+  // subscription |subscription_id|. |device_infos| contains the new list of
+  // devices of type |type|, with device and group IDs obfuscated according to
+  // the subscription's security origin.
+  OnDevicesChanged(MediaDeviceType type,
+                   uint32 subscription_id,
+                   array<MediaDeviceInfo> device_infos);
+};
diff --git a/chromium/content/common/media/media_devices.typemap b/chromium/content/common/media/media_devices.typemap
new file mode 100644
index 00000000000..586b971d7b1
--- /dev/null
+++ b/chromium/content/common/media/media_devices.typemap
@@ -0,0 +1,14 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/common/media/media_devices.mojom"
+public_headers = [ "//content/common/media/media_devices.h" ]
+traits_headers = [ "//content/common/media/media_devices_param_traits.h" ]
+deps = [
+  "//content:export",
+]
+type_mappings = [
+  "mojom.MediaDeviceType=::content::MediaDeviceType",
+  "mojom.MediaDeviceInfo=::content::MediaDeviceInfo",
+]
diff --git a/chromium/content/common/media/media_devices_param_traits.cc b/chromium/content/common/media/media_devices_param_traits.cc
new file mode 100644
index 00000000000..d130d42b02c
--- /dev/null
+++ b/chromium/content/common/media/media_devices_param_traits.cc
@@ -0,0 +1,29 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/media/media_devices_param_traits.h"
+
+// Generate param traits size methods.
+#include "ipc/param_traits_size_macros.h"
+namespace IPC {
+#include "content/common/media/media_devices_param_traits.h"
+}  // namespace IPC
+
+// Generate param traits write methods.
+#include "ipc/param_traits_write_macros.h"
+namespace IPC {
+#include "content/common/media/media_devices_param_traits.h"
+}  // namespace IPC
+
+// Generate param traits read methods.
+#include "ipc/param_traits_read_macros.h"
+namespace IPC {
+#include "content/common/media/media_devices_param_traits.h"
+}  // namespace IPC
+
+// Generate param traits log methods.
+#include "ipc/param_traits_log_macros.h"
+namespace IPC {
+#include "content/common/media/media_devices_param_traits.h"
+}  // namespace IPC
diff --git a/chromium/content/common/media/media_devices_param_traits.h b/chromium/content/common/media/media_devices_param_traits.h
new file mode 100644
index 00000000000..ed0830c108f
--- /dev/null
+++ b/chromium/content/common/media/media_devices_param_traits.h
@@ -0,0 +1,21 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Multiply-included IPC traits file, hence no include guard.
+
+#include "content/common/content_export.h"
+#include "content/common/media/media_devices.h"
+#include "ipc/ipc_message_macros.h"
+
+#undef IPC_MESSAGE_EXPORT
+#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
+
+IPC_ENUM_TRAITS_MAX_VALUE(content::MediaDeviceType,
+                          content::NUM_MEDIA_DEVICE_TYPES - 1)
+
+IPC_STRUCT_TRAITS_BEGIN(content::MediaDeviceInfo)
+  IPC_STRUCT_TRAITS_MEMBER(device_id)
+  IPC_STRUCT_TRAITS_MEMBER(label)
+  IPC_STRUCT_TRAITS_MEMBER(group_id)
+IPC_STRUCT_TRAITS_END()
diff --git a/chromium/content/common/media/media_metadata_sanitizer.cc b/chromium/content/common/media/media_metadata_sanitizer.cc
deleted file mode 100644
index 16f548179d8..00000000000
--- a/chromium/content/common/media/media_metadata_sanitizer.cc
+++ /dev/null
@@ -1,110 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/media/media_metadata_sanitizer.h"
-
-#include <algorithm>
-#include <string>
-
-#include "content/public/common/media_metadata.h"
-
-namespace content {
-
-namespace {
-
-// Maximum length for all the strings inside the MediaMetadata when it is sent
-// over IPC. The renderer process should truncate the strings before sending
-// the MediaMetadata and the browser process must do the same when receiving
-// it.
-const size_t kMaxIPCStringLength = 4 * 1024;
-
-// Maximum type length of Artwork, which conforms to RFC 4288
-// (https://tools.ietf.org/html/rfc4288).
-const size_t kMaxArtworkTypeLength = 2 * 127 + 1;
-
-// Maximum number of artwork images inside the MediaMetadata.
-const size_t kMaxNumberOfArtworkImages = 10;
-
-// Maximum of sizes in an artwork image.
-const size_t kMaxNumberOfArtworkSizes = 10;
-
-bool CheckArtworkSrcSanity(const GURL& src) {
-  if (!src.is_valid())
-    return false;
-  if (!src.SchemeIsHTTPOrHTTPS() && !src.SchemeIs(url::kDataScheme))
-    return false;
-  if (src.spec().size() > url::kMaxURLChars)
-    return false;
-
-  return true;
-}
-
-bool CheckArtworkSanity(const MediaMetadata::Artwork& artwork) {
-  if (!CheckArtworkSrcSanity(artwork.src))
-    return false;
-  if (artwork.type.size() > kMaxArtworkTypeLength)
-    return false;
-  if (artwork.sizes.size() > kMaxNumberOfArtworkSizes)
-    return false;
-
-  return true;
-}
-
-// Sanitize artwork. The method should not be called if |artwork.src| is bad.
-MediaMetadata::Artwork SanitizeArtwork(const MediaMetadata::Artwork& artwork) {
-  MediaMetadata::Artwork sanitized_artwork;
-
-  sanitized_artwork.src = artwork.src;
-  sanitized_artwork.type = artwork.type.substr(0, kMaxArtworkTypeLength);
-  for (const auto& size : artwork.sizes) {
-    sanitized_artwork.sizes.push_back(size);
-    if (sanitized_artwork.sizes.size() == kMaxNumberOfArtworkSizes)
-      break;
-  }
-
-  return sanitized_artwork;
-}
-
-}  // anonymous namespace
-
-bool MediaMetadataSanitizer::CheckSanity(const MediaMetadata& metadata) {
-  if (metadata.title.size() > kMaxIPCStringLength)
-    return false;
-  if (metadata.artist.size() > kMaxIPCStringLength)
-    return false;
-  if (metadata.album.size() > kMaxIPCStringLength)
-    return false;
-  if (metadata.artwork.size() > kMaxNumberOfArtworkImages)
-    return false;
-
-  for (const auto& artwork : metadata.artwork) {
-    if (!CheckArtworkSanity(artwork))
-        return false;
-  }
-
-  return true;
-}
-
-MediaMetadata MediaMetadataSanitizer::Sanitize(const MediaMetadata& metadata) {
-  MediaMetadata sanitized_metadata;
-
-  sanitized_metadata.title = metadata.title.substr(0, kMaxIPCStringLength);
-  sanitized_metadata.artist = metadata.artist.substr(0, kMaxIPCStringLength);
-  sanitized_metadata.album = metadata.album.substr(0, kMaxIPCStringLength);
-
-  for (const auto& artwork : metadata.artwork) {
-    if (!CheckArtworkSrcSanity(artwork.src))
-      continue;
-
-    sanitized_metadata.artwork.push_back(
-        CheckArtworkSanity(artwork) ? artwork : SanitizeArtwork(artwork));
-
-    if (sanitized_metadata.artwork.size() == kMaxNumberOfArtworkImages)
-      break;
-  }
-
-  return sanitized_metadata;
-}
-
-}  // namespace content
diff --git a/chromium/content/common/media/media_metadata_sanitizer.h b/chromium/content/common/media/media_metadata_sanitizer.h
deleted file mode 100644
index 6a4d678b25f..00000000000
--- a/chromium/content/common/media/media_metadata_sanitizer.h
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MEDIA_MEDIA_METADATA_SANITIZER_H_
-#define CONTENT_COMMON_MEDIA_MEDIA_METADATA_SANITIZER_H_
-
-namespace content {
-
-struct MediaMetadata;
-
-class MediaMetadataSanitizer {
- public:
-  // Check the sanity of |metadata|.
-  static bool CheckSanity(const MediaMetadata& metadata);
-
-  // Sanitizes |metadata| and return the result.
-  static MediaMetadata Sanitize(const MediaMetadata& metadata);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_MEDIA_MEDIA_METADATA_SANITIZER_H_
diff --git a/chromium/content/common/media/media_player_delegate_messages.h b/chromium/content/common/media/media_player_delegate_messages.h
index 8229b62ea56..7fabeb5fff6 100644
--- a/chromium/content/common/media/media_player_delegate_messages.h
+++ b/chromium/content/common/media/media_player_delegate_messages.h
@@ -16,8 +16,7 @@
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 #define IPC_MESSAGE_START MediaPlayerDelegateMsgStart
 
-IPC_ENUM_TRAITS_MAX_VALUE(media::MediaContentType,
-                          media::MediaContentType::Uncontrollable)
+IPC_ENUM_TRAITS_MAX_VALUE(media::MediaContentType, media::MediaContentType::Max)
 
 // ----------------------------------------------------------------------------
 // Messages from the browser to the renderer requesting playback state changes.
diff --git a/chromium/content/common/media/media_player_messages_android.h b/chromium/content/common/media/media_player_messages_android.h
index b1738c1ea6d..d7b93e61654 100644
--- a/chromium/content/common/media/media_player_messages_android.h
+++ b/chromium/content/common/media/media_player_messages_android.h
@@ -10,6 +10,7 @@
 #include "ipc/ipc_message_macros.h"
 #include "media/blink/renderer_media_player_interface.h"
 #include "media/gpu/ipc/common/media_param_traits.h"
+#include "third_party/WebKit/public/platform/modules/remoteplayback/WebRemotePlaybackAvailability.h"
 #include "ui/gfx/geometry/rect_f.h"
 #include "url/gurl.h"
 
@@ -20,6 +21,9 @@
 IPC_ENUM_TRAITS_MAX_VALUE(MediaPlayerHostMsg_Initialize_Type,
                           MEDIA_PLAYER_TYPE_LAST)
 
+IPC_ENUM_TRAITS_MAX_VALUE(blink::WebRemotePlaybackAvailability,
+                          blink::WebRemotePlaybackAvailability::Last)
+
 // Parameters to describe a media player
 IPC_STRUCT_BEGIN(MediaPlayerHostMsg_Initialize_Params)
   IPC_STRUCT_MEMBER(MediaPlayerHostMsg_Initialize_Type, type)
@@ -120,6 +124,10 @@ IPC_MESSAGE_ROUTED2(MediaPlayerMsg_ConnectedToRemoteDevice,
 IPC_MESSAGE_ROUTED1(MediaPlayerMsg_DisconnectedFromRemoteDevice,
                     int /* player_id */)
 
+// The remote playback has started.
+IPC_MESSAGE_ROUTED1(MediaPlayerMsg_RemotePlaybackStarted,
+                    int /* player_id */)
+
 // The remote playback device selection has been cancelled.
 IPC_MESSAGE_ROUTED1(MediaPlayerMsg_CancelledRemotePlaybackRequest,
                     int /* player_id */)
@@ -127,7 +135,7 @@ IPC_MESSAGE_ROUTED1(MediaPlayerMsg_CancelledRemotePlaybackRequest,
 // The availability of remote devices has changed
 IPC_MESSAGE_ROUTED2(MediaPlayerMsg_RemoteRouteAvailabilityChanged,
                     int /* player_id */,
-                    bool /* routes_available */)
+                    blink::WebRemotePlaybackAvailability /* availability */)
 
 // Messages for controlling the media playback in browser process ----------
 
@@ -176,3 +184,7 @@ IPC_MESSAGE_ROUTED1(MediaPlayerHostMsg_RequestRemotePlayback,
 // Control media playing on a remote device.
 IPC_MESSAGE_ROUTED1(MediaPlayerHostMsg_RequestRemotePlaybackControl,
                     int /* player_id */)
+
+// Stop playing media on a remote device.
+IPC_MESSAGE_ROUTED1(MediaPlayerHostMsg_RequestRemotePlaybackStop,
+                    int /* player_id */)
diff --git a/chromium/content/common/media/media_session.typemap b/chromium/content/common/media/media_session.typemap
index b7566984935..e31ffdddb12 100644
--- a/chromium/content/common/media/media_session.typemap
+++ b/chromium/content/common/media/media_session.typemap
@@ -6,6 +6,6 @@ mojom = "//third_party/WebKit/public/platform/modules/mediasession/media_session
 public_headers = [ "//content/public/common/media_metadata.h" ]
 traits_headers = [ "//content/common/media/media_session_struct_traits.h" ]
 type_mappings = [
-  "blink.mojom.MediaImage=content::MediaMetadata::Artwork",
+  "blink.mojom.MediaImage=content::MediaMetadata::MediaImage",
   "blink.mojom.MediaMetadata=content::MediaMetadata",
 ]
diff --git a/chromium/content/common/media/media_session_struct_traits.h b/chromium/content/common/media/media_session_struct_traits.h
index bff354c9941..571f653277e 100644
--- a/chromium/content/common/media/media_session_struct_traits.h
+++ b/chromium/content/common/media/media_session_struct_traits.h
@@ -11,23 +11,23 @@ namespace mojo {
 
 template <>
 struct StructTraits<blink::mojom::MediaImageDataView,
-                    content::MediaMetadata::Artwork> {
-  static const GURL& src(const content::MediaMetadata::Artwork& artwork) {
-    return artwork.src;
+                    content::MediaMetadata::MediaImage> {
+  static const GURL& src(const content::MediaMetadata::MediaImage& image) {
+    return image.src;
   }
 
   static const base::string16& type(
-      const content::MediaMetadata::Artwork& artwork) {
-    return artwork.type;
+      const content::MediaMetadata::MediaImage& image) {
+    return image.type;
   }
 
   static const std::vector<gfx::Size>& sizes(
-      const content::MediaMetadata::Artwork& artwork) {
-    return artwork.sizes;
+      const content::MediaMetadata::MediaImage& image) {
+    return image.sizes;
   }
 
   static bool Read(blink::mojom::MediaImageDataView data,
-                   content::MediaMetadata::Artwork* out) {
+                   content::MediaMetadata::MediaImage* out) {
     if (!data.ReadSrc(&out->src))
       return false;
     if (!data.ReadType(&out->type))
@@ -54,7 +54,7 @@ struct StructTraits<blink::mojom::MediaMetadataDataView,
     return metadata.album;
   }
 
-  static const std::vector<content::MediaMetadata::Artwork>& artwork(
+  static const std::vector<content::MediaMetadata::MediaImage>& artwork(
       const content::MediaMetadata& metadata) {
     return metadata.artwork;
   }
diff --git a/chromium/content/common/media/media_stream_messages.h b/chromium/content/common/media/media_stream_messages.h
index 78c5e8c4ce8..bdcc42f0a59 100644
--- a/chromium/content/common/media/media_stream_messages.h
+++ b/chromium/content/common/media/media_stream_messages.h
@@ -37,13 +37,13 @@ IPC_STRUCT_TRAITS_BEGIN(content::StreamControls)
   IPC_STRUCT_TRAITS_MEMBER(audio)
   IPC_STRUCT_TRAITS_MEMBER(video)
   IPC_STRUCT_TRAITS_MEMBER(hotword_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(disable_local_echo)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::StreamDeviceInfo)
   IPC_STRUCT_TRAITS_MEMBER(device.type)
   IPC_STRUCT_TRAITS_MEMBER(device.name)
   IPC_STRUCT_TRAITS_MEMBER(device.id)
-  IPC_STRUCT_TRAITS_MEMBER(device.group_id)
   IPC_STRUCT_TRAITS_MEMBER(device.video_facing)
   IPC_STRUCT_TRAITS_MEMBER(device.matched_output_device_id)
   IPC_STRUCT_TRAITS_MEMBER(device.input.sample_rate)
@@ -96,9 +96,6 @@ IPC_MESSAGE_ROUTED3(MediaStreamMsg_DeviceOpened,
 IPC_MESSAGE_ROUTED1(MediaStreamMsg_DeviceOpenFailed,
                     int /* request id */)
 
-// The browser has detected a change in the set of media devices.
-IPC_MESSAGE_ROUTED0(MediaStreamMsg_DevicesChanged)
-
 // Messages sent from the renderer to the browser.
 
 // Request a new media stream.
@@ -119,19 +116,6 @@ IPC_MESSAGE_CONTROL2(MediaStreamHostMsg_StopStreamDevice,
                      int /* render frame id */,
                      std::string /*device_id*/)
 
-// Request to enumerate devices.
-// Used by Pepper and WebRTC.
-IPC_MESSAGE_CONTROL4(MediaStreamHostMsg_EnumerateDevices,
-                     int /* render frame id */,
-                     int /* request id */,
-                     content::MediaStreamType /* type */,
-                     url::Origin /* security origin */)
-
-// Request to stop enumerating devices.
-IPC_MESSAGE_CONTROL2(MediaStreamHostMsg_CancelEnumerateDevices,
-                     int /* render frame id */,
-                     int /* request id */)
-
 // Request to open the device.
 IPC_MESSAGE_CONTROL5(MediaStreamHostMsg_OpenDevice,
                      int /* render frame id */,
@@ -145,15 +129,6 @@ IPC_MESSAGE_CONTROL2(MediaStreamHostMsg_CloseDevice,
                      int /* render frame id */,
                      std::string /*label*/)
 
-// Subscribe to notifications about changes in the set of media devices.
-IPC_MESSAGE_CONTROL2(MediaStreamHostMsg_SubscribeToDeviceChangeNotifications,
-                     int /* render frame id */,
-                     url::Origin /* security origin */)
-
-// Cancel notifications about changes in the set of media devices.
-IPC_MESSAGE_CONTROL1(MediaStreamHostMsg_CancelDeviceChangeNotifications,
-                     int /* render frame id */)
-
 // Tell the browser process if the video capture is secure (i.e., all
 // connected video sinks meet the requirement of output protection.).
 // Note: the browser process only trusts the |is_sucure| value in this IPC
diff --git a/chromium/content/common/media/media_stream_options.cc b/chromium/content/common/media/media_stream_options.cc
index 876a0d1f50c..ba390927fba 100644
--- a/chromium/content/common/media/media_stream_options.cc
+++ b/chromium/content/common/media/media_stream_options.cc
@@ -24,10 +24,16 @@ TrackControls::TrackControls(const TrackControls& other) = default;
 TrackControls::~TrackControls() {}
 
 StreamControls::StreamControls()
-    : audio(false), video(false), hotword_enabled(false) {}
+    : audio(false),
+      video(false),
+      hotword_enabled(false),
+      disable_local_echo(false) {}
 
 StreamControls::StreamControls(bool request_audio, bool request_video)
-    : audio(request_audio), video(request_video), hotword_enabled(false) {}
+    : audio(request_audio),
+      video(request_video),
+      hotword_enabled(false),
+      disable_local_echo(false) {}
 
 StreamControls::~StreamControls() {}
 
@@ -39,28 +45,18 @@ StreamDeviceInfo::StreamDeviceInfo()
 
 StreamDeviceInfo::StreamDeviceInfo(MediaStreamType service_param,
                                    const std::string& name_param,
-                                   const std::string& device_param,
-                                   const std::string& group_param)
-    : device(service_param, device_param, name_param, group_param),
-      session_id(kNoId) {}
-
-StreamDeviceInfo::StreamDeviceInfo(MediaStreamType service_param,
-                                   const std::string& name_param,
                                    const std::string& device_param)
-    : StreamDeviceInfo(service_param, name_param, device_param, std::string()) {
-}
+    : device(service_param, device_param, name_param), session_id(kNoId) {}
 
 StreamDeviceInfo::StreamDeviceInfo(MediaStreamType service_param,
                                    const std::string& name_param,
                                    const std::string& device_param,
-                                   const std::string& group_param,
                                    int sample_rate,
                                    int channel_layout,
                                    int frames_per_buffer)
     : device(service_param,
              device_param,
              name_param,
-             group_param,
              sample_rate,
              channel_layout,
              frames_per_buffer),
diff --git a/chromium/content/common/media/media_stream_options.h b/chromium/content/common/media/media_stream_options.h
index 5eb060697d1..2eb56283425 100644
--- a/chromium/content/common/media/media_stream_options.h
+++ b/chromium/content/common/media/media_stream_options.h
@@ -24,8 +24,8 @@ CONTENT_EXPORT extern const char kMediaStreamSourceSystem[];
 struct CONTENT_EXPORT TrackControls {
  public:
   TrackControls();
-  TrackControls(bool request);
-  TrackControls(const TrackControls& other);
+  explicit TrackControls(bool request);
+  explicit TrackControls(const TrackControls& other);
   ~TrackControls();
   bool requested;
 
@@ -57,6 +57,7 @@ struct CONTENT_EXPORT StreamControls {
   // Hotword functionality (chromeos only)
   // See crbug.com/564574 for discussion on possibly #ifdef'ing this out.
   bool hotword_enabled;  // kMediaStreamAudioHotword = "googHotword";
+  bool disable_local_echo;
 };
 
 // StreamDeviceInfo describes information about a device.
@@ -70,11 +71,6 @@ struct CONTENT_EXPORT StreamDeviceInfo {
   StreamDeviceInfo(MediaStreamType service_param,
                    const std::string& name_param,
                    const std::string& device_param,
-                   const std::string& group_param);
-  StreamDeviceInfo(MediaStreamType service_param,
-                   const std::string& name_param,
-                   const std::string& device_param,
-                   const std::string& group_param,
                    int sample_rate,
                    int channel_layout,
                    int frames_per_buffer);
diff --git a/chromium/content/common/media/midi_messages.h b/chromium/content/common/media/midi_messages.h
index 504b395687e..4882b379daa 100644
--- a/chromium/content/common/media/midi_messages.h
+++ b/chromium/content/common/media/midi_messages.h
@@ -5,23 +5,27 @@
 // IPC messages for access to MIDI hardware.
 // Multiply-included message file, hence no include guard.
 
+// TODO(toyoshim): Mojofication is working in progress. Until the work is
+// finished, this file temporarily depends on midi_service.mojom.h.
+// Once the migration is finished, this file will be removed.
+// http://crbug.com/582327
+
 #include <stdint.h>
 
 #include "content/common/content_export.h"
 #include "ipc/ipc_message_macros.h"
 #include "ipc/param_traits_macros.h"
 #include "media/midi/midi_port_info.h"
-#include "media/midi/result.h"
+#include "media/midi/midi_service.mojom.h"
 #include "url/gurl.h"
 
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 #define IPC_MESSAGE_START MidiMsgStart
 
-IPC_ENUM_TRAITS_MAX_VALUE(media::midi::MidiPortState,
-                          media::midi::MIDI_PORT_STATE_LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(midi::mojom::PortState, midi::mojom::PortState::LAST)
 
-IPC_STRUCT_TRAITS_BEGIN(media::midi::MidiPortInfo)
+IPC_STRUCT_TRAITS_BEGIN(midi::MidiPortInfo)
   IPC_STRUCT_TRAITS_MEMBER(id)
   IPC_STRUCT_TRAITS_MEMBER(manufacturer)
   IPC_STRUCT_TRAITS_MEMBER(name)
@@ -29,7 +33,7 @@ IPC_STRUCT_TRAITS_BEGIN(media::midi::MidiPortInfo)
   IPC_STRUCT_TRAITS_MEMBER(state)
 IPC_STRUCT_TRAITS_END()
 
-IPC_ENUM_TRAITS_MAX_VALUE(media::midi::Result, media::midi::Result::MAX)
+IPC_ENUM_TRAITS_MAX_VALUE(midi::mojom::Result, midi::mojom::Result::MAX)
 
 // Messages for IPC between MidiMessageFilter and MidiHost.
 
@@ -46,20 +50,20 @@ IPC_MESSAGE_CONTROL0(MidiHostMsg_EndSession)
 // Messages sent from the browser to the renderer.
 
 IPC_MESSAGE_CONTROL1(MidiMsg_AddInputPort,
-                     media::midi::MidiPortInfo /* input port */)
+                     midi::MidiPortInfo /* input port */)
 
 IPC_MESSAGE_CONTROL1(MidiMsg_AddOutputPort,
-                     media::midi::MidiPortInfo /* output port */)
+                     midi::MidiPortInfo /* output port */)
 
 IPC_MESSAGE_CONTROL2(MidiMsg_SetInputPortState,
                      uint32_t /* port */,
-                     media::midi::MidiPortState /* state */)
+                     midi::mojom::PortState /* state */)
 
 IPC_MESSAGE_CONTROL2(MidiMsg_SetOutputPortState,
                      uint32_t /* port */,
-                     media::midi::MidiPortState /* state */)
+                     midi::mojom::PortState /* state */)
 
-IPC_MESSAGE_CONTROL1(MidiMsg_SessionStarted, media::midi::Result /* result */)
+IPC_MESSAGE_CONTROL1(MidiMsg_SessionStarted, midi::mojom::Result /* result */)
 
 IPC_MESSAGE_CONTROL3(MidiMsg_DataReceived,
                      uint32_t /* port */,
diff --git a/chromium/content/common/media/video_capture.h b/chromium/content/common/media/video_capture.h
index 09632c440a0..298d575a8c5 100644
--- a/chromium/content/common/media/video_capture.h
+++ b/chromium/content/common/media/video_capture.h
@@ -8,8 +8,8 @@
 #define CONTENT_COMMON_MEDIA_VIDEO_CAPTURE_H_
 
 #include "base/callback.h"
-#include "media/base/video_capture_types.h"
-#include "media/base/video_capturer_source.h"
+#include "media/capture/video_capture_types.h"
+#include "media/capture/video_capturer_source.h"
 
 namespace content {
 
diff --git a/chromium/content/common/media/video_capture_messages.h b/chromium/content/common/media/video_capture_messages.h
deleted file mode 100644
index 1c92066c252..00000000000
--- a/chromium/content/common/media/video_capture_messages.h
+++ /dev/null
@@ -1,121 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/memory/shared_memory.h"
-#include "content/common/content_export.h"
-#include "content/common/media/video_capture.h"
-#include "content/public/common/common_param_traits.h"
-#include "ipc/ipc_message_macros.h"
-#include "media/base/video_capture_types.h"
-#include "media/base/video_frame.h"
-#include "ui/gfx/gpu_memory_buffer.h"
-
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-#define IPC_MESSAGE_START VideoCaptureMsgStart
-
-IPC_ENUM_TRAITS_MAX_VALUE(content::VideoCaptureState,
-                          content::VIDEO_CAPTURE_STATE_LAST)
-IPC_ENUM_TRAITS_MAX_VALUE(media::ResolutionChangePolicy,
-                          media::RESOLUTION_POLICY_LAST)
-IPC_ENUM_TRAITS_MAX_VALUE(media::VideoFrame::StorageType,
-                          media::VideoFrame::STORAGE_LAST)
-IPC_ENUM_TRAITS_MAX_VALUE(media::PowerLineFrequency,
-                          media::PowerLineFrequency::FREQUENCY_MAX)
-
-IPC_STRUCT_TRAITS_BEGIN(media::VideoCaptureParams)
-  IPC_STRUCT_TRAITS_MEMBER(requested_format)
-  IPC_STRUCT_TRAITS_MEMBER(resolution_change_policy)
-  IPC_STRUCT_TRAITS_MEMBER(power_line_frequency)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_BEGIN(VideoCaptureMsg_BufferReady_Params)
-  IPC_STRUCT_MEMBER(int, device_id)
-  IPC_STRUCT_MEMBER(int, buffer_id)
-  IPC_STRUCT_MEMBER(base::TimeDelta, timestamp)
-  IPC_STRUCT_MEMBER(base::DictionaryValue, metadata)
-  IPC_STRUCT_MEMBER(media::VideoPixelFormat, pixel_format)
-  IPC_STRUCT_MEMBER(media::VideoFrame::StorageType, storage_type)
-  IPC_STRUCT_MEMBER(gfx::Size, coded_size)
-  IPC_STRUCT_MEMBER(gfx::Rect, visible_rect)
-IPC_STRUCT_END()
-
-// TODO(nick): device_id in these messages is basically just a route_id. We
-// should shift to IPC_MESSAGE_ROUTED and use MessageRouter in the filter impls.
-
-// Notify the renderer process about the state update such as
-// Start/Pause/Stop.
-IPC_MESSAGE_CONTROL2(VideoCaptureMsg_StateChanged,
-                     int /* device id */,
-                     content::VideoCaptureState /* new state */)
-
-// Tell the renderer process that a new buffer is allocated for video capture.
-IPC_MESSAGE_CONTROL4(VideoCaptureMsg_NewBuffer,
-                     int /* device id */,
-                     base::SharedMemoryHandle /* handle */,
-                     int /* length */,
-                     int /* buffer_id */)
-
-// Tell the renderer process that a new GpuMemoryBuffer backed buffer is
-// allocated for video capture.
-IPC_MESSAGE_CONTROL4(VideoCaptureMsg_NewBuffer2,
-                     int /* device id */,
-                     std::vector<gfx::GpuMemoryBufferHandle> /* handles */,
-                     gfx::Size /* dimensions */,
-                     int /* buffer_id */)
-
-// Tell the renderer process that it should release a buffer previously
-// allocated by VideoCaptureMsg_NewBuffer.
-IPC_MESSAGE_CONTROL2(VideoCaptureMsg_FreeBuffer,
-                     int /* device id */,
-                     int /* buffer_id */)
-
-// Tell the renderer process that a Buffer is available from video capture, and
-// send the associated VideoFrame constituent parts as IPC parameters.
-IPC_MESSAGE_CONTROL1(VideoCaptureMsg_BufferReady,
-                     VideoCaptureMsg_BufferReady_Params)
-
-// Notify the renderer about a device's supported formats; this is a response
-// to a VideoCaptureHostMsg_GetDeviceSupportedFormats request.
-IPC_MESSAGE_CONTROL2(VideoCaptureMsg_DeviceSupportedFormatsEnumerated,
-                     int /* device_id */,
-                     media::VideoCaptureFormats /* supported_formats */)
-
-// Notify the renderer about a device's format(s) in use; this is a response
-// to a VideoCaptureHostMsg_GetDeviceFormatInUse request.
-IPC_MESSAGE_CONTROL2(VideoCaptureMsg_DeviceFormatsInUseReceived,
-                     int /* device_id */,
-                     media::VideoCaptureFormats /* formats_in_use */)
-
-// Start a video capture as |device_id|, a new id picked by the renderer
-// process. The session to be started is determined by |params.session_id|.
-IPC_MESSAGE_CONTROL3(VideoCaptureHostMsg_Start,
-                     int /* device_id */,
-                     media::VideoCaptureSessionId, /* session_id */
-                     media::VideoCaptureParams /* params */)
-
-// Resume the video capture specified by |device_id|, |session_id| and
-// |params|.
-IPC_MESSAGE_CONTROL3(VideoCaptureHostMsg_Resume,
-                     int, /* device_id */
-                     media::VideoCaptureSessionId, /* session_id */
-                     media::VideoCaptureParams /* params */)
-
-// Tell the browser process that the renderer has finished reading from
-// a buffer previously delivered by VideoCaptureMsg_BufferReady.
-IPC_MESSAGE_CONTROL4(VideoCaptureHostMsg_BufferReady,
-                     int /* device_id */,
-                     int /* buffer_id */,
-                     gpu::SyncToken /* sync_token */,
-                     double /* consumer_resource_utilization */)
-
-// Get the formats supported by a device referenced by |capture_session_id|.
-IPC_MESSAGE_CONTROL2(VideoCaptureHostMsg_GetDeviceSupportedFormats,
-                     int /* device_id */,
-                     media::VideoCaptureSessionId /* session_id */)
-
-// Get the format(s) in use by a device referenced by |capture_session_id|.
-IPC_MESSAGE_CONTROL2(VideoCaptureHostMsg_GetDeviceFormatsInUse,
-                     int /* device_id */,
-                     media::VideoCaptureSessionId /* session_id */)
diff --git a/chromium/content/common/native_types.mojom b/chromium/content/common/native_types.mojom
index 222ee34803a..d11886248fc 100644
--- a/chromium/content/common/native_types.mojom
+++ b/chromium/content/common/native_types.mojom
@@ -20,5 +20,21 @@ struct RendererPreferences;
 [Native]
 struct ResizeParams;
 
+// NOTE: This type is only mapped and usable on Mac.
+[Native]
+enum ScrollbarButtonsPlacement;
+
+// NOTE: This type is only mapped and usable on Mac.
+[Native]
+enum ScrollerStyle;
+
 [Native]
 struct WebPreferences;
+
+// TODO(rockot): This should most likely be defined by network service mojom,
+// but the network service doesn't exist yet.
+[Native]
+enum NetworkConnectionType;
+
+[Native]
+enum WebPopupType;
diff --git a/chromium/content/common/native_types.typemap b/chromium/content/common/native_types.typemap
index ad8a5468737..e75986137f5 100644
--- a/chromium/content/common/native_types.typemap
+++ b/chromium/content/common/native_types.typemap
@@ -9,6 +9,8 @@ public_headers = [
   "//content/common/resize_params.h",
   "//content/public/common/renderer_preferences.h",
   "//content/public/common/web_preferences.h",
+  "//net/base/network_change_notifier.h",
+  "//third_party/WebKit/public/web/WebPopupType.h",
 ]
 traits_headers = [
   "//content/common/frame_messages.h",
@@ -25,6 +27,7 @@ public_deps = [
   "//cc/ipc",
   "//media",
   "//media/base/ipc",
+  "//net",
   "//ui/accessibility",
   "//ui/base/ime:text_input_types",
   "//ui/gfx/ipc",
@@ -36,7 +39,9 @@ public_deps = [
 type_mappings = [
   "content.mojom.FrameOwnerProperties=content::FrameOwnerProperties",
   "content.mojom.FrameReplicationState=content::FrameReplicationState",
+  "content.mojom.NetworkConnectionType=net::NetworkChangeNotifier::ConnectionType",
   "content.mojom.RendererPreferences=content::RendererPreferences",
   "content.mojom.ResizeParams=content::ResizeParams",
+  "content.mojom.WebPopupType=blink::WebPopupType",
   "content.mojom.WebPreferences=content::WebPreferences",
 ]
diff --git a/chromium/content/common/native_types_mac.typemap b/chromium/content/common/native_types_mac.typemap
new file mode 100644
index 00000000000..d614f0476f4
--- /dev/null
+++ b/chromium/content/common/native_types_mac.typemap
@@ -0,0 +1,34 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/common/native_types.mojom"
+public_headers = [
+  "//third_party/WebKit/public/platform/WebScrollbarButtonsPlacement.h",
+  "//third_party/WebKit/public/web/mac/WebScrollbarTheme.h",
+]
+traits_headers = [ "//content/common/view_messages.h" ]
+deps = [
+  # NOTE: These dependencies are here to satisfy gn check because
+  # common_param_traits_macros.h and/or view_messages.h include their headers.
+  # Although the mojo bindings target is configured to allow direct circular
+  # includes from //content/common and //content/public/common, this isn't a
+  # transitive allowance, so those targets' own public_deps aren't included in
+  # the set of implied dependencies.
+  "//cc/ipc",
+  "//media",
+  "//media/base/ipc",
+  "//net",
+  "//third_party/WebKit/public:blink_headers",
+  "//ui/accessibility",
+  "//ui/base/ime:text_input_types",
+  "//ui/gfx/ipc",
+  "//ui/gfx/ipc/color",
+  "//ui/gfx/ipc/skia",
+  "//ui/surface",
+  "//url/ipc:url_ipc",
+]
+type_mappings = [
+  "content.mojom.ScrollerStyle=::blink::ScrollerStyle",
+  "content.mojom.ScrollbarButtonsPlacement=::blink::WebScrollbarButtonsPlacement",
+]
diff --git a/chromium/content/common/navigation_params.cc b/chromium/content/common/navigation_params.cc
index 2518e72800b..d6d1eb1abaa 100644
--- a/chromium/content/common/navigation_params.cc
+++ b/chromium/content/common/navigation_params.cc
@@ -22,10 +22,9 @@ bool ShouldMakeNetworkRequestForURL(const GURL& url) {
   // to the network stack.
   // TODO(clamy): same document navigations should not send requests to the
   // network stack. Neither should pushState/popState.
-  return url != GURL(url::kAboutBlankURL) &&
-         !url.SchemeIs(url::kJavaScriptScheme) && !url.is_empty() &&
-         !url.SchemeIs(url::kContentIDScheme) &&
-         url != GURL(content::kAboutSrcDocURL);
+  return url != url::kAboutBlankURL && !url.SchemeIs(url::kJavaScriptScheme) &&
+         !url.is_empty() && !url.SchemeIs(url::kContentIDScheme) &&
+         url != content::kAboutSrcDocURL;
 }
 
 CommonNavigationParams::CommonNavigationParams()
@@ -124,8 +123,6 @@ StartNavigationParams::~StartNavigationParams() {
 RequestNavigationParams::RequestNavigationParams()
     : is_overriding_user_agent(false),
       can_load_local_resources(false),
-      request_time(base::Time::Now()),
-      page_id(-1),
       nav_entry_id(0),
       is_same_document_history_load(false),
       is_history_navigation_in_new_child(false),
@@ -144,9 +141,7 @@ RequestNavigationParams::RequestNavigationParams(
     bool is_overriding_user_agent,
     const std::vector<GURL>& redirects,
     bool can_load_local_resources,
-    base::Time request_time,
     const PageState& page_state,
-    int32_t page_id,
     int nav_entry_id,
     bool is_same_document_history_load,
     bool is_history_navigation_in_new_child,
@@ -162,9 +157,7 @@ RequestNavigationParams::RequestNavigationParams(
     : is_overriding_user_agent(is_overriding_user_agent),
       redirects(redirects),
       can_load_local_resources(can_load_local_resources),
-      request_time(request_time),
       page_state(page_state),
-      page_id(page_id),
       nav_entry_id(nav_entry_id),
       is_same_document_history_load(is_same_document_history_load),
       is_history_navigation_in_new_child(is_history_navigation_in_new_child),
diff --git a/chromium/content/common/navigation_params.h b/chromium/content/common/navigation_params.h
index 6fd86aafcd6..98757a7303b 100644
--- a/chromium/content/common/navigation_params.h
+++ b/chromium/content/common/navigation_params.h
@@ -163,6 +163,10 @@ struct CONTENT_EXPORT BeginNavigationParams {
 
   // Indicates the request context type.
   RequestContextType request_context_type;
+
+  // See WebSearchableFormData for a description of these.
+  GURL searchable_form_url;
+  std::string searchable_form_encoding;
 };
 
 // Provided by the browser -----------------------------------------------------
@@ -217,9 +221,7 @@ struct CONTENT_EXPORT RequestNavigationParams {
   RequestNavigationParams(bool is_overriding_user_agent,
                           const std::vector<GURL>& redirects,
                           bool can_load_local_resources,
-                          base::Time request_time,
                           const PageState& page_state,
-                          int32_t page_id,
                           int nav_entry_id,
                           bool is_same_document_history_load,
                           bool is_history_navigation_in_new_child,
@@ -249,20 +251,9 @@ struct CONTENT_EXPORT RequestNavigationParams {
   // resources.
   bool can_load_local_resources;
 
-  // The time the request was created. This is used by the old performance
-  // infrastructure to set up DocumentState associated with the RenderView.
-  // TODO(ppi): make it go away.
-  base::Time request_time;
-
   // Opaque history state (received by ViewHostMsg_UpdateState).
   PageState page_state;
 
-  // The page_id for this navigation, or -1 if it is a new navigation.  Back,
-  // Forward, and Reload navigations should have a valid page_id.  If the load
-  // succeeds, then this page_id will be reflected in the resultant
-  // FrameHostMsg_DidCommitProvisionalLoad message.
-  int32_t page_id;
-
   // For browser-initiated navigations, this is the unique id of the
   // NavigationEntry being navigated to. (For renderer-initiated navigations it
   // is 0.) If the load succeeds, then this nav_entry_id will be reflected in
diff --git a/chromium/content/common/net/url_fetcher.cc b/chromium/content/common/net/url_fetcher.cc
index f4bf457b26b..6540f0da7cc 100644
--- a/chromium/content/common/net/url_fetcher.cc
+++ b/chromium/content/common/net/url_fetcher.cc
@@ -19,15 +19,16 @@ base::SupportsUserData::Data* CreateURLRequestUserData(int render_process_id,
 
 }  // namespace
 
-void AssociateURLFetcherWithRenderFrame(net::URLFetcher* url_fetcher,
-                                        const GURL& initiator,
-                                        int render_process_id,
-                                        int render_frame_id) {
-  url_fetcher->SetInitiatorURL(initiator);
+void AssociateURLFetcherWithRenderFrame(
+    net::URLFetcher* url_fetcher,
+    const base::Optional<url::Origin>& initiator,
+    int render_process_id,
+    int render_frame_id) {
+  url_fetcher->SetInitiator(initiator);
   url_fetcher->SetURLRequestUserData(
       URLRequestUserData::kUserDataKey,
-      base::Bind(&CreateURLRequestUserData,
-                 render_process_id, render_frame_id));
+      base::Bind(&CreateURLRequestUserData, render_process_id,
+                 render_frame_id));
 }
 
 }  // namespace content
diff --git a/chromium/content/common/origin_trials/trial_token.cc b/chromium/content/common/origin_trials/trial_token.cc
index ae11999ee3a..ab9debf19a3 100644
--- a/chromium/content/common/origin_trials/trial_token.cc
+++ b/chromium/content/common/origin_trials/trial_token.cc
@@ -4,8 +4,6 @@
 
 #include "content/common/origin_trials/trial_token.h"
 
-#include <openssl/curve25519.h>
-
 #include <vector>
 
 #include "base/base64.h"
@@ -17,6 +15,7 @@
 #include "base/time/time.h"
 #include "base/values.h"
 #include "third_party/WebKit/public/platform/WebOriginTrialTokenStatus.h"
+#include "third_party/boringssl/src/include/openssl/curve25519.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
diff --git a/chromium/content/common/origin_trials/trial_token.h b/chromium/content/common/origin_trials/trial_token.h
index 9e4f8244eab..9432756394a 100644
--- a/chromium/content/common/origin_trials/trial_token.h
+++ b/chromium/content/common/origin_trials/trial_token.h
@@ -13,6 +13,8 @@
 #include "content/common/content_export.h"
 #include "url/origin.h"
 
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size);
+
 namespace blink {
 enum class WebOriginTrialTokenStatus;
 }
@@ -60,7 +62,12 @@ class CONTENT_EXPORT TrialToken {
   base::Time expiry_time() { return expiry_time_; }
 
  protected:
+  // Tests can access the Parse method directly to validate it, and so are
+  // declared as friends here. All other access to Parse should be made through
+  // TrialToken::From, which will always also ensure that there is a valid
+  // signature attached to the token.
   friend class TrialTokenTest;
+  friend int ::LLVMFuzzerTestOneInput(const uint8_t*, size_t);
 
   // If the string represents a properly signed and well-formed token, the token
   // payload is returned in the |out_token_payload| parameter and success is
diff --git a/chromium/content/common/origin_trials/trial_token_validator.cc b/chromium/content/common/origin_trials/trial_token_validator.cc
index 34ae30448f2..2cb1dd3d43d 100644
--- a/chromium/content/common/origin_trials/trial_token_validator.cc
+++ b/chromium/content/common/origin_trials/trial_token_validator.cc
@@ -5,6 +5,7 @@
 #include "content/common/origin_trials/trial_token_validator.h"
 
 #include "base/feature_list.h"
+#include "base/memory/ptr_util.h"
 #include "base/time/time.h"
 #include "content/common/origin_trials/trial_token.h"
 #include "content/public/common/content_client.h"
@@ -83,4 +84,52 @@ bool TrialTokenValidator::RequestEnablesFeature(
   return false;
 }
 
+std::unique_ptr<TrialTokenValidator::FeatureToTokensMap>
+TrialTokenValidator::GetValidTokensFromHeaders(
+    const url::Origin& origin,
+    const net::HttpResponseHeaders* headers) {
+  std::unique_ptr<FeatureToTokensMap> tokens(
+      base::MakeUnique<FeatureToTokensMap>());
+  if (!base::FeatureList::IsEnabled(features::kOriginTrials))
+    return tokens;
+
+  if (!IsOriginSecure(origin.GetURL()))
+    return tokens;
+
+  size_t iter = 0;
+  std::string token;
+  while (headers->EnumerateHeader(&iter, "Origin-Trial", &token)) {
+    std::string token_feature;
+    if (TrialTokenValidator::ValidateToken(token, origin, &token_feature) ==
+        blink::WebOriginTrialTokenStatus::Success) {
+      (*tokens)[token_feature].push_back(token);
+    }
+  }
+  return tokens;
+}
+
+std::unique_ptr<TrialTokenValidator::FeatureToTokensMap>
+TrialTokenValidator::GetValidTokens(const url::Origin& origin,
+                                    const FeatureToTokensMap& tokens) {
+  std::unique_ptr<FeatureToTokensMap> out_tokens(
+      base::MakeUnique<FeatureToTokensMap>());
+  if (!base::FeatureList::IsEnabled(features::kOriginTrials))
+    return out_tokens;
+
+  if (!IsOriginSecure(origin.GetURL()))
+    return out_tokens;
+
+  for (const auto& feature : tokens) {
+    for (const std::string& token : feature.second) {
+      std::string token_feature;
+      if (TrialTokenValidator::ValidateToken(token, origin, &token_feature) ==
+          blink::WebOriginTrialTokenStatus::Success) {
+        DCHECK_EQ(token_feature, feature.first);
+        (*out_tokens)[feature.first].push_back(token);
+      }
+    }
+  }
+  return out_tokens;
+}
+
 }  // namespace content
diff --git a/chromium/content/common/origin_trials/trial_token_validator.h b/chromium/content/common/origin_trials/trial_token_validator.h
index 1997985cb4e..9a8cce9f1bc 100644
--- a/chromium/content/common/origin_trials/trial_token_validator.h
+++ b/chromium/content/common/origin_trials/trial_token_validator.h
@@ -5,7 +5,10 @@
 #ifndef CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_TOKEN_VALIDATOR_H_
 #define CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_TOKEN_VALIDATOR_H_
 
+#include <map>
+#include <memory>
 #include <string>
+#include <vector>
 #include "base/strings/string_piece.h"
 #include "content/common/content_export.h"
 #include "url/origin.h"
@@ -23,6 +26,9 @@ namespace content {
 
 namespace TrialTokenValidator {
 
+using FeatureToTokensMap = std::map<std::string /* feature_name */,
+                                    std::vector<std::string /* token */>>;
+
 // If token validates, |*feature_name| is set to the name of the feature the
 // token enables.
 // This method is thread-safe.
@@ -39,6 +45,17 @@ CONTENT_EXPORT bool RequestEnablesFeature(
     const net::HttpResponseHeaders* response_headers,
     base::StringPiece feature_name);
 
+// Returns all valid tokens in |headers|.
+CONTENT_EXPORT std::unique_ptr<FeatureToTokensMap> GetValidTokensFromHeaders(
+    const url::Origin& origin,
+    const net::HttpResponseHeaders* headers);
+
+// Returns all valid tokens in |tokens|. This method is used to re-validate
+// previously stored tokens.
+CONTENT_EXPORT std::unique_ptr<FeatureToTokensMap> GetValidTokens(
+    const url::Origin& origin,
+    const FeatureToTokensMap& tokens);
+
 }  // namespace TrialTokenValidator
 
 }  // namespace content
diff --git a/chromium/content/common/origin_util.cc b/chromium/content/common/origin_util.cc
index 4af685acc31..11873d63cfd 100644
--- a/chromium/content/common/origin_util.cc
+++ b/chromium/content/common/origin_util.cc
@@ -4,17 +4,12 @@
 
 #include "content/public/common/origin_util.h"
 
-#include <string>
-
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/stl_util.h"
-#include "base/strings/string_piece.h"
 #include "content/public/common/content_client.h"
-#include "content/public/common/url_constants.h"
 #include "net/base/url_util.h"
 #include "url/gurl.h"
-#include "url/url_constants.h"
 
 namespace content {
 
@@ -95,63 +90,4 @@ void ResetSchemesAndOriginsWhitelistForTesting() {
   g_trustworthy_whitelist.Get().Reset();
 }
 
-bool HasSuborigin(const GURL& url) {
-  if (!url.is_valid())
-    return false;
-
-  if (url.scheme() != kHttpSuboriginScheme &&
-      url.scheme() != kHttpsSuboriginScheme) {
-    return false;
-  }
-
-  base::StringPiece host_piece = url.host_piece();
-  size_t first_period = host_piece.find('.');
-
-  // If the first period is the first position in the hostname, or there is no
-  // period at all, there is no suborigin serialized in the hostname.
-  if (first_period == 0 || first_period == base::StringPiece::npos)
-    return false;
-
-  // If there's nothing after the first dot, then there is no host for the
-  // physical origin, which is not a valid suborigin serialization.
-  if (first_period == (host_piece.size() - 1))
-    return false;
-
-  return true;
-}
-
-std::string SuboriginFromUrl(const GURL& url) {
-  if (!HasSuborigin(url))
-    return "";
-
-  std::string host = url.host();
-  size_t suborigin_end = host.find(".");
-  return (suborigin_end == std::string::npos) ? ""
-                                              : host.substr(0, suborigin_end);
-}
-
-GURL StripSuboriginFromUrl(const GURL& url) {
-  if (!HasSuborigin(url))
-    return url;
-
-  GURL::Replacements replacements;
-  if (url.scheme() == kHttpSuboriginScheme) {
-    replacements.SetSchemeStr(url::kHttpScheme);
-  } else {
-    DCHECK(url.scheme() == kHttpsSuboriginScheme);
-    replacements.SetSchemeStr(url::kHttpsScheme);
-  }
-
-  std::string host = url.host();
-  size_t suborigin_end = host.find(".");
-  std::string new_host(
-      (suborigin_end == std::string::npos)
-          ? ""
-          : host.substr(suborigin_end + 1,
-                        url.host().length() - suborigin_end - 1));
-  replacements.SetHostStr(new_host);
-
-  return url.ReplaceComponents(replacements);
-}
-
 }  // namespace content
diff --git a/chromium/content/common/origin_util_unittest.cc b/chromium/content/common/origin_util_unittest.cc
index d4409a01f01..3c2328bff99 100644
--- a/chromium/content/common/origin_util_unittest.cc
+++ b/chromium/content/common/origin_util_unittest.cc
@@ -47,81 +47,4 @@ TEST(URLSchemesTest, IsOriginSecure) {
       IsOriginSecure(GURL("filesystem:https://www.example.com/temporary/")));
 }
 
-TEST(OriginUtilTest, Suborigins) {
-  GURL no_suborigin_simple_url("https://b");
-  GURL suborigin_simple_url("https-so://a.b");
-  GURL no_suborigin_path_url("https://example.com/some/path");
-  GURL suborigin_path_url("https-so://foobar.example.com/some/path");
-  GURL no_suborigin_url_with_port("https://example.com:1234");
-  GURL suborigin_url_with_port("https-so://foobar.example.com:1234");
-  GURL no_suborigin_url_with_query("https://example.com/some/path?query");
-  GURL suborigin_url_with_query(
-      "https-so://foobar.example.com/some/path?query");
-  GURL no_suborigin_url_with_fragment("https://example.com/some/path#fragment");
-  GURL suborigin_url_with_fragment(
-      "https-so://foobar.example.com/some/path#fragment");
-  GURL no_suborigin_url_big(
-      "https://example.com:1234/some/path?query#fragment");
-  GURL suborigin_url_big(
-      "https-so://foobar.example.com:1234/some/path?query#fragment");
-
-  EXPECT_FALSE(HasSuborigin(no_suborigin_simple_url));
-  EXPECT_FALSE(HasSuborigin(no_suborigin_path_url));
-  EXPECT_TRUE(HasSuborigin(suborigin_simple_url));
-  EXPECT_TRUE(HasSuborigin(suborigin_path_url));
-  EXPECT_TRUE(HasSuborigin(suborigin_url_with_port));
-  EXPECT_TRUE(HasSuborigin(suborigin_url_with_query));
-  EXPECT_TRUE(HasSuborigin(suborigin_url_with_fragment));
-  EXPECT_TRUE(HasSuborigin(suborigin_url_big));
-
-  EXPECT_EQ("", SuboriginFromUrl(no_suborigin_simple_url));
-  EXPECT_EQ("", SuboriginFromUrl(no_suborigin_path_url));
-  EXPECT_EQ("a", SuboriginFromUrl(suborigin_simple_url));
-  EXPECT_EQ("foobar", SuboriginFromUrl(suborigin_path_url));
-  EXPECT_EQ("foobar", SuboriginFromUrl(suborigin_url_with_port));
-  EXPECT_EQ("foobar", SuboriginFromUrl(suborigin_url_with_query));
-  EXPECT_EQ("foobar", SuboriginFromUrl(suborigin_url_with_fragment));
-  EXPECT_EQ("foobar", SuboriginFromUrl(suborigin_url_big));
-
-  EXPECT_EQ(no_suborigin_simple_url,
-            StripSuboriginFromUrl(no_suborigin_simple_url));
-  EXPECT_EQ(no_suborigin_path_url,
-            StripSuboriginFromUrl(no_suborigin_path_url));
-  EXPECT_EQ(no_suborigin_simple_url,
-            StripSuboriginFromUrl(suborigin_simple_url));
-  EXPECT_EQ(no_suborigin_path_url, StripSuboriginFromUrl(suborigin_path_url));
-  EXPECT_EQ(no_suborigin_url_with_port,
-            StripSuboriginFromUrl(suborigin_url_with_port));
-  EXPECT_EQ(no_suborigin_url_with_query,
-            StripSuboriginFromUrl(suborigin_url_with_query));
-  EXPECT_EQ(no_suborigin_url_with_fragment,
-            StripSuboriginFromUrl(suborigin_url_with_fragment));
-  EXPECT_EQ(no_suborigin_url_big, StripSuboriginFromUrl(suborigin_url_big));
-
-  // Failure cases/invalid suborigins
-  GURL just_dot_url("https-so://.");
-  GURL empty_hostname_url("https-so://");
-  GURL empty_suborigin_url("https-so://.foo");
-  GURL no_dot_url("https-so://foo");
-  GURL suborigin_but_empty_host_url("https-so://foo.");
-  EXPECT_FALSE(HasSuborigin(just_dot_url));
-  EXPECT_FALSE(HasSuborigin(empty_hostname_url));
-  EXPECT_FALSE(HasSuborigin(empty_suborigin_url));
-  EXPECT_FALSE(HasSuborigin(no_dot_url));
-  EXPECT_FALSE(HasSuborigin(suborigin_but_empty_host_url));
-
-  EXPECT_EQ("", SuboriginFromUrl(just_dot_url));
-  EXPECT_EQ("", SuboriginFromUrl(empty_hostname_url));
-  EXPECT_EQ("", SuboriginFromUrl(empty_suborigin_url));
-  EXPECT_EQ("", SuboriginFromUrl(no_dot_url));
-  EXPECT_EQ("", SuboriginFromUrl(suborigin_but_empty_host_url));
-
-  EXPECT_EQ(just_dot_url, StripSuboriginFromUrl(just_dot_url));
-  EXPECT_EQ(empty_hostname_url, StripSuboriginFromUrl(empty_hostname_url));
-  EXPECT_EQ(empty_suborigin_url, StripSuboriginFromUrl(empty_suborigin_url));
-  EXPECT_EQ(no_dot_url, StripSuboriginFromUrl(no_dot_url));
-  EXPECT_EQ(suborigin_but_empty_host_url,
-            StripSuboriginFromUrl(suborigin_but_empty_host_url));
-}
-
 }  // namespace content
diff --git a/chromium/content/common/page_messages.h b/chromium/content/common/page_messages.h
index 6b988a352d4..6d81f3f965e 100644
--- a/chromium/content/common/page_messages.h
+++ b/chromium/content/common/page_messages.h
@@ -43,6 +43,8 @@ IPC_MESSAGE_ROUTED2(PageMsg_SetHistoryOffsetAndLength,
                     int /* history_offset */,
                     int /* history_length */)
 
+IPC_MESSAGE_ROUTED1(PageMsg_AudioStateChanged, bool /* is_audio_playing */)
+
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
diff --git a/chromium/content/common/page_state_serialization.cc b/chromium/content/common/page_state_serialization.cc
index 2d4782e27b6..894ff2be722 100644
--- a/chromium/content/common/page_state_serialization.cc
+++ b/chromium/content/common/page_state_serialization.cc
@@ -83,12 +83,12 @@ bool AppendReferencedFilesFromDocumentState(
   if (document_state.empty())
     return true;
 
-  // This algorithm is adapted from Blink's core/html/FormController.cpp code.
+  // This algorithm is adapted from Blink's FormController code.
   // We only care about how that code worked when this code snapshot was taken
   // as this code is only needed for backwards compat.
   //
-  // For reference, see FormController::formStatesFromStateVector at:
-  // http://src.chromium.org/viewvc/blink/trunk/Source/core/html/FormController.cpp?pathrev=152274
+  // For reference, see FormController::formStatesFromStateVector in
+  // third_party/WebKit/Source/core/html/forms/FormController.cpp.
 
   size_t index = 0;
 
@@ -765,6 +765,10 @@ scoped_refptr<ResourceRequestBodyImpl> DecodeResourceRequestBody(
   scoped_refptr<ResourceRequestBodyImpl> result = new ResourceRequestBodyImpl();
   SerializeObject obj(data, static_cast<int>(size));
   ReadResourceRequestBody(&obj, result);
+  // Please see the EncodeResourceRequestBody() function below for information
+  // about why the contains_sensitive_info() field is being explicitly
+  // deserialized.
+  result->set_contains_sensitive_info(ReadBoolean(&obj));
   return obj.parse_error ? nullptr : result;
 }
 
@@ -773,6 +777,11 @@ std::string EncodeResourceRequestBody(
   SerializeObject obj;
   obj.version = kCurrentVersion;
   WriteResourceRequestBody(resource_request_body, &obj);
+  // EncodeResourceRequestBody() is different from WriteResourceRequestBody()
+  // because it covers additional data (e.g.|contains_sensitive_info|) which
+  // is marshaled between native code and java. WriteResourceRequestBody()
+  // serializes data which needs to be saved out to disk.
+  WriteBoolean(resource_request_body.contains_sensitive_info(), &obj);
   return obj.GetAsString();
 }
 
diff --git a/chromium/content/common/power_monitor_messages.h b/chromium/content/common/power_monitor_messages.h
deleted file mode 100644
index 9b462454c85..00000000000
--- a/chromium/content/common/power_monitor_messages.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Multiply-included message file, no include guard.
-
-#include "ipc/ipc_message_macros.h"
-#include "ipc/ipc_param_traits.h"
-#include "ipc/ipc_platform_file.h"
-
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-#define IPC_MESSAGE_START PowerMonitorMsgStart
-
-// Messages sent from the browser to the renderer/gpu.
-
-// Notification of a change in power status of the computer, such
-// as from switching between battery and A/C power.
-IPC_MESSAGE_CONTROL1(PowerMonitorMsg_PowerStateChange,
-    bool /* on_battery_power */)
-
-// Notification that the system is suspending.
-IPC_MESSAGE_CONTROL0(PowerMonitorMsg_Suspend)
-
-// Notification that the system is resuming.
-IPC_MESSAGE_CONTROL0(PowerMonitorMsg_Resume)
diff --git a/chromium/content/common/render_message_filter.mojom b/chromium/content/common/render_message_filter.mojom
index 3b19f688afe..be6a9a97cdf 100644
--- a/chromium/content/common/render_message_filter.mojom
+++ b/chromium/content/common/render_message_filter.mojom
@@ -4,6 +4,7 @@
 
 module content.mojom;
 
+import "content/common/native_types.mojom";
 import "content/public/common/window_container_type.mojom";
 import "third_party/WebKit/public/platform/referrer.mojom";
 import "third_party/WebKit/public/web/window_features.mojom";
@@ -82,4 +83,13 @@ interface RenderMessageFilter {
   // be created.
   [Sync] CreateNewWindow(CreateNewWindowParams params)
       => (CreateNewWindowReply reply);
+
+  // Similar to CreateWindow, except used for sub-widgets, like <select>
+  // dropdowns.
+  [Sync] CreateNewWidget(int32 opener_id, content.mojom.WebPopupType popup_type)
+      => (int32 route_id);
+
+  // Similar to CreateWidget except the widget is a full screen window.
+  [Sync] CreateFullscreenWidget(int32 opener_id)
+      => (int32 route_id);
 };
diff --git a/chromium/content/common/renderer.mojom b/chromium/content/common/renderer.mojom
index 80b1f2f4a4d..6c7fb6abb94 100644
--- a/chromium/content/common/renderer.mojom
+++ b/chromium/content/common/renderer.mojom
@@ -54,11 +54,6 @@ struct CreateViewParams {
   // Whether the window associated with this view was created with an opener.
   bool window_was_created_with_opener;
 
-  // The initial page ID to use for this view, which must be larger than any
-  // existing navigation that might be loaded in the view.  Page IDs are unique
-  // to a view and are only updated by the renderer after this initial value.
-  int32 next_page_id;
-
   // The initial renderer size.
   ResizeParams initial_size;
 
@@ -127,6 +122,14 @@ struct CreateFrameParams {
   CreateFrameWidgetParams widget_params;
 };
 
+struct UpdateScrollbarThemeParams {
+  float initial_button_delay;
+  float autoscroll_button_delay;
+  bool jump_on_track_click;
+  ScrollerStyle preferred_scroller_style;
+  bool redraw;
+  ScrollbarButtonsPlacement button_placement;
+};
 
 // The primordial Channel-associated interface implemented by a render process.
 // This should be used for implementing browser-to-renderer control messages
@@ -148,4 +151,25 @@ interface Renderer {
   CreateFrameProxy(int32 routing_id, int32 render_view_routing_id,
                    int32 opener_routing_id, int32 parent_routing_id,
                    FrameReplicationState replication_state);
+
+  // Tells the renderer that the network type has changed so that
+  // navigator.onLine and navigator.connection can be updated.
+  OnNetworkConnectionChanged(NetworkConnectionType connection_type,
+                             double max_bandwidth_mbps);
+
+  // Tells the renderer to suspend/resume the webkit timers. Only for use on
+  // Android.
+  SetWebKitSharedTimersSuspended(bool suspend);
+
+  // Tells the renderer about a scrollbar appearance change. Only for use on
+  // OS X.
+  UpdateScrollbarTheme(UpdateScrollbarThemeParams params);
+
+  // Notification that the OS X Aqua color preferences changed.
+  OnSystemColorsChanged(int32 aqua_color_variant, string highlight_text_color,
+                        string highlight_color);
+
+  // Tells the renderer to empty its plugin list cache, optional reloading
+  // pages containing plugins.
+  PurgePluginListCache(bool reload_pages);
 };
diff --git a/chromium/content/common/resize_params.cc b/chromium/content/common/resize_params.cc
index ee6943fc77b..49199a7d851 100644
--- a/chromium/content/common/resize_params.cc
+++ b/chromium/content/common/resize_params.cc
@@ -7,7 +7,7 @@
 namespace content {
 
 ResizeParams::ResizeParams()
-    : top_controls_shrink_blink_size(false),
+    : browser_controls_shrink_blink_size(false),
       top_controls_height(0.f),
       bottom_controls_height(0.f),
       is_fullscreen_granted(false),
diff --git a/chromium/content/common/resize_params.h b/chromium/content/common/resize_params.h
index 436cb562b94..547dd35d6cc 100644
--- a/chromium/content/common/resize_params.h
+++ b/chromium/content/common/resize_params.h
@@ -28,7 +28,7 @@ struct CONTENT_EXPORT ResizeParams {
 
   // Whether or not Blink's viewport size should be shrunk by the height of the
   // URL-bar (always false on platforms where URL-bar hiding isn't supported).
-  bool top_controls_shrink_blink_size;
+  bool browser_controls_shrink_blink_size;
 
   // The height of the top controls (always 0 on platforms where URL-bar hiding
   // isn't supported).
@@ -42,9 +42,6 @@ struct CONTENT_EXPORT ResizeParams {
   // DPI-adjusted pixels.
   gfx::Size visible_viewport_size;
 
-  // The resizer rect.
-  gfx::Rect resizer_rect;
-
   // Indicates whether tab-initiated fullscreen was granted.
   bool is_fullscreen_granted;
 
diff --git a/chromium/content/common/resource_messages.cc b/chromium/content/common/resource_messages.cc
index 31330a7e208..5062ca5ede0 100644
--- a/chromium/content/common/resource_messages.cc
+++ b/chromium/content/common/resource_messages.cc
@@ -396,6 +396,7 @@ void ParamTraits<scoped_refptr<content::ResourceRequestBodyImpl>>::GetSize(
   if (p.get()) {
     GetParamSize(s, *p->elements());
     GetParamSize(s, p->identifier());
+    GetParamSize(s, p->contains_sensitive_info());
   }
 }
 
@@ -406,6 +407,7 @@ void ParamTraits<scoped_refptr<content::ResourceRequestBodyImpl>>::Write(
   if (p.get()) {
     WriteParam(m, *p->elements());
     WriteParam(m, p->identifier());
+    WriteParam(m, p->contains_sensitive_info());
   }
 }
 
@@ -424,9 +426,13 @@ bool ParamTraits<scoped_refptr<content::ResourceRequestBodyImpl>>::Read(
   int64_t identifier;
   if (!ReadParam(m, iter, &identifier))
     return false;
+  bool contains_sensitive_info;
+  if (!ReadParam(m, iter, &contains_sensitive_info))
+    return false;
   *r = new content::ResourceRequestBodyImpl;
   (*r)->swap_elements(&elements);
   (*r)->set_identifier(identifier);
+  (*r)->set_contains_sensitive_info(contains_sensitive_info);
   return true;
 }
 
diff --git a/chromium/content/common/resource_messages.h b/chromium/content/common/resource_messages.h
index 6812be78ea8..765dbe0a4b4 100644
--- a/chromium/content/common/resource_messages.h
+++ b/chromium/content/common/resource_messages.h
@@ -365,10 +365,6 @@ IPC_SYNC_MESSAGE_ROUTED2_1(ResourceHostMsg_SyncLoad,
 IPC_MESSAGE_CONTROL1(ResourceHostMsg_DataReceived_ACK,
                      int /* request_id */)
 
-// Sent when the renderer has processed a DataDownloaded message.
-IPC_MESSAGE_CONTROL1(ResourceHostMsg_DataDownloaded_ACK,
-                     int /* request_id */)
-
 // Sent by the renderer process to acknowledge receipt of a
 // UploadProgress message.
 IPC_MESSAGE_CONTROL1(ResourceHostMsg_UploadProgress_ACK,
diff --git a/chromium/content/common/resource_request.h b/chromium/content/common/resource_request.h
index 6e07eef0278..0f5651fadff 100644
--- a/chromium/content/common/resource_request.h
+++ b/chromium/content/common/resource_request.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/memory/ref_counted.h"
+#include "base/optional.h"
 #include "content/common/content_export.h"
 #include "content/common/navigation_params.h"
 #include "content/common/resource_request_body_impl.h"
@@ -47,7 +48,7 @@ struct CONTENT_EXPORT ResourceRequest {
 
   // The origin of the context which initiated the request, which will be used
   // for cookie checks like 'First-Party-Only'.
-  url::Origin request_initiator;
+  base::Optional<url::Origin> request_initiator;
 
   // The referrer to use (may be empty).
   GURL referrer;
diff --git a/chromium/content/common/resource_request_body_impl.cc b/chromium/content/common/resource_request_body_impl.cc
index 80212bd96a1..2484aec00e0 100644
--- a/chromium/content/common/resource_request_body_impl.cc
+++ b/chromium/content/common/resource_request_body_impl.cc
@@ -12,7 +12,9 @@ using blink::WebString;
 
 namespace content {
 
-ResourceRequestBodyImpl::ResourceRequestBodyImpl() : identifier_(0) {}
+ResourceRequestBodyImpl::ResourceRequestBodyImpl()
+    : identifier_(0),
+      contains_sensitive_info_(false) {}
 
 void ResourceRequestBodyImpl::AppendBytes(const char* bytes, int bytes_len) {
   if (bytes_len > 0) {
diff --git a/chromium/content/common/resource_request_body_impl.h b/chromium/content/common/resource_request_body_impl.h
index 4cc8ad04b8b..bb74d6a8f7c 100644
--- a/chromium/content/common/resource_request_body_impl.h
+++ b/chromium/content/common/resource_request_body_impl.h
@@ -58,12 +58,21 @@ class CONTENT_EXPORT ResourceRequestBodyImpl : public ResourceRequestBody,
   // Returns paths referred to by |elements| of type Element::TYPE_FILE.
   std::vector<base::FilePath> GetReferencedFiles() const;
 
+  // Sets the flag which indicates whether the post data contains sensitive
+  // information like passwords.
+  void set_contains_sensitive_info(bool contains_sensitive_info) {
+    contains_sensitive_info_ = contains_sensitive_info;
+  }
+  bool contains_sensitive_info() const { return contains_sensitive_info_; }
+
  private:
   ~ResourceRequestBodyImpl() override;
 
   std::vector<Element> elements_;
   int64_t identifier_;
 
+  bool contains_sensitive_info_;
+
   DISALLOW_COPY_AND_ASSIGN(ResourceRequestBodyImpl);
 };
 
diff --git a/chromium/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc b/chromium/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc
index bf356017359..be6a91c6c67 100644
--- a/chromium/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc
+++ b/chromium/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc
@@ -15,6 +15,10 @@
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
+#if defined(__x86_64__)
+#include <asm/prctl.h>
+#endif
+
 using sandbox::bpf_dsl::AllOf;
 using sandbox::bpf_dsl::Allow;
 using sandbox::bpf_dsl::AnyOf;
@@ -36,6 +40,7 @@ namespace content {
 
 namespace {
 
+#if !defined(__i386__)
 // Restricts the arguments to sys_socket() to AF_UNIX. Returns a BoolExpr that
 // evaluates to true if the syscall should be allowed.
 BoolExpr RestrictSocketArguments(const Arg<int>& domain,
@@ -47,6 +52,7 @@ BoolExpr RestrictSocketArguments(const Arg<int>& domain,
                      (type & ~kSockFlags) == SOCK_STREAM),
                protocol == 0);
 }
+#endif  // !defined(__i386__)
 
 }  // namespace
 
@@ -80,6 +86,10 @@ ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const {
     case __NR_getpriority:
     case __NR_ioctl:
     case __NR_mremap:
+#if defined(__i386__)
+    // Used on pre-N to initialize threads in ART.
+    case __NR_modify_ldt:
+#endif
     case __NR_msync:
     // File system access cannot be restricted with seccomp-bpf on Android,
     // since the JVM classloader and other Framework features require file
@@ -97,6 +107,10 @@ ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const {
     case __NR_sched_getscheduler:
     case __NR_sched_setscheduler:
     case __NR_setpriority:
+#if defined(__i386__)
+    // Used on N+ instead of __NR_modify_ldt to initialize threads in ART.
+    case __NR_set_thread_area:
+#endif
     case __NR_set_tid_address:
     case __NR_sigaltstack:
 #if defined(__i386__) || defined(__arm__)
@@ -137,6 +151,16 @@ ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const {
     return sandbox::RestrictClockID();
   }
 
+#if defined(__x86_64__)
+  if (sysno == __NR_arch_prctl) {
+    const Arg<int> code(0);
+    return If(code == ARCH_SET_GS, Allow()).Else(Error(EPERM));
+  }
+#endif
+
+  // Restrict socket-related operations. On non-i386 platforms, these are
+  // individual syscalls. On i386, the socketcall syscall demultiplexes many
+  // socket operations.
 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
       defined(__mips__)
   if (sysno == __NR_socket) {
@@ -146,6 +170,13 @@ ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const {
     return If(RestrictSocketArguments(domain, type, protocol), Allow())
            .Else(Error(EPERM));
   }
+
+  // https://crbug.com/655300
+  if (sysno == __NR_getsockname) {
+    // Rather than blocking with SIGSYS, just return an error. This is not
+    // documented to be a valid errno, but we will use it anyways.
+    return Error(EPERM);
+  }
 #elif defined(__i386__)
   if (sysno == __NR_socketcall) {
     const Arg<int> socketcall(0);
@@ -153,9 +184,7 @@ ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const {
     const Arg<int> type(2);
     const Arg<int> protocol(3);
     return If(socketcall == SYS_CONNECT, Allow())
-           .ElseIf(AllOf(socketcall == SYS_SOCKET,
-                         RestrictSocketArguments(domain, type, protocol)),
-                   Allow())
+           .ElseIf(socketcall == SYS_SOCKET, Allow())
            .ElseIf(socketcall == SYS_GETSOCKOPT, Allow())
            .Else(Error(EPERM));
   }
diff --git a/chromium/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/chromium/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
index 47c0bebeecc..09eedbb37e5 100644
--- a/chromium/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
+++ b/chromium/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
@@ -19,6 +19,7 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
+#include "base/files/file_enumerator.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
@@ -154,9 +155,16 @@ intptr_t GpuSIGSYS_Handler(const struct arch_seccomp_data& args,
 
 void AddV4L2GpuWhitelist(std::vector<BrokerFilePermission>* permissions) {
   if (IsAcceleratedVideoDecodeEnabled()) {
-    // Device node for V4L2 video decode accelerator drivers.
-    static const char kDevVideoDecPath[] = "/dev/video-dec";
-    permissions->push_back(BrokerFilePermission::ReadWrite(kDevVideoDecPath));
+    // Device nodes for V4L2 video decode accelerator drivers.
+    static const base::FilePath::CharType kDevicePath[] =
+        FILE_PATH_LITERAL("/dev/");
+    static const base::FilePath::CharType kVideoDecPattern[] = "video-dec[0-9]";
+    base::FileEnumerator enumerator(base::FilePath(kDevicePath), false,
+                                    base::FileEnumerator::FILES,
+                                    base::FilePath(kVideoDecPattern).value());
+    for (base::FilePath name = enumerator.Next(); !name.empty();
+         name = enumerator.Next())
+      permissions->push_back(BrokerFilePermission::ReadWrite(name.value()));
   }
 
   // Device node for V4L2 video encode accelerator drivers.
diff --git a/chromium/content/common/sandbox_linux/bpf_renderer_policy_linux.cc b/chromium/content/common/sandbox_linux/bpf_renderer_policy_linux.cc
index b6a960ceef3..67c1301d604 100644
--- a/chromium/content/common/sandbox_linux/bpf_renderer_policy_linux.cc
+++ b/chromium/content/common/sandbox_linux/bpf_renderer_policy_linux.cc
@@ -88,7 +88,8 @@ ResultExpr RendererProcessPolicy::EvaluateSyscall(int sysno) const {
     case __NR_sched_setscheduler:
       return sandbox::RestrictSchedTarget(GetPolicyPid(), sysno);
     case __NR_prlimit64:
-      return Error(EPERM);  // See crbug.com/160157.
+      // See crbug.com/662450.
+      return sandbox::RestrictPrlimitToGetrlimit(GetPolicyPid());
     default:
       // Default on the content baseline policy.
       return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
diff --git a/chromium/content/common/sandbox_mac_system_access_unittest.mm b/chromium/content/common/sandbox_mac_system_access_unittest.mm
index b37b967d2b9..735bb995442 100644
--- a/chromium/content/common/sandbox_mac_system_access_unittest.mm
+++ b/chromium/content/common/sandbox_mac_system_access_unittest.mm
@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
-#include <openssl/rand.h>
 #include <stdint.h>
 
 #include "base/files/file_util.h"
@@ -15,6 +14,7 @@
 #include "content/common/sandbox_mac_unittest_helper.h"
 #include "crypto/openssl_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/boringssl/src/include/openssl/rand.h"
 #import "ui/base/clipboard/clipboard_util_mac.h"
 
 namespace content {
diff --git a/chromium/content/common/sandbox_win.cc b/chromium/content/common/sandbox_win.cc
index 2cd1e9c32ca..633012ff60d 100644
--- a/chromium/content/common/sandbox_win.cc
+++ b/chromium/content/common/sandbox_win.cc
@@ -17,7 +17,7 @@
 #include "base/macros.h"
 #include "base/memory/shared_memory.h"
 #include "base/metrics/field_trial.h"
-#include "base/metrics/sparse_histogram.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/path_service.h"
 #include "base/process/launch.h"
 #include "base/strings/string_number_conversions.h"
@@ -601,7 +601,7 @@ sandbox::ResultCode AddAppContainerPolicy(sandbox::TargetPolicy* policy,
 sandbox::ResultCode AddWin32kLockdownPolicy(sandbox::TargetPolicy* policy,
                                             bool enable_opm) {
 #if !defined(NACL_WIN64)
-  if (!IsWin32kRendererLockdownEnabled())
+  if (!IsWin32kLockdownEnabled())
     return sandbox::SBOX_ALL_OK;
 
   // Enable win32k lockdown if not already.
@@ -735,8 +735,7 @@ sandbox::ResultCode StartSandboxedProcess(
     return result;
 
 #if !defined(NACL_WIN64)
-  if (type_str == switches::kRendererProcess &&
-      IsWin32kRendererLockdownEnabled()) {
+  if (type_str == switches::kRendererProcess && IsWin32kLockdownEnabled()) {
     result = AddWin32kLockdownPolicy(policy, false);
     if (result != sandbox::SBOX_ALL_OK)
       return result;
diff --git a/chromium/content/common/security_style_util.cc b/chromium/content/common/security_style_util.cc
deleted file mode 100644
index dcb9eb84fca..00000000000
--- a/chromium/content/common/security_style_util.cc
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/security_style_util.h"
-
-#include "url/gurl.h"
-
-namespace content {
-
-SecurityStyle GetSecurityStyleForResource(
-    const GURL& url,
-    bool has_certificate,
-    net::CertStatus cert_status) {
-  // An HTTPS response may not have a certificate for some reason.  When that
-  // happens, use the unauthenticated (HTTP) rather than the authentication
-  // broken security style so that we can detect this error condition.
-  if (!url.SchemeIsCryptographic() || !has_certificate)
-    return SECURITY_STYLE_UNAUTHENTICATED;
-
-  // Minor errors don't lower the security style to
-  // SECURITY_STYLE_AUTHENTICATION_BROKEN.
-  if (net::IsCertStatusError(cert_status) &&
-      !net::IsCertStatusMinorError(cert_status)) {
-    return SECURITY_STYLE_AUTHENTICATION_BROKEN;
-  }
-
-  return SECURITY_STYLE_AUTHENTICATED;
-}
-
-}  // namespace content
diff --git a/chromium/content/common/security_style_util.h b/chromium/content/common/security_style_util.h
deleted file mode 100644
index 81aa1645a32..00000000000
--- a/chromium/content/common/security_style_util.h
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_SECURITY_STYLE_UTIL_H_
-#define CONTENT_COMMON_SECURITY_STYLE_UTIL_H_
-
-#include "content/public/common/security_style.h"
-#include "net/cert/cert_status_flags.h"
-
-class GURL;
-
-namespace content {
-
-// Returns a security style describing an individual resource. Does
-// not take into account any of the page- or host-level state such as
-// mixed content or whether the host has run insecure content.
-SecurityStyle GetSecurityStyleForResource(const GURL& url,
-                                          bool has_certificate,
-                                          net::CertStatus cert_status);
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_SECURITY_STYLE_UTIL_H_
diff --git a/chromium/content/common/service_manager/DEPS b/chromium/content/common/service_manager/DEPS
index 4aa4defd619..b583263b872 100644
--- a/chromium/content/common/service_manager/DEPS
+++ b/chromium/content/common/service_manager/DEPS
@@ -1,5 +1,5 @@
 include_rules = [
   "+mojo/converters/network",
   "+mojo/edk/embedder",
-  "+services/shell",
+  "+services/service_manager",
 ]
diff --git a/chromium/content/common/service_manager/OWNERS b/chromium/content/common/service_manager/OWNERS
index 9216e7a75ab..3f76ba38349 100644
--- a/chromium/content/common/service_manager/OWNERS
+++ b/chromium/content/common/service_manager/OWNERS
@@ -1,3 +1,6 @@
+ben@chromium.org
+rockot@chromium.org
+
 per-file *_messages*.h=set noparent
 per-file *_messages*.h=file://ipc/SECURITY_OWNERS
 
diff --git a/chromium/content/common/service_manager/child_connection.cc b/chromium/content/common/service_manager/child_connection.cc
index f21e9c032dd..acbb8797415 100644
--- a/chromium/content/common/service_manager/child_connection.cc
+++ b/chromium/content/common/service_manager/child_connection.cc
@@ -11,17 +11,17 @@
 #include "content/public/common/service_manager_connection.h"
 #include "mojo/edk/embedder/embedder.h"
 #include "mojo/public/cpp/system/message_pipe.h"
-#include "services/shell/public/cpp/connector.h"
-#include "services/shell/public/cpp/identity.h"
-#include "services/shell/public/cpp/interface_registry.h"
-#include "services/shell/public/interfaces/service.mojom.h"
+#include "services/service_manager/public/cpp/connector.h"
+#include "services/service_manager/public/cpp/identity.h"
+#include "services/service_manager/public/cpp/interface_registry.h"
+#include "services/service_manager/public/interfaces/service.mojom.h"
 
 namespace content {
 
 namespace {
 
 void CallBinderOnTaskRunner(
-    const shell::InterfaceRegistry::Binder& binder,
+    const service_manager::InterfaceRegistry::Binder& binder,
     scoped_refptr<base::SequencedTaskRunner> task_runner,
     const std::string& interface_name,
     mojo::ScopedMessagePipeHandle request_handle) {
@@ -37,13 +37,13 @@ class ChildConnection::IOThreadContext
  public:
   IOThreadContext() {}
 
-  void Initialize(const shell::Identity& child_identity,
-                  shell::Connector* connector,
+  void Initialize(const service_manager::Identity& child_identity,
+                  service_manager::Connector* connector,
                   mojo::ScopedMessagePipeHandle service_pipe,
                   scoped_refptr<base::SequencedTaskRunner> io_task_runner) {
     DCHECK(!io_task_runner_);
     io_task_runner_ = io_task_runner;
-    std::unique_ptr<shell::Connector> io_thread_connector;
+    std::unique_ptr<service_manager::Connector> io_thread_connector;
     if (connector)
       io_thread_connector = connector->Clone();
     io_task_runner_->PostTask(
@@ -85,16 +85,16 @@ class ChildConnection::IOThreadContext
   virtual ~IOThreadContext() {}
 
   void InitializeOnIOThread(
-      const shell::Identity& child_identity,
-      std::unique_ptr<shell::Connector> connector,
+      const service_manager::Identity& child_identity,
+      std::unique_ptr<service_manager::Connector> connector,
       mojo::ScopedMessagePipeHandle service_pipe) {
-    shell::mojom::ServicePtr service;
-    service.Bind(mojo::InterfacePtrInfo<shell::mojom::Service>(
+    service_manager::mojom::ServicePtr service;
+    service.Bind(mojo::InterfacePtrInfo<service_manager::mojom::Service>(
         std::move(service_pipe), 0u));
-    shell::mojom::PIDReceiverRequest pid_receiver_request =
+    service_manager::mojom::PIDReceiverRequest pid_receiver_request =
         mojo::GetProxy(&pid_receiver_);
 
-    shell::Connector::ConnectParams params(child_identity);
+    service_manager::Connector::ConnectParams params(child_identity);
     params.set_client_process_connection(std::move(service),
                                          std::move(pid_receiver_request));
 
@@ -115,8 +115,8 @@ class ChildConnection::IOThreadContext
   }
 
   scoped_refptr<base::SequencedTaskRunner> io_task_runner_;
-  std::unique_ptr<shell::Connection> connection_;
-  shell::mojom::PIDReceiverPtr pid_receiver_;
+  std::unique_ptr<service_manager::Connection> connection_;
+  service_manager::mojom::PIDReceiverPtr pid_receiver_;
 
   DISALLOW_COPY_AND_ASSIGN(IOThreadContext);
 };
@@ -125,14 +125,17 @@ ChildConnection::ChildConnection(
     const std::string& service_name,
     const std::string& instance_id,
     const std::string& child_token,
-    shell::Connector* connector,
+    service_manager::Connector* connector,
     scoped_refptr<base::SequencedTaskRunner> io_task_runner)
-    : context_(new IOThreadContext),
-      child_identity_(service_name, shell::mojom::kInheritUserID, instance_id),
+    : child_token_(child_token),
+      context_(new IOThreadContext),
+      child_identity_(service_name,
+                      service_manager::mojom::kInheritUserID,
+                      instance_id),
       service_token_(mojo::edk::GenerateRandomToken()),
       weak_factory_(this) {
   mojo::ScopedMessagePipeHandle service_pipe =
-      mojo::edk::CreateParentMessagePipe(service_token_, child_token);
+      mojo::edk::CreateParentMessagePipe(service_token_, child_token_);
 
   context_->Initialize(child_identity_, connector, std::move(service_pipe),
                        io_task_runner);
@@ -144,9 +147,18 @@ ChildConnection::ChildConnection(
 
 ChildConnection::~ChildConnection() {
   context_->ShutDown();
+
+  if (process_handle_ == base::kNullProcessHandle) {
+    // The process handle was never set, so we have to assume the process was
+    // not successfully launched. Note that ChildProcessLauncher may also call
+    // call ChildProcessLaunchFailed for the same token, so this is (harmlessly)
+    // redundant in some cases.
+    mojo::edk::ChildProcessLaunchFailed(child_token_);
+  }
 }
 
 void ChildConnection::SetProcessHandle(base::ProcessHandle handle) {
+  process_handle_ = handle;
   context_->SetProcessHandle(handle);
 }
 
diff --git a/chromium/content/common/service_manager/child_connection.h b/chromium/content/common/service_manager/child_connection.h
index f7fc946d330..fab883eae92 100644
--- a/chromium/content/common/service_manager/child_connection.h
+++ b/chromium/content/common/service_manager/child_connection.h
@@ -14,20 +14,20 @@
 #include "base/process/process_handle.h"
 #include "base/sequenced_task_runner.h"
 #include "content/common/content_export.h"
-#include "services/shell/public/cpp/identity.h"
-#include "services/shell/public/cpp/interface_provider.h"
-#include "services/shell/public/interfaces/connector.mojom.h"
+#include "services/service_manager/public/cpp/identity.h"
+#include "services/service_manager/public/cpp/interface_provider.h"
+#include "services/service_manager/public/interfaces/connector.mojom.h"
 
-namespace shell {
+namespace service_manager {
 class Connection;
 class Connector;
 }
 
 namespace content {
 
-// Helper class to establish a connection between the shell and a single child
-// process. Process hosts can use this when launching new processes which
-// should be registered with the service manager.
+// Helper class to establish a connection between the Service Manager and a
+// single child process. Process hosts can use this when launching new processes
+// which should be registered with the service manager.
 class CONTENT_EXPORT ChildConnection {
  public:
   // Prepares a new child connection for a child process which will be
@@ -37,21 +37,21 @@ class CONTENT_EXPORT ChildConnection {
   ChildConnection(const std::string& name,
                   const std::string& instance_id,
                   const std::string& child_token,
-                  shell::Connector* connector,
+                  service_manager::Connector* connector,
                   scoped_refptr<base::SequencedTaskRunner> io_task_runner);
   ~ChildConnection();
 
-  shell::InterfaceProvider* GetRemoteInterfaces() {
+  service_manager::InterfaceProvider* GetRemoteInterfaces() {
     return &remote_interfaces_;
   }
 
-  const shell::Identity& child_identity() const {
+  const service_manager::Identity& child_identity() const {
     return child_identity_;
   }
 
   // A token which must be passed to the child process via
   // |switches::kPrimordialPipeToken| in order for the child to initialize its
-  // end of the shell connection pipe.
+  // end of the Service Manager connection pipe.
   std::string service_token() const { return service_token_; }
 
   // Sets the child connection's process handle. This should be called as soon
@@ -62,11 +62,13 @@ class CONTENT_EXPORT ChildConnection {
  private:
   class IOThreadContext;
 
+  const std::string child_token_;
   scoped_refptr<IOThreadContext> context_;
-  shell::Identity child_identity_;
+  service_manager::Identity child_identity_;
   const std::string service_token_;
+  base::ProcessHandle process_handle_ = base::kNullProcessHandle;
 
-  shell::InterfaceProvider remote_interfaces_;
+  service_manager::InterfaceProvider remote_interfaces_;
 
   base::WeakPtrFactory<ChildConnection> weak_factory_;
 
diff --git a/chromium/content/common/service_manager/embedded_service_runner.cc b/chromium/content/common/service_manager/embedded_service_runner.cc
index 0a6bbca2e7a..0c7c45890da 100644
--- a/chromium/content/common/service_manager/embedded_service_runner.cc
+++ b/chromium/content/common/service_manager/embedded_service_runner.cc
@@ -4,113 +4,120 @@
 
 #include "content/common/service_manager/embedded_service_runner.h"
 
+#include <map>
+#include <memory>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_checker.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "services/shell/public/cpp/service_context.h"
+#include "services/service_manager/public/cpp/service_context.h"
 
 namespace content {
 
-class EmbeddedServiceRunner::Instance
-    : public base::RefCountedThreadSafe<Instance> {
+class EmbeddedServiceRunner::InstanceManager
+    : public base::RefCountedThreadSafe<InstanceManager> {
  public:
-  Instance(const base::StringPiece& name,
-           const ServiceInfo& info,
-           const base::Closure& quit_closure)
+  InstanceManager(const base::StringPiece& name,
+                  const ServiceInfo& info,
+                  const base::Closure& quit_closure)
       : name_(name.as_string()),
         factory_callback_(info.factory),
         use_own_thread_(!info.task_runner && info.use_own_thread),
         quit_closure_(quit_closure),
         quit_task_runner_(base::ThreadTaskRunnerHandle::Get()),
-        task_runner_(info.task_runner) {
-    if (!use_own_thread_ && !task_runner_)
-      task_runner_ = base::ThreadTaskRunnerHandle::Get();
+        service_task_runner_(info.task_runner) {
+    if (!use_own_thread_ && !service_task_runner_)
+      service_task_runner_ = base::ThreadTaskRunnerHandle::Get();
   }
 
-  void BindServiceRequest(shell::mojom::ServiceRequest request) {
+  void BindServiceRequest(service_manager::mojom::ServiceRequest request) {
     DCHECK(runner_thread_checker_.CalledOnValidThread());
 
     if (use_own_thread_ && !thread_) {
       // Start a new thread if necessary.
       thread_.reset(new base::Thread(name_));
       thread_->Start();
-      task_runner_ = thread_->task_runner();
+      service_task_runner_ = thread_->task_runner();
     }
 
-    DCHECK(task_runner_);
-    task_runner_->PostTask(
+    DCHECK(service_task_runner_);
+    service_task_runner_->PostTask(
         FROM_HERE,
-        base::Bind(&Instance::BindServiceRequestOnApplicationThread, this,
-                   base::Passed(&request)));
+        base::Bind(&InstanceManager::BindServiceRequestOnServiceThread,
+                   this, base::Passed(&request)));
   }
 
   void ShutDown() {
     DCHECK(runner_thread_checker_.CalledOnValidThread());
-    if (!task_runner_)
+    if (!service_task_runner_)
       return;
     // Any extant ServiceContexts must be destroyed on the application thread.
-    if (task_runner_->BelongsToCurrentThread()) {
-      Quit();
+    if (service_task_runner_->BelongsToCurrentThread()) {
+      QuitOnServiceThread();
     } else {
-      task_runner_->PostTask(FROM_HERE,
-                                         base::Bind(&Instance::Quit, this));
+      service_task_runner_->PostTask(
+          FROM_HERE, base::Bind(&InstanceManager::QuitOnServiceThread, this));
     }
   }
 
  private:
-  friend class base::RefCountedThreadSafe<Instance>;
+  friend class base::RefCountedThreadSafe<InstanceManager>;
 
-  ~Instance() {
+  ~InstanceManager() {
     // If this instance had its own thread, it MUST be explicitly destroyed by
     // QuitOnRunnerThread() by the time this destructor is run.
     DCHECK(!thread_);
   }
 
-  void BindServiceRequestOnApplicationThread(
-      shell::mojom::ServiceRequest request) {
-    DCHECK(task_runner_->BelongsToCurrentThread());
+  void BindServiceRequestOnServiceThread(
+      service_manager::mojom::ServiceRequest request) {
+    DCHECK(service_task_runner_->BelongsToCurrentThread());
 
-    if (!service_) {
-      service_ = factory_callback_.Run(
-          base::Bind(&Instance::Quit, base::Unretained(this)));
-    }
+    int instance_id = next_instance_id_++;
+
+    std::unique_ptr<service_manager::ServiceContext> context =
+        base::MakeUnique<service_manager::ServiceContext>(
+            factory_callback_.Run(), std::move(request));
 
-    shell::ServiceContext* new_connection =
-        new shell::ServiceContext(service_.get(), std::move(request));
-    shell_connections_.push_back(base::WrapUnique(new_connection));
-    new_connection->SetConnectionLostClosure(
-        base::Bind(&Instance::OnStop, base::Unretained(this),
-                   new_connection));
+    service_manager::ServiceContext* raw_context = context.get();
+    context->SetConnectionLostClosure(
+        base::Bind(&InstanceManager::OnInstanceLost, this, instance_id));
+    contexts_.insert(std::make_pair(raw_context, std::move(context)));
+    id_to_context_map_.insert(std::make_pair(instance_id, raw_context));
   }
 
-  void OnStop(shell::ServiceContext* connection) {
-    DCHECK(task_runner_->BelongsToCurrentThread());
+  void OnInstanceLost(int instance_id) {
+    DCHECK(service_task_runner_->BelongsToCurrentThread());
 
-    for (auto it = shell_connections_.begin(); it != shell_connections_.end();
-         ++it) {
-      if (it->get() == connection) {
-        shell_connections_.erase(it);
-        break;
-      }
-    }
+    auto id_iter = id_to_context_map_.find(instance_id);
+    CHECK(id_iter != id_to_context_map_.end());
+
+    auto context_iter = contexts_.find(id_iter->second);
+    CHECK(context_iter != contexts_.end());
+    contexts_.erase(context_iter);
+    id_to_context_map_.erase(id_iter);
+
+    // If we've lost the last instance, run the quit closure.
+    if (contexts_.empty())
+      QuitOnServiceThread();
   }
 
-  void Quit() {
-    DCHECK(task_runner_->BelongsToCurrentThread());
+  void QuitOnServiceThread() {
+    DCHECK(service_task_runner_->BelongsToCurrentThread());
 
-    shell_connections_.clear();
-    service_.reset();
+    contexts_.clear();
     if (quit_task_runner_->BelongsToCurrentThread()) {
       QuitOnRunnerThread();
     } else {
       quit_task_runner_->PostTask(
-          FROM_HERE, base::Bind(&Instance::QuitOnRunnerThread, this));
+          FROM_HERE, base::Bind(&InstanceManager::QuitOnRunnerThread, this));
     }
   }
 
@@ -118,7 +125,7 @@ class EmbeddedServiceRunner::Instance
     DCHECK(runner_thread_checker_.CalledOnValidThread());
     if (thread_) {
       thread_.reset();
-      task_runner_ = nullptr;
+      service_task_runner_ = nullptr;
     }
     quit_closure_.Run();
   }
@@ -135,32 +142,44 @@ class EmbeddedServiceRunner::Instance
 
   // These fields must only be accessed from the runner's thread.
   std::unique_ptr<base::Thread> thread_;
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+  scoped_refptr<base::SingleThreadTaskRunner> service_task_runner_;
 
-  // These fields must only be accessed from the application thread, except in
-  // the destructor which may run on either the runner thread or the application
+  // These fields must only be accessed from the service thread, except in
+  // the destructor which may run on either the runner thread or the service
   // thread.
-  std::unique_ptr<shell::Service> service_;
-  std::vector<std::unique_ptr<shell::ServiceContext>> shell_connections_;
 
-  DISALLOW_COPY_AND_ASSIGN(Instance);
+  // A map which owns all existing Service instances for this service.
+  using ServiceContextMap =
+      std::map<service_manager::ServiceContext*,
+               std::unique_ptr<service_manager::ServiceContext>>;
+  ServiceContextMap contexts_;
+
+  int next_instance_id_ = 0;
+
+  // A mapping from instance ID to (not owned) ServiceContext.
+  //
+  // TODO(rockot): Remove this once we get rid of the quit closure argument to
+  // service factory functions.
+  std::map<int, service_manager::ServiceContext*> id_to_context_map_;
+
+  DISALLOW_COPY_AND_ASSIGN(InstanceManager);
 };
 
 EmbeddedServiceRunner::EmbeddedServiceRunner(const base::StringPiece& name,
                                              const ServiceInfo& info)
     : weak_factory_(this) {
-  instance_ = new Instance(name, info,
-                           base::Bind(&EmbeddedServiceRunner::OnQuit,
-                                      weak_factory_.GetWeakPtr()));
+  instance_manager_ = new InstanceManager(
+      name, info, base::Bind(&EmbeddedServiceRunner::OnQuit,
+                             weak_factory_.GetWeakPtr()));
 }
 
 EmbeddedServiceRunner::~EmbeddedServiceRunner() {
-  instance_->ShutDown();
+  instance_manager_->ShutDown();
 }
 
 void EmbeddedServiceRunner::BindServiceRequest(
-    shell::mojom::ServiceRequest request) {
-  instance_->BindServiceRequest(std::move(request));
+    service_manager::mojom::ServiceRequest request) {
+  instance_manager_->BindServiceRequest(std::move(request));
 }
 
 void EmbeddedServiceRunner::SetQuitClosure(
diff --git a/chromium/content/common/service_manager/embedded_service_runner.h b/chromium/content/common/service_manager/embedded_service_runner.h
index fda29a3cfe8..9144c5c0f77 100644
--- a/chromium/content/common/service_manager/embedded_service_runner.h
+++ b/chromium/content/common/service_manager/embedded_service_runner.h
@@ -14,42 +14,35 @@
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_piece.h"
 #include "content/public/common/service_info.h"
-#include "services/shell/public/cpp/service.h"
-#include "services/shell/public/interfaces/service.mojom.h"
+#include "services/service_manager/public/cpp/service.h"
+#include "services/service_manager/public/interfaces/service.mojom.h"
 
 namespace content {
 
-// Hosts an in-process service instance that supports multiple Service
-// connections. The first incoming connection will invoke a provided factory
-// function to instantiate the service, and the service will automatically be
-// torn down when its last connection is lost. The service may be launched and
-// torn down multiple times by a single EmbeddedServiceRunner instance.
+// Hosts in-process service instances for a given service.
 class EmbeddedServiceRunner {
  public:
-  // Constructs a runner which hosts a service. If an existing instance of the
-  // service is not running when an incoming connection is made, details from
-  // |info| will be used to construct a new instance.
+  // Constructs a runner for a service. Every new instance started by the
+  // Service Manager for this service will invoke the factory function on |info|
+  // to create a new concrete instance of the Service implementation.
   EmbeddedServiceRunner(const base::StringPiece& name,
                         const ServiceInfo& info);
   ~EmbeddedServiceRunner();
 
-  // Binds an incoming ServiceRequest for this service. If the service isn't
-  // already running, it is started. Otherwise the request is bound to the
-  // running instance.
-  void BindServiceRequest(shell::mojom::ServiceRequest request);
+  // Binds an incoming ServiceRequest for this service. This creates a new
+  // instance of the Service implementation.
+  void BindServiceRequest(service_manager::mojom::ServiceRequest request);
 
-  // Sets a callback to run after the service loses its last connection and is
-  // torn down.
+  // Sets a callback to run when all instances of the service have stopped.
   void SetQuitClosure(const base::Closure& quit_closure);
 
  private:
-  class Instance;
+  class InstanceManager;
 
   void OnQuit();
 
-  // A reference to the service instance which may operate on the
-  // |task_runner_|'s thread.
-  scoped_refptr<Instance> instance_;
+  // A reference to the instance manager, which may operate on another thread.
+  scoped_refptr<InstanceManager> instance_manager_;
 
   base::Closure quit_closure_;
 
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl.cc b/chromium/content/common/service_manager/service_manager_connection_impl.cc
index 0bc9ac0e0d4..24e4e4d470a 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl.cc
+++ b/chromium/content/common/service_manager/service_manager_connection_impl.cc
@@ -19,10 +19,12 @@
 #include "content/public/common/connection_filter.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/system/message_pipe.h"
-#include "services/shell/public/cpp/service.h"
-#include "services/shell/public/cpp/service_context.h"
-#include "services/shell/public/interfaces/service_factory.mojom.h"
-#include "services/shell/runner/common/client_util.h"
+#include "services/service_manager/public/cpp/interface_registry.h"
+#include "services/service_manager/public/cpp/service.h"
+#include "services/service_manager/public/cpp/service_context.h"
+#include "services/service_manager/public/interfaces/constants.mojom.h"
+#include "services/service_manager/public/interfaces/service_factory.mojom.h"
+#include "services/service_manager/runner/common/client_util.h"
 
 namespace content {
 namespace {
@@ -39,18 +41,22 @@ ServiceManagerConnection::Factory* service_manager_connection_factory = nullptr;
 // bindings.
 class ServiceManagerConnectionImpl::IOThreadContext
     : public base::RefCountedThreadSafe<IOThreadContext>,
-      public shell::Service,
-      public shell::InterfaceFactory<shell::mojom::ServiceFactory>,
-      public shell::mojom::ServiceFactory {
+      public service_manager::Service,
+      public service_manager::InterfaceFactory<
+          service_manager::mojom::ServiceFactory>,
+      public service_manager::mojom::ServiceFactory {
  public:
-  using InitializeCallback = base::Callback<void(const shell::Identity&)>;
+  using InitializeCallback =
+      base::Callback<void(const service_manager::Identity&)>;
   using ServiceFactoryCallback =
-      base::Callback<void(shell::mojom::ServiceRequest, const std::string&)>;
-
-  IOThreadContext(shell::mojom::ServiceRequest service_request,
-                  scoped_refptr<base::SequencedTaskRunner> io_task_runner,
-                  std::unique_ptr<shell::Connector> io_thread_connector,
-                  shell::mojom::ConnectorRequest connector_request)
+      base::Callback<void(service_manager::mojom::ServiceRequest,
+                          const std::string&)>;
+
+  IOThreadContext(
+      service_manager::mojom::ServiceRequest service_request,
+      scoped_refptr<base::SequencedTaskRunner> io_task_runner,
+      std::unique_ptr<service_manager::Connector> io_thread_connector,
+      service_manager::mojom::ConnectorRequest connector_request)
       : pending_service_request_(std::move(service_request)),
         io_task_runner_(io_task_runner),
         io_thread_connector_(std::move(io_thread_connector)),
@@ -61,14 +67,17 @@ class ServiceManagerConnectionImpl::IOThreadContext
   }
 
   // Safe to call from any thread.
-  void Start(const InitializeCallback& initialize_callback,
-             const ServiceFactoryCallback& create_service_callback,
-             const base::Closure& stop_callback) {
+  void Start(
+      const InitializeCallback& initialize_callback,
+      const ServiceManagerConnection::OnConnectHandler& on_connect_callback,
+      const ServiceFactoryCallback& create_service_callback,
+      const base::Closure& stop_callback) {
     DCHECK(!started_);
 
     started_ = true;
     callback_task_runner_ = base::ThreadTaskRunnerHandle::Get();
     initialize_handler_ = initialize_callback;
+    on_connect_callback_ = on_connect_callback;
     create_service_callback_ = create_service_callback;
     stop_callback_ = stop_callback;
     io_task_runner_->PostTask(
@@ -109,7 +118,7 @@ class ServiceManagerConnectionImpl::IOThreadContext
 
   // Safe to call any time before Start() is called.
   void SetDefaultBinderForBrowserConnection(
-      const shell::InterfaceRegistry::Binder& binder) {
+      const service_manager::InterfaceRegistry::Binder& binder) {
     DCHECK(!started_);
     default_browser_binder_ = base::Bind(
         &IOThreadContext::CallBinderOnTaskRunner,
@@ -160,8 +169,9 @@ class ServiceManagerConnectionImpl::IOThreadContext
   void StartOnIOThread() {
     // Should bind |io_thread_checker_| to the context's thread.
     DCHECK(io_thread_checker_.CalledOnValidThread());
-    service_context_.reset(new shell::ServiceContext(
-        this, std::move(pending_service_request_),
+    service_context_.reset(new service_manager::ServiceContext(
+        base::MakeUnique<service_manager::ForwardingService>(this),
+        std::move(pending_service_request_),
         std::move(io_thread_connector_),
         std::move(pending_connector_request_)));
 
@@ -212,24 +222,29 @@ class ServiceManagerConnectionImpl::IOThreadContext
   }
 
   /////////////////////////////////////////////////////////////////////////////
-  // shell::Service implementation
+  // service_manager::Service implementation
 
-  void OnStart(const shell::Identity& identity) override {
+  void OnStart() override {
     DCHECK(io_thread_checker_.CalledOnValidThread());
     DCHECK(!initialize_handler_.is_null());
-    id_ = identity;
+    local_info_ = context()->local_info();
 
     InitializeCallback handler = base::ResetAndReturn(&initialize_handler_);
-    callback_task_runner_->PostTask(FROM_HERE, base::Bind(handler, identity));
+    callback_task_runner_->PostTask(FROM_HERE,
+                                    base::Bind(handler, local_info_.identity));
   }
 
-  bool OnConnect(const shell::Identity& remote_identity,
-                 shell::InterfaceRegistry* registry) override {
+  bool OnConnect(const service_manager::ServiceInfo& remote_info,
+                 service_manager::InterfaceRegistry* registry) override {
     DCHECK(io_thread_checker_.CalledOnValidThread());
-    std::string remote_service = remote_identity.name();
-    if (remote_service == "service:shell") {
-      // Only expose the SCF interface to the shell.
-      registry->AddInterface<shell::mojom::ServiceFactory>(this);
+
+    callback_task_runner_->PostTask(
+        FROM_HERE, base::Bind(on_connect_callback_, local_info_, remote_info));
+
+    std::string remote_service = remote_info.identity.name();
+    if (remote_service == service_manager::mojom::kServiceName) {
+      // Only expose the ServiceFactory interface to the Service Manager.
+      registry->AddInterface<service_manager::mojom::ServiceFactory>(this);
       return true;
     }
 
@@ -237,16 +252,16 @@ class ServiceManagerConnectionImpl::IOThreadContext
     {
       base::AutoLock lock(lock_);
       for (auto& entry : connection_filters_) {
-        accept |= entry.second->OnConnect(remote_identity, registry,
+        accept |= entry.second->OnConnect(remote_info.identity, registry,
                                           service_context_->connector());
       }
     }
 
-    if (remote_identity.name() == "service:content_browser" &&
+    if (remote_service == "content_browser" &&
         !has_browser_connection_) {
       has_browser_connection_ = true;
       registry->set_default_binder(default_browser_binder_);
-      registry->SetConnectionLostClosure(
+      registry->AddConnectionLostClosure(
           base::Bind(&IOThreadContext::OnBrowserConnectionLost, this));
       return true;
     }
@@ -262,18 +277,19 @@ class ServiceManagerConnectionImpl::IOThreadContext
   }
 
   /////////////////////////////////////////////////////////////////////////////
-  // shell::InterfaceFactory<shell::mojom::ServiceFactory> implementation
+  // service_manager::InterfaceFactory<service_manager::mojom::ServiceFactory>
+  // implementation
 
-  void Create(const shell::Identity& remote_identity,
-              shell::mojom::ServiceFactoryRequest request) override {
+  void Create(const service_manager::Identity& remote_identity,
+              service_manager::mojom::ServiceFactoryRequest request) override {
     DCHECK(io_thread_checker_.CalledOnValidThread());
     factory_bindings_.AddBinding(this, std::move(request));
   }
 
   /////////////////////////////////////////////////////////////////////////////
-  // shell::mojom::ServiceFactory implementation
+  // service_manager::mojom::ServiceFactory implementation
 
-  void CreateService(shell::mojom::ServiceRequest request,
+  void CreateService(service_manager::mojom::ServiceRequest request,
                      const std::string& name) override {
     DCHECK(io_thread_checker_.CalledOnValidThread());
     callback_task_runner_->PostTask(
@@ -283,7 +299,7 @@ class ServiceManagerConnectionImpl::IOThreadContext
 
   static void CallBinderOnTaskRunner(
       scoped_refptr<base::SequencedTaskRunner> task_runner,
-      const shell::InterfaceRegistry::Binder& binder,
+      const service_manager::InterfaceRegistry::Binder& binder,
       const std::string& interface_name,
       mojo::ScopedMessagePipeHandle request_handle) {
     task_runner->PostTask(FROM_HERE, base::Bind(binder, interface_name,
@@ -295,10 +311,10 @@ class ServiceManagerConnectionImpl::IOThreadContext
 
   // Temporary state established on construction and consumed on the IO thread
   // once the connection is started.
-  shell::mojom::ServiceRequest pending_service_request_;
+  service_manager::mojom::ServiceRequest pending_service_request_;
   scoped_refptr<base::SequencedTaskRunner> io_task_runner_;
-  std::unique_ptr<shell::Connector> io_thread_connector_;
-  shell::mojom::ConnectorRequest pending_connector_request_;
+  std::unique_ptr<service_manager::Connector> io_thread_connector_;
+  service_manager::mojom::ConnectorRequest pending_connector_request_;
 
   // TaskRunner on which to run our owner's callbacks, i.e. the ones passed to
   // Start().
@@ -307,6 +323,9 @@ class ServiceManagerConnectionImpl::IOThreadContext
   // Callback to run once Service::OnStart is invoked.
   InitializeCallback initialize_handler_;
 
+  // Callback to run when a connection request is received.
+  ServiceManagerConnection::OnConnectHandler on_connect_callback_;
+
   // Callback to run when a new Service request is received.
   ServiceFactoryCallback create_service_callback_;
 
@@ -317,17 +336,17 @@ class ServiceManagerConnectionImpl::IOThreadContext
   // default binder (below) has been set up.
   bool has_browser_connection_ = false;
 
-  shell::Identity id_;
+  service_manager::ServiceInfo local_info_;
 
   // Default binder callback used for the browser connection's
   // InterfaceRegistry.
   //
   // TODO(rockot): Remove this once all interfaces exposed to the browser are
   // exposed via a ConnectionFilter.
-  shell::InterfaceRegistry::Binder default_browser_binder_;
+  service_manager::InterfaceRegistry::Binder default_browser_binder_;
 
-  std::unique_ptr<shell::ServiceContext> service_context_;
-  mojo::BindingSet<shell::mojom::ServiceFactory> factory_bindings_;
+  std::unique_ptr<service_manager::ServiceContext> service_context_;
+  mojo::BindingSet<service_manager::mojom::ServiceFactory> factory_bindings_;
   int next_filter_id_ = kInvalidConnectionFilterId;
 
   // Not owned.
@@ -371,7 +390,7 @@ void ServiceManagerConnection::SetFactoryForTest(Factory* factory) {
 
 // static
 std::unique_ptr<ServiceManagerConnection> ServiceManagerConnection::Create(
-    shell::mojom::ServiceRequest request,
+    service_manager::mojom::ServiceRequest request,
     scoped_refptr<base::SequencedTaskRunner> io_task_runner) {
   if (service_manager_connection_factory)
     return service_manager_connection_factory->Run();
@@ -385,13 +404,14 @@ ServiceManagerConnection::~ServiceManagerConnection() {}
 // ServiceManagerConnectionImpl, public:
 
 ServiceManagerConnectionImpl::ServiceManagerConnectionImpl(
-    shell::mojom::ServiceRequest request,
+    service_manager::mojom::ServiceRequest request,
     scoped_refptr<base::SequencedTaskRunner> io_task_runner)
     : weak_factory_(this) {
-  shell::mojom::ConnectorRequest connector_request;
-  connector_ = shell::Connector::Create(&connector_request);
+  service_manager::mojom::ConnectorRequest connector_request;
+  connector_ = service_manager::Connector::Create(&connector_request);
 
-  std::unique_ptr<shell::Connector> io_thread_connector = connector_->Clone();
+  std::unique_ptr<service_manager::Connector> io_thread_connector =
+      connector_->Clone();
   context_ = new IOThreadContext(
       std::move(request), io_task_runner, std::move(io_thread_connector),
       std::move(connector_request));
@@ -408,6 +428,8 @@ void ServiceManagerConnectionImpl::Start() {
   context_->Start(
       base::Bind(&ServiceManagerConnectionImpl::OnContextInitialized,
                  weak_factory_.GetWeakPtr()),
+      base::Bind(&ServiceManagerConnectionImpl::OnConnect,
+                 weak_factory_.GetWeakPtr()),
       base::Bind(&ServiceManagerConnectionImpl::CreateService,
                  weak_factory_.GetWeakPtr()),
       base::Bind(&ServiceManagerConnectionImpl::OnConnectionLost,
@@ -420,11 +442,12 @@ void ServiceManagerConnectionImpl::SetInitializeHandler(
   initialize_handler_ = handler;
 }
 
-shell::Connector* ServiceManagerConnectionImpl::GetConnector() {
+service_manager::Connector* ServiceManagerConnectionImpl::GetConnector() {
   return connector_.get();
 }
 
-const shell::Identity& ServiceManagerConnectionImpl::GetIdentity() const {
+const service_manager::Identity& ServiceManagerConnectionImpl::GetIdentity()
+    const {
   return identity_;
 }
 
@@ -434,8 +457,8 @@ void ServiceManagerConnectionImpl::SetConnectionLostClosure(
 }
 
 void ServiceManagerConnectionImpl::SetupInterfaceRequestProxies(
-    shell::InterfaceRegistry* registry,
-    shell::InterfaceProvider* provider) {
+    service_manager::InterfaceRegistry* registry,
+    service_manager::InterfaceProvider* provider) {
   // It's safe to bind |registry| as a raw pointer because the caller must
   // guarantee that it outlives |this|, and |this| is bound as a weak ptr here.
   context_->SetDefaultBinderForBrowserConnection(
@@ -473,8 +496,21 @@ void ServiceManagerConnectionImpl::AddServiceRequestHandler(
   DCHECK(result.second);
 }
 
+int ServiceManagerConnectionImpl::AddOnConnectHandler(
+    const OnConnectHandler& handler) {
+  int id = ++next_on_connect_handler_id_;
+  on_connect_handlers_[id] = handler;
+  return id;
+}
+
+void ServiceManagerConnectionImpl::RemoveOnConnectHandler(int id) {
+  auto it = on_connect_handlers_.find(id);
+  DCHECK(it != on_connect_handlers_.end());
+  on_connect_handlers_.erase(it);
+}
+
 void ServiceManagerConnectionImpl::CreateService(
-    shell::mojom::ServiceRequest request,
+    service_manager::mojom::ServiceRequest request,
     const std::string& name) {
   auto it = request_handlers_.find(name);
   if (it != request_handlers_.end())
@@ -482,7 +518,7 @@ void ServiceManagerConnectionImpl::CreateService(
 }
 
 void ServiceManagerConnectionImpl::OnContextInitialized(
-    const shell::Identity& identity) {
+    const service_manager::Identity& identity) {
   identity_ = identity;
   if (!initialize_handler_.is_null())
     base::ResetAndReturn(&initialize_handler_).Run();
@@ -493,8 +529,16 @@ void ServiceManagerConnectionImpl::OnConnectionLost() {
     connection_lost_handler_.Run();
 }
 
+void ServiceManagerConnectionImpl::OnConnect(
+    const service_manager::ServiceInfo& local_info,
+    const service_manager::ServiceInfo& remote_info) {
+  local_info_ = local_info;
+  for (auto& handler : on_connect_handlers_)
+    handler.second.Run(local_info, remote_info);
+}
+
 void ServiceManagerConnectionImpl::GetInterface(
-    shell::mojom::InterfaceProvider* provider,
+    service_manager::mojom::InterfaceProvider* provider,
     const std::string& interface_name,
     mojo::ScopedMessagePipeHandle request_handle) {
   provider->GetInterface(interface_name, std::move(request_handle));
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl.h b/chromium/content/common/service_manager/service_manager_connection_impl.h
index 4a42331d6ff..971f9478374 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl.h
+++ b/chromium/content/common/service_manager/service_manager_connection_impl.h
@@ -14,10 +14,10 @@
 #include "content/public/common/service_manager_connection.h"
 #include "mojo/public/cpp/bindings/string.h"
 #include "mojo/public/cpp/system/message_pipe.h"
-#include "services/shell/public/cpp/identity.h"
-#include "services/shell/public/interfaces/service.mojom.h"
+#include "services/service_manager/public/cpp/identity.h"
+#include "services/service_manager/public/interfaces/service.mojom.h"
 
-namespace shell {
+namespace service_manager {
 class Connector;
 }
 
@@ -28,7 +28,7 @@ class EmbeddedServiceRunner;
 class ServiceManagerConnectionImpl : public ServiceManagerConnection {
  public:
   explicit ServiceManagerConnectionImpl(
-      shell::mojom::ServiceRequest request,
+      service_manager::mojom::ServiceRequest request,
       scoped_refptr<base::SequencedTaskRunner> io_task_runner);
   ~ServiceManagerConnectionImpl() override;
 
@@ -38,12 +38,12 @@ class ServiceManagerConnectionImpl : public ServiceManagerConnection {
   // ServiceManagerConnection:
   void Start() override;
   void SetInitializeHandler(const base::Closure& handler) override;
-  shell::Connector* GetConnector() override;
-  const shell::Identity& GetIdentity() const override;
+  service_manager::Connector* GetConnector() override;
+  const service_manager::Identity& GetIdentity() const override;
   void SetConnectionLostClosure(const base::Closure& closure) override;
   void SetupInterfaceRequestProxies(
-      shell::InterfaceRegistry* registry,
-      shell::InterfaceProvider* provider) override;
+      service_manager::InterfaceRegistry* registry,
+      service_manager::InterfaceProvider* provider) override;
   int AddConnectionFilter(std::unique_ptr<ConnectionFilter> filter) override;
   void RemoveConnectionFilter(int filter_id) override;
   void AddEmbeddedService(const std::string& name,
@@ -51,18 +51,24 @@ class ServiceManagerConnectionImpl : public ServiceManagerConnection {
   void AddServiceRequestHandler(
       const std::string& name,
       const ServiceRequestHandler& handler) override;
+  int AddOnConnectHandler(const OnConnectHandler& handler) override;
+  void RemoveOnConnectHandler(int id) override;
 
-  void OnContextInitialized(const shell::Identity& identity);
+  void OnContextInitialized(const service_manager::Identity& identity);
   void OnConnectionLost();
-  void CreateService(shell::mojom::ServiceRequest request,
+  void OnConnect(const service_manager::ServiceInfo& local_info,
+                 const service_manager::ServiceInfo& remote_info);
+  void CreateService(service_manager::mojom::ServiceRequest request,
                      const std::string& name);
-  void GetInterface(shell::mojom::InterfaceProvider* provider,
+  void GetInterface(service_manager::mojom::InterfaceProvider* provider,
                     const std::string& interface_name,
                     mojo::ScopedMessagePipeHandle request_handle);
 
-  shell::Identity identity_;
+  service_manager::Identity identity_;
+  service_manager::ServiceInfo local_info_;
+  service_manager::ServiceInfo last_remote_info_;
 
-  std::unique_ptr<shell::Connector> connector_;
+  std::unique_ptr<service_manager::Connector> connector_;
   scoped_refptr<IOThreadContext> context_;
 
   base::Closure initialize_handler_;
@@ -71,6 +77,8 @@ class ServiceManagerConnectionImpl : public ServiceManagerConnection {
   std::unordered_map<std::string, std::unique_ptr<EmbeddedServiceRunner>>
       embedded_services_;
   std::unordered_map<std::string, ServiceRequestHandler> request_handlers_;
+  int next_on_connect_handler_id_ = 0;
+  std::map<int, OnConnectHandler> on_connect_handlers_;
 
   base::WeakPtrFactory<ServiceManagerConnectionImpl> weak_factory_;
 
diff --git a/chromium/content/common/service_worker/embedded_worker.mojom b/chromium/content/common/service_worker/embedded_worker.mojom
index d15d62bb237..e9d01b25ce2 100644
--- a/chromium/content/common/service_worker/embedded_worker.mojom
+++ b/chromium/content/common/service_worker/embedded_worker.mojom
@@ -4,7 +4,7 @@
 
 module content.mojom;
 
-import "services/shell/public/interfaces/interface_provider.mojom";
+import "services/service_manager/public/interfaces/interface_provider.mojom";
 import "url/mojo/url.mojom";
 
 [Native]
@@ -12,5 +12,8 @@ struct EmbeddedWorkerStartParams;
 
 // Interface to control a renderer-side worker's environment.
 interface EmbeddedWorkerInstanceClient {
-  StartWorker(EmbeddedWorkerStartParams params);
-};
+  StartWorker(EmbeddedWorkerStartParams params,
+              service_manager.mojom.InterfaceProvider browser_interfaces,
+              service_manager.mojom.InterfaceProvider& renderer_request);
+  StopWorker() => ();
+};
\ No newline at end of file
diff --git a/chromium/content/common/service_worker/embedded_worker_setup.mojom b/chromium/content/common/service_worker/embedded_worker_setup.mojom
index 6b1dfb5d91c..f70830ac82c 100644
--- a/chromium/content/common/service_worker/embedded_worker_setup.mojom
+++ b/chromium/content/common/service_worker/embedded_worker_setup.mojom
@@ -4,11 +4,11 @@
 
 module content.mojom;
 
-import "services/shell/public/interfaces/interface_provider.mojom";
+import "services/service_manager/public/interfaces/interface_provider.mojom";
 
 interface EmbeddedWorkerSetup {
   ExchangeInterfaceProviders(
       int32 thread_id,
-      shell.mojom.InterfaceProvider& remote_interfaces,
-      shell.mojom.InterfaceProvider local_interfaces);
+      service_manager.mojom.InterfaceProvider& remote_interfaces,
+      service_manager.mojom.InterfaceProvider local_interfaces);
 };
diff --git a/chromium/content/common/service_worker/fetch_event_dispatcher.mojom b/chromium/content/common/service_worker/fetch_event_dispatcher.mojom
new file mode 100644
index 00000000000..ff4252f1f6e
--- /dev/null
+++ b/chromium/content/common/service_worker/fetch_event_dispatcher.mojom
@@ -0,0 +1,24 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "content/common/url_loader.mojom";
+import "mojo/common/common_custom_types.mojom";
+import "third_party/WebKit/public/platform/modules/serviceworker/service_worker_event_status.mojom";
+
+[Native]
+struct ServiceWorkerFetchRequest;
+
+struct FetchEventPreloadHandle {
+  URLLoader url_loader;
+  URLLoaderClient& url_loader_client_request;
+};
+
+interface FetchEventDispatcher {
+  DispatchFetchEvent(int32 fetch_event_id, ServiceWorkerFetchRequest request,
+                     FetchEventPreloadHandle? preload_handle)
+      => (blink.mojom.ServiceWorkerEventStatus status,
+          mojo.common.mojom.Time dispatch_event_time);
+};
diff --git a/chromium/content/common/service_worker/fetch_event_dispatcher.typemap b/chromium/content/common/service_worker/fetch_event_dispatcher.typemap
new file mode 100644
index 00000000000..e4bec0cde22
--- /dev/null
+++ b/chromium/content/common/service_worker/fetch_event_dispatcher.typemap
@@ -0,0 +1,20 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/common/service_worker/fetch_event_dispatcher.mojom"
+public_headers = [
+  "//content/common/service_worker/service_worker_status_code.h",
+  "//content/common/service_worker/service_worker_types.h",
+]
+sources = [
+  "//content/common/service_worker/service_worker_status_code_traits.cc",
+]
+traits_headers = [
+  "//content/common/service_worker/service_worker_messages.h",
+  "//content/common/service_worker/service_worker_status_code_traits.h",
+]
+type_mappings = [
+  "content.mojom.ServiceWorkerFetchRequest=::content::ServiceWorkerFetchRequest",
+  "blink.mojom.ServiceWorkerEventStatus=::content::ServiceWorkerStatusCode",
+]
diff --git a/chromium/content/common/service_worker/service_worker.mojom b/chromium/content/common/service_worker/service_worker.mojom
new file mode 100644
index 00000000000..04817ecd528
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker.mojom
@@ -0,0 +1,17 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "content/common/service_worker/service_worker_types.mojom";
+
+// Per-process browser-side interface bound to ServiceWorkerDispatcherHost.
+// Each InterfacePtrs on the same render process will be bound to the same
+// ServiceWorkerDispatcherHost.
+interface ServiceWorkerDispatcherHost {
+  OnProviderCreated(int32 provider_id,
+                    int32 route_id,
+                    ServiceWorkerProviderType provider_type,
+                    bool is_parent_frame_secure);
+};
\ No newline at end of file
diff --git a/chromium/content/common/service_worker/service_worker_messages.h b/chromium/content/common/service_worker/service_worker_messages.h
index 59af129dd12..7cd3d188eba 100644
--- a/chromium/content/common/service_worker/service_worker_messages.h
+++ b/chromium/content/common/service_worker/service_worker_messages.h
@@ -57,6 +57,11 @@ IPC_STRUCT_TRAITS_BEGIN(content::ExtendableMessageEventSource)
   IPC_STRUCT_TRAITS_MEMBER(service_worker_info)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::NavigationPreloadState)
+  IPC_STRUCT_TRAITS_MEMBER(enabled)
+  IPC_STRUCT_TRAITS_MEMBER(header)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(content::ServiceWorkerFetchRequest)
   IPC_STRUCT_TRAITS_MEMBER(mode)
   IPC_STRUCT_TRAITS_MEMBER(is_main_resource_load)
@@ -187,6 +192,29 @@ IPC_MESSAGE_CONTROL3(ServiceWorkerHostMsg_GetRegistrationForReady,
                      int /* request_id */,
                      int /* provider_id */)
 
+// Asks the browser to enable/disable navigation preload for a registration.
+IPC_MESSAGE_CONTROL5(ServiceWorkerHostMsg_EnableNavigationPreload,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     int /* provider_id */,
+                     int64_t /* registration_id */,
+                     bool /* enable */)
+
+// Asks the browser to get navigation preload state for a registration.
+IPC_MESSAGE_CONTROL4(ServiceWorkerHostMsg_GetNavigationPreloadState,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     int /* provider_id */,
+                     int64_t /* registration_id */)
+
+// Asks the browser to set navigation preload header value for a registration.
+IPC_MESSAGE_CONTROL5(ServiceWorkerHostMsg_SetNavigationPreloadHeader,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     int /* provider_id */,
+                     int64_t /* registration_id */,
+                     std::string /* header_value */)
+
 // Sends ExtendableMessageEvent to a service worker (renderer->browser).
 IPC_MESSAGE_CONTROL5(
     ServiceWorkerHostMsg_PostMessageToWorker,
@@ -271,14 +299,10 @@ IPC_MESSAGE_ROUTED3(ServiceWorkerHostMsg_ExtendableMessageEventFinished,
                     blink::WebServiceWorkerEventResult,
                     base::Time /* dispatch_event_time */)
 IPC_MESSAGE_ROUTED4(ServiceWorkerHostMsg_FetchEventResponse,
-                    int /* response_id */,
+                    int /* fetch_event_id */,
                     content::ServiceWorkerFetchEventResult,
                     content::ServiceWorkerResponse,
                     base::Time /* dispatch_event_time */)
-IPC_MESSAGE_ROUTED3(ServiceWorkerHostMsg_FetchEventFinished,
-                    int /* event_finish_id */,
-                    blink::WebServiceWorkerEventResult,
-                    base::Time /* dispatch_event_time */)
 IPC_MESSAGE_ROUTED3(ServiceWorkerHostMsg_NotificationClickEventFinished,
                     int /* request_id */,
                     blink::WebServiceWorkerEventResult,
@@ -479,6 +503,32 @@ IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_SetControllerServiceWorker,
                      content::ServiceWorkerObjectInfo,
                      bool /* should_notify_controllerchange */)
 
+IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_DidEnableNavigationPreload,
+                     int /* thread_id */,
+                     int /* request_id */)
+IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_EnableNavigationPreloadError,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     blink::WebServiceWorkerError::ErrorType /* code */,
+                     std::string /* message */)
+IPC_MESSAGE_CONTROL3(ServiceWorkerMsg_DidGetNavigationPreloadState,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     content::NavigationPreloadState /* state */)
+IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_GetNavigationPreloadStateError,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     blink::WebServiceWorkerError::ErrorType /* code */,
+                     std::string /* message */)
+IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_DidSetNavigationPreloadHeader,
+                     int /* thread_id */,
+                     int /* request_id */)
+IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_SetNavigationPreloadHeaderError,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     blink::WebServiceWorkerError::ErrorType /* code */,
+                     std::string /* message */)
+
 // Sends MessageEvent to a client document (browser->renderer).
 IPC_MESSAGE_CONTROL1(ServiceWorkerMsg_MessageToDocument,
                      ServiceWorkerMsg_MessageToDocument_Params)
@@ -491,15 +541,12 @@ IPC_MESSAGE_CONTROL1(ServiceWorkerMsg_ActivateEvent,
 IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_ExtendableMessageEvent,
                      int /* request_id */,
                      ServiceWorkerMsg_ExtendableMessageEvent_Params)
-IPC_MESSAGE_CONTROL3(ServiceWorkerMsg_FetchEvent,
-                     int /* response_id */,
-                     int /* event_finish_id */,
-                     content::ServiceWorkerFetchRequest)
-IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_NotificationClickEvent,
+IPC_MESSAGE_CONTROL5(ServiceWorkerMsg_NotificationClickEvent,
                      int /* request_id */,
                      std::string /* notification_id */,
                      content::PlatformNotificationData /* notification_data */,
-                     int /* action_index */)
+                     int /* action_index */,
+                     base::NullableString16 /* notification reply */)
 IPC_MESSAGE_CONTROL3(ServiceWorkerMsg_NotificationCloseEvent,
                      int /* request_id */,
                      std::string /* notification_id */,
diff --git a/chromium/content/common/service_worker/service_worker_status_code_traits.cc b/chromium/content/common/service_worker/service_worker_status_code_traits.cc
new file mode 100644
index 00000000000..65f26ae52e9
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker_status_code_traits.cc
@@ -0,0 +1,51 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/service_worker/service_worker_status_code_traits.h"
+
+#include "base/logging.h"
+#include "content/common/service_worker/service_worker_status_code.h"
+#include "third_party/WebKit/public/platform/modules/serviceworker/service_worker_event_status.mojom.h"
+
+namespace mojo {
+
+// static
+blink::mojom::ServiceWorkerEventStatus EnumTraits<
+    blink::mojom::ServiceWorkerEventStatus,
+    content::ServiceWorkerStatusCode>::ToMojom(content::ServiceWorkerStatusCode
+                                                   input) {
+  switch (input) {
+    case content::SERVICE_WORKER_OK:
+      return blink::mojom::ServiceWorkerEventStatus::COMPLETED;
+    case content::SERVICE_WORKER_ERROR_EVENT_WAITUNTIL_REJECTED:
+      return blink::mojom::ServiceWorkerEventStatus::REJECTED;
+    case content::SERVICE_WORKER_ERROR_ABORT:
+      return blink::mojom::ServiceWorkerEventStatus::ABORTED;
+    default:
+      NOTREACHED() << "Unexpected ServiceWorkerStatusCode: " << input;
+      return blink::mojom::ServiceWorkerEventStatus::ABORTED;
+  }
+}
+
+// static
+bool EnumTraits<blink::mojom::ServiceWorkerEventStatus,
+                content::ServiceWorkerStatusCode>::
+    FromMojom(blink::mojom::ServiceWorkerEventStatus input,
+              content::ServiceWorkerStatusCode* out) {
+  switch (input) {
+    case blink::mojom::ServiceWorkerEventStatus::COMPLETED:
+      *out = content::SERVICE_WORKER_OK;
+      return true;
+    case blink::mojom::ServiceWorkerEventStatus::REJECTED:
+      *out = content::SERVICE_WORKER_ERROR_EVENT_WAITUNTIL_REJECTED;
+      return true;
+    case blink::mojom::ServiceWorkerEventStatus::ABORTED:
+      *out = content::SERVICE_WORKER_ERROR_ABORT;
+      return true;
+  }
+  NOTREACHED();
+  return false;
+}
+
+}  // namespace content
diff --git a/chromium/content/common/service_worker/service_worker_status_code_traits.h b/chromium/content/common/service_worker/service_worker_status_code_traits.h
new file mode 100644
index 00000000000..98139c1becd
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker_status_code_traits.h
@@ -0,0 +1,25 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_STATUS_CODE_TRAITS_H_
+#define CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_STATUS_CODE_TRAITS_H_
+
+#include "content/common/service_worker/service_worker_status_code.h"
+#include "third_party/WebKit/public/platform/modules/serviceworker/service_worker_event_status.mojom.h"
+
+namespace mojo {
+
+template <>
+struct EnumTraits<blink::mojom::ServiceWorkerEventStatus,
+                  content::ServiceWorkerStatusCode> {
+  static blink::mojom::ServiceWorkerEventStatus ToMojom(
+      content::ServiceWorkerStatusCode input);
+
+  static bool FromMojom(blink::mojom::ServiceWorkerEventStatus input,
+                        content::ServiceWorkerStatusCode* out);
+};
+
+}  // namespace mojo
+
+#endif  // CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_STATUS_CODE_TRAITS_H_
diff --git a/chromium/content/common/service_worker/service_worker_types.cc b/chromium/content/common/service_worker/service_worker_types.cc
index 2e5bb190e53..43a9740afa9 100644
--- a/chromium/content/common/service_worker/service_worker_types.cc
+++ b/chromium/content/common/service_worker/service_worker_types.cc
@@ -153,4 +153,13 @@ ExtendableMessageEventSource::ExtendableMessageEventSource(
     const ServiceWorkerObjectInfo& service_worker_info)
     : service_worker_info(service_worker_info) {}
 
+NavigationPreloadState::NavigationPreloadState()
+    : enabled(false), header("true") {}
+
+NavigationPreloadState::NavigationPreloadState(bool enabled, std::string header)
+    : enabled(enabled), header(header) {}
+
+NavigationPreloadState::NavigationPreloadState(
+    const NavigationPreloadState& other) = default;
+
 }  // namespace content
diff --git a/chromium/content/common/service_worker/service_worker_types.h b/chromium/content/common/service_worker/service_worker_types.h
index 4dbe26f8e7e..589a6a40fd0 100644
--- a/chromium/content/common/service_worker/service_worker_types.h
+++ b/chromium/content/common/service_worker/service_worker_types.h
@@ -272,6 +272,14 @@ struct ExtendableMessageEventSource {
   ServiceWorkerObjectInfo service_worker_info;
 };
 
+struct CONTENT_EXPORT NavigationPreloadState {
+  NavigationPreloadState();
+  NavigationPreloadState(bool enabled, std::string header);
+  NavigationPreloadState(const NavigationPreloadState& other);
+  bool enabled;
+  std::string header;
+};
+
 }  // namespace content
 
 #endif  // CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_TYPES_H_
diff --git a/chromium/content/common/service_worker/service_worker_types.mojom b/chromium/content/common/service_worker/service_worker_types.mojom
new file mode 100644
index 00000000000..1094171758d
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker_types.mojom
@@ -0,0 +1,20 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+enum ServiceWorkerProviderType {
+  SERVICE_WORKER_PROVIDER_UNKNOWN,
+
+  // For ServiceWorker clients.
+  SERVICE_WORKER_PROVIDER_FOR_WINDOW,
+  SERVICE_WORKER_PROVIDER_FOR_WORKER,
+  SERVICE_WORKER_PROVIDER_FOR_SHARED_WORKER,
+
+  // For ServiceWorkers.
+  SERVICE_WORKER_PROVIDER_FOR_CONTROLLER,
+
+  SERVICE_WORKER_PROVIDER_TYPE_LAST =
+      SERVICE_WORKER_PROVIDER_FOR_CONTROLLER
+};
\ No newline at end of file
diff --git a/chromium/content/common/service_worker/service_worker_types.typemap b/chromium/content/common/service_worker/service_worker_types.typemap
new file mode 100644
index 00000000000..4ec79bbcfba
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker_types.typemap
@@ -0,0 +1,12 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/common/service_worker/service_worker_types.mojom"
+public_headers = [ "//content/common/service_worker/service_worker_types.h" ]
+traits_headers =
+    [ "//content/common/service_worker/service_worker_types_traits.h" ]
+sources = [
+  "//content/common/service_worker/service_worker_types_traits.cc",
+]
+type_mappings = [ "content.mojom.ServiceWorkerProviderType=::content::ServiceWorkerProviderType" ]
diff --git a/chromium/content/common/service_worker/service_worker_types_traits.cc b/chromium/content/common/service_worker/service_worker_types_traits.cc
new file mode 100644
index 00000000000..1126308a1b7
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker_types_traits.cc
@@ -0,0 +1,24 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/service_worker/service_worker_types_traits.h"
+
+namespace mojo {
+
+content::mojom::ServiceWorkerProviderType EnumTraits<
+  content::mojom::ServiceWorkerProviderType,
+  content::ServiceWorkerProviderType>::ToMojom(
+      content::ServiceWorkerProviderType input) {
+  return static_cast<content::mojom::ServiceWorkerProviderType>(input);
+}
+
+bool EnumTraits<content::mojom::ServiceWorkerProviderType,
+                content::ServiceWorkerProviderType>::FromMojom(
+                    content::mojom::ServiceWorkerProviderType input,
+                    content::ServiceWorkerProviderType* out) {
+  *out = static_cast<content::ServiceWorkerProviderType>(input);
+  return true;
+}
+
+}  // namespace mojo
diff --git a/chromium/content/common/service_worker/service_worker_types_traits.h b/chromium/content/common/service_worker/service_worker_types_traits.h
new file mode 100644
index 00000000000..18910a52444
--- /dev/null
+++ b/chromium/content/common/service_worker/service_worker_types_traits.h
@@ -0,0 +1,24 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_TYPES_TRAITS_H_
+#define CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_TYPES_TRAITS_H_
+
+#include "content/common/service_worker/service_worker_types.mojom.h"
+
+namespace mojo {
+
+template <>
+struct EnumTraits<content::mojom::ServiceWorkerProviderType,
+                  content::ServiceWorkerProviderType> {
+  static content::mojom::ServiceWorkerProviderType ToMojom(
+      content::ServiceWorkerProviderType input);
+
+  static bool FromMojom(content::mojom::ServiceWorkerProviderType input,
+                        content::ServiceWorkerProviderType* out);
+};
+
+}  // namespace mojo
+
+#endif  // CONTENT_COMMON_SERVICE_WORKER_SERVICE_WORKER_TYPES_TRAITS_H_
diff --git a/chromium/content/common/service_worker/service_worker_utils.cc b/chromium/content/common/service_worker/service_worker_utils.cc
index fb3e7251f1a..9abc85887f4 100644
--- a/chromium/content/common/service_worker/service_worker_utils.cc
+++ b/chromium/content/common/service_worker/service_worker_utils.cc
@@ -106,23 +106,36 @@ bool ServiceWorkerUtils::ContainsDisallowedCharacter(
 }
 
 // static
-bool ServiceWorkerUtils::CanRegisterServiceWorker(const GURL& context_url,
-                                                  const GURL& pattern,
-                                                  const GURL& script_url) {
-  DCHECK(context_url.is_valid());
-  DCHECK(pattern.is_valid());
-  DCHECK(script_url.is_valid());
-  return ServiceWorkerUtils::PassOriginEqualitySecurityCheck<GURL>(
-             context_url, pattern, script_url) &&
-         OriginCanAccessServiceWorkers(context_url) &&
-         OriginCanAccessServiceWorkers(pattern) &&
-         OriginCanAccessServiceWorkers(script_url);
+bool ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+    const std::vector<GURL>& urls) {
+  // (A) Check if all origins can access service worker. Every URL must be
+  // checked despite the same-origin check below in (B), because GetOrigin()
+  // uses the inner URL for filesystem URLs so that https://foo/ and
+  // filesystem:https://foo/ are considered equal, but filesystem URLs cannot
+  // access service worker.
+  for (const GURL& url : urls) {
+    if (!OriginCanAccessServiceWorkers(url))
+      return false;
+  }
+
+  // (B) Check if all origins are equal. Cross-origin access is permitted when
+  // --disable-web-security is set.
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableWebSecurity)) {
+    return true;
+  }
+  const GURL& first = urls.front();
+  for (const GURL& url : urls) {
+    if (first.GetOrigin() != url.GetOrigin())
+      return false;
+  }
+  return true;
 }
 
 // static
 bool ServiceWorkerUtils::IsMojoForServiceWorkerEnabled() {
-  return base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kMojoServiceWorker);
+  return !base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kDisableMojoServiceWorker);
 }
 
 bool LongestScopeMatcher::MatchLongest(const GURL& scope) {
diff --git a/chromium/content/common/service_worker/service_worker_utils.h b/chromium/content/common/service_worker/service_worker_utils.h
index b0c3cc8dee5..8c9b52899b3 100644
--- a/chromium/content/common/service_worker/service_worker_utils.h
+++ b/chromium/content/common/service_worker/service_worker_utils.h
@@ -42,26 +42,14 @@ class ServiceWorkerUtils {
                                           const GURL& script_url,
                                           std::string* error_message);
 
-  static bool CanRegisterServiceWorker(const GURL& context_url,
-                                       const GURL& pattern,
-                                       const GURL& script_url);
-
   static bool IsMojoForServiceWorkerEnabled();
 
-  // Returns true when '--disable-web-security' flag is set. Otherwise returns
-  // whether the all origins of |urls| are same as the origin of |url|.
-  template <typename... Args>
-  static bool PassOriginEqualitySecurityCheck(const GURL& url,
-                                              const Args&... urls) {
-    if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-            switches::kDisableWebSecurity))
-      return true;
-    for (const GURL& u : {urls...}) {
-      if (url.GetOrigin() != u.GetOrigin())
-        return false;
-    }
-    return true;
-  }
+  // Returns true if all members of |urls| have the same origin, and
+  // OriginCanAccessServiceWorkers is true for this origin.
+  // If --disable-web-security is enabled, the same origin check is
+  // not performed.
+  CONTENT_EXPORT static bool AllOriginsMatchAndCanAccessServiceWorkers(
+      const std::vector<GURL>& urls);
 
   // PlzNavigate
   // Returns true if the |provider_id| was assigned by the browser process.
diff --git a/chromium/content/common/service_worker/service_worker_utils_unittest.cc b/chromium/content/common/service_worker/service_worker_utils_unittest.cc
index 393c36ce158..96564a26550 100644
--- a/chromium/content/common/service_worker/service_worker_utils_unittest.cc
+++ b/chromium/content/common/service_worker/service_worker_utils_unittest.cc
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/command_line.h"
 #include "content/common/service_worker/service_worker_utils.h"
+#include "content/public/common/content_switches.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -162,7 +164,7 @@ TEST(ServiceWorkerUtilsTest, PathRestriction_Basic) {
       GURL("http://example.com/foo/sw.js?key/value")));
 }
 
-TEST(ServiceWorkerUtils, PathRestriction_SelfReference) {
+TEST(ServiceWorkerUtilsTest, PathRestriction_SelfReference) {
   // Self reference is canonicalized.
   ASSERT_EQ(GURL("http://example.com/foo/bar"),
             GURL("http://example.com/././foo/bar"));
@@ -352,7 +354,7 @@ TEST(ServiceWorkerUtilsTest, PathRestriction_DisallowedCharacter) {
       GURL("http://example.com/foo/sw.js?key%5cvalue")));
 }
 
-TEST(ServiceWorkerUtils, PathRestriction_ServiceWorkerAllowed) {
+TEST(ServiceWorkerUtilsTest, PathRestriction_ServiceWorkerAllowed) {
   // Setting header to default max scope changes nothing.
   EXPECT_TRUE(IsPathRestrictionSatisfiedWithServiceWorkerAllowedHeader(
       GURL("http://example.com/"), GURL("http://example.com/sw.js"),
@@ -394,4 +396,44 @@ TEST(ServiceWorkerUtils, PathRestriction_ServiceWorkerAllowed) {
       ""));
 }
 
+TEST(ServiceWorkerUtilsTest, AllOriginsMatchAndCanAccessServiceWorkers) {
+  std::vector<GURL> https_same_origin = {GURL("https://example.com/1"),
+                                         GURL("https://example.com/2"),
+                                         GURL("https://example.com/3")};
+  EXPECT_TRUE(ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+      https_same_origin));
+
+  std::vector<GURL> http_same_origin = {GURL("http://example.com/1"),
+                                        GURL("http://example.com/2")};
+  EXPECT_FALSE(ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+      http_same_origin));
+
+  std::vector<GURL> localhost_same_origin = {GURL("http://localhost/1"),
+                                             GURL("http://localhost/2")};
+  EXPECT_TRUE(ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+      localhost_same_origin));
+
+  std::vector<GURL> filesystem_same_origin = {
+      GURL("https://example.com/1"), GURL("https://example.com/2"),
+      GURL("filesystem:https://example.com/3")};
+  EXPECT_FALSE(ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+      filesystem_same_origin));
+
+  std::vector<GURL> https_cross_origin = {GURL("https://example.com/1"),
+                                          GURL("https://example.org/2"),
+                                          GURL("https://example.com/3")};
+  EXPECT_FALSE(ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+      https_cross_origin));
+
+  // Cross-origin access is permitted with --disable-web-security.
+  base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
+  command_line->AppendSwitch(switches::kDisableWebSecurity);
+  EXPECT_TRUE(ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+      https_cross_origin));
+
+  // Disallowed schemes are not permitted even with --disable-web-security.
+  EXPECT_FALSE(ServiceWorkerUtils::AllOriginsMatchAndCanAccessServiceWorkers(
+      filesystem_same_origin));
+}
+
 }  // namespace content
diff --git a/chromium/content/common/site_isolation_policy.cc b/chromium/content/common/site_isolation_policy.cc
index 4ab845d60b2..015940a1ec5 100644
--- a/chromium/content/common/site_isolation_policy.cc
+++ b/chromium/content/common/site_isolation_policy.cc
@@ -5,9 +5,11 @@
 #include "content/common/site_isolation_policy.h"
 
 #include "base/command_line.h"
+#include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 
 namespace content {
@@ -17,8 +19,7 @@ bool SiteIsolationPolicy::AreCrossProcessFramesPossible() {
   return UseDedicatedProcessesForAllSites() ||
          IsTopDocumentIsolationEnabled() ||
          GetContentClient()->IsSupplementarySiteIsolationModeEnabled() ||
-         base::CommandLine::ForCurrentProcess()->HasSwitch(
-             switches::kUseCrossProcessFramesForGuests);
+         base::FeatureList::IsEnabled(::features::kGuestViewCrossProcessFrames);
 }
 
 // static
diff --git a/chromium/content/common/swapped_out_messages.cc b/chromium/content/common/swapped_out_messages.cc
index 39ba68fff37..776b8ee5c09 100644
--- a/chromium/content/common/swapped_out_messages.cc
+++ b/chromium/content/common/swapped_out_messages.cc
@@ -43,13 +43,8 @@ bool SwappedOutMessages::CanSendWhileSwappedOut(const IPC::Message* msg) {
     case FrameHostMsg_DomOperationResponse::ID:
     // Input events propagate from parent to child.
     case FrameHostMsg_ForwardInputEvent::ID:
-    // The browser should always have an accurate mirror of the renderer's
-    // notion of the current page id.
-    case FrameHostMsg_DidAssignPageId::ID:
     // A swapped-out frame's opener might be updated with window.open.
     case FrameHostMsg_DidChangeOpener::ID:
-    // For handling pop-ups from cross-site frames.
-    case ViewHostMsg_CreateWidget::ID:
       return true;
     default:
       break;
diff --git a/chromium/content/common/typemaps.gni b/chromium/content/common/typemaps.gni
index 3d2d61fd94a..c6a7bd7e1d7 100644
--- a/chromium/content/common/typemaps.gni
+++ b/chromium/content/common/typemaps.gni
@@ -4,10 +4,15 @@
 
 typemaps = [
   "//content/common/native_types.typemap",
+  "//content/common/media/media_devices.typemap",
   "//content/common/service_worker/embedded_worker.typemap",
+  "//content/common/service_worker/fetch_event_dispatcher.typemap",
+  "//content/common/service_worker/service_worker_types.typemap",
   "//content/common/url_loader_status.typemap",
   "//content/common/url_request.typemap",
+  "//content/common/url_request_redirect_info.typemap",
   "//content/common/url_response_head.typemap",
+  "//content/common/url_sync_load_result.typemap",
   "//content/common/web_preferences.typemap",
   "//content/common/media/media_session.typemap",
 ]
diff --git a/chromium/content/common/typemaps_mac.gni b/chromium/content/common/typemaps_mac.gni
new file mode 100644
index 00000000000..a45d2402aec
--- /dev/null
+++ b/chromium/content/common/typemaps_mac.gni
@@ -0,0 +1,5 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+typemaps = [ "//content/common/native_types_mac.typemap" ]
diff --git a/chromium/content/common/url_loader.mojom b/chromium/content/common/url_loader.mojom
index bdb72581d55..c8d8ac3a9c5 100644
--- a/chromium/content/common/url_loader.mojom
+++ b/chromium/content/common/url_loader.mojom
@@ -11,24 +11,32 @@ struct URLRequest;
 struct URLResponseHead;
 
 [Native]
+struct URLRequestRedirectInfo;
+
+[Native]
 struct URLLoaderStatus;
 
+// Destroying a URLLoader will cancel the associated request.
 interface URLLoader {
   // If the associated request has |auto_follow_redirects| set to false,
   // then upon receiving an URLResponse with a non-NULL |redirect_url| field,
   // |FollowRedirect| may be called to load the URL indicated by the redirect.
   FollowRedirect();
-
-  // Cancels the request. The service will cancel loading, but there may be some
-  // time lag and it is possible that the client gets some notification after
-  // calling this method for a while.
-  Cancel();
 };
 
 interface URLLoaderClient {
   // Called when the response head is received.
   OnReceiveResponse(URLResponseHead head);
 
+  // Called when the request has been redirected. The receiver is expected to
+  // call FollowRedirect or cancel the request.
+  OnReceiveRedirect(URLRequestRedirectInfo redirect_info, URLResponseHead head);
+
+  // Called when some data from a resource request has been downloaded to the
+  // file. This is only called in the 'download_to_file' case and replaces
+  // OnStartLoadingResponseBody in the call sequence in that case.
+  OnDataDownloaded(int64 data_length, int64 encoded_length);
+
   // Called when the loader starts loading response body.
   OnStartLoadingResponseBody(handle<data_pipe_consumer> body);
 
diff --git a/chromium/content/common/url_loader_factory.mojom b/chromium/content/common/url_loader_factory.mojom
index 0cd0cb872ef..6b12570909b 100644
--- a/chromium/content/common/url_loader_factory.mojom
+++ b/chromium/content/common/url_loader_factory.mojom
@@ -6,14 +6,24 @@ module content.mojom;
 
 import "url_loader.mojom";
 
+[Native]
+struct URLSyncLoadResult;
+
 interface URLLoaderFactory {
   // Creats a URLLoader and starts loading with the given |request|. |client|'s
   // method will be called when certain events related to that loading
   // (e.g., response arrival) happen. |request_id| is for compatibility with
   // the existing Chrome IPC.
-  CreateLoaderAndStart(URLLoader& loader,
+  CreateLoaderAndStart(associated URLLoader& loader,
                        int32 routing_id,
                        int32 request_id,
                        URLRequest request,
-                       URLLoaderClient client);
-};
\ No newline at end of file
+                       associated URLLoaderClient client);
+
+  // Loads the resource for the given |request| synchronously.
+  // |request_id| is for compatibility with the existing Chrome IPC.
+  [Sync] SyncLoad(int32 routing_id,
+                  int32 request_id,
+                  URLRequest request)
+      => (URLSyncLoadResult result);
+};
diff --git a/chromium/content/common/url_request_redirect_info.typemap b/chromium/content/common/url_request_redirect_info.typemap
new file mode 100644
index 00000000000..fcec85bc420
--- /dev/null
+++ b/chromium/content/common/url_request_redirect_info.typemap
@@ -0,0 +1,12 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/common/url_loader.mojom"
+public_headers = [ "//net/url_request/redirect_info.h" ]
+traits_headers = [ "//content/common/resource_messages.h" ]
+deps = [
+  "//content:export",
+  "//net:net",
+]
+type_mappings = [ "content.mojom.URLRequestRedirectInfo=net::RedirectInfo" ]
diff --git a/chromium/content/common/url_schemes.cc b/chromium/content/common/url_schemes.cc
index 253bfd32bbf..96f487b2f04 100644
--- a/chromium/content/common/url_schemes.cc
+++ b/chromium/content/common/url_schemes.cc
@@ -35,11 +35,6 @@ void RegisterContentSchemes(bool lock_schemes) {
   url::AddStandardScheme(kChromeUIScheme, url::SCHEME_WITHOUT_PORT);
   url::AddStandardScheme(kGuestScheme, url::SCHEME_WITHOUT_PORT);
 
-  url::AddStandardScheme(kHttpSuboriginScheme, url::SCHEME_WITH_PORT);
-  url::AddReferrerScheme(kHttpSuboriginScheme, url::SCHEME_WITH_PORT);
-  url::AddStandardScheme(kHttpsSuboriginScheme, url::SCHEME_WITH_PORT);
-  url::AddReferrerScheme(kHttpsSuboriginScheme, url::SCHEME_WITH_PORT);
-
   for (const url::SchemeWithType& scheme : additional_standard_schemes)
     url::AddStandardScheme(scheme.scheme, scheme.type);
 
diff --git a/chromium/content/common/url_sync_load_result.typemap b/chromium/content/common/url_sync_load_result.typemap
new file mode 100644
index 00000000000..a8d96175030
--- /dev/null
+++ b/chromium/content/common/url_sync_load_result.typemap
@@ -0,0 +1,8 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/common/url_loader_factory.mojom"
+public_headers = [ "//content/public/common/resource_response.h" ]
+traits_headers = [ "//content/common/resource_messages.h" ]
+type_mappings = [ "content.mojom.URLSyncLoadResult=content::SyncLoadResult" ]
diff --git a/chromium/content/common/video_capture.mojom b/chromium/content/common/video_capture.mojom
index 6b9a08dc91a..4c6d487be3e 100644
--- a/chromium/content/common/video_capture.mojom
+++ b/chromium/content/common/video_capture.mojom
@@ -4,8 +4,94 @@
 
 module content.mojom;
 
+import "gpu/ipc/common/sync_token.mojom";
+import "media/mojo/interfaces/media_types.mojom";
+import "media/capture/mojo/video_capture_types.mojom";
+import "mojo/common/common_custom_types.mojom";
+import "ui/gfx/geometry/mojo/geometry.mojom";
+
+// This file decribes the communication between a given Renderer Host interface
+// implementation (VideoCaptureHost) and a remote VideoCaptureObserver.
+// VideoCaptureHost offers a stateless part (GetDeviceSupportedFormats() and
+// GetDeviceFormatsInUse()) that can be invoked at any time, and a stateful part
+// sandwiched between Start() and Stop(). A Client's OnStateChanged() can be
+// notified any time during the stateful part. The stateful part is composed of
+// a preamble where a Renderer client sends a command to Start() the capture,
+// registering itself as the associated remote VideoCaptureObserver. The Host
+// will then create and pre- share a number of buffers:
+//
+//   Observer                                        VideoCaptureHost
+//      | ---> StartCapture                                     |
+//      |                        OnStateChanged(STARTED) <---   |
+//      |                             OnBufferCreated(1) <---   |
+//      |                             OnBufferCreated(2) <---   |
+//      =                                                       =
+// and capture will then refer to those preallocated buffers:
+//      |                               OnBufferReady(1) <---   |
+//      |                               OnBufferReady(2) <---   |
+//      | ---> ReleaseBuffer(1)                                 |
+//      |                               OnBufferReady(1) <---   |
+//      | ---> ReleaseBuffer(2)                                 |
+//      |                               OnBufferReady(2) <---   |
+//      | ---> ReleaseBuffer(1)                                 |
+//      |                         ...                           |
+//      =                                                       =
+// Buffers can be reallocated with a larger size, if e.g. resolution changes.
+//      |                 (resolution change)                   |
+//      |                           OnBufferDestroyed(1) <---   |
+//      |                             OnBufferCreated(3) <---   |
+//      |                               OnBufferReady(3) <---   |
+//      | ---> ReleaseBuffer(2)                                 |
+//      |                           OnBufferDestroyed(2) <---   |
+//      |                             OnBufferCreated(5) <---   |
+//      |                               OnBufferReady(5) <---   |
+//      =                                                       =
+// In the communication epilogue, the client Stop()s capture, receiving a last
+// status update:
+//      | ---> StopCapture                                      |
+//      |                        OnStateChanged(STOPPED) <---   |
+
+struct VideoFrameInfo{
+  mojo.common.mojom.TimeDelta timestamp;
+  mojo.common.mojom.DictionaryValue metadata;
+  media.mojom.VideoPixelFormat pixel_format;
+  media.mojom.VideoPixelStorage storage_type;
+  gfx.mojom.Size coded_size;
+  gfx.mojom.Rect visible_rect;
+};
+
+enum VideoCaptureState {
+  STARTED,
+  PAUSED,
+  RESUMED,
+  STOPPED,
+  FAILED,
+  ENDED,
+};
+
+// Interface for notifications from Browser/Host back to Renderer/Client. This
+// interface is used between VideoCaptureHost.Start() and Stop().
+interface VideoCaptureObserver {
+  // Gets notified about a VideoCaptureState update.
+  OnStateChanged(VideoCaptureState state);
+
+  // A new buffer identified by |buffer_id| has been created for video capture.
+  OnBufferCreated(int32 buffer_id, handle<shared_buffer> handle_fd);
+
+  // |buffer_id| has video capture data with |info| containing the associated
+  // VideoFrame constituent parts.
+  OnBufferReady(int32 buffer_id, VideoFrameInfo info);
+
+  // |buffer_id| has been released by VideoCaptureHost and must not be used.
+  OnBufferDestroyed(int32 buffer_id);
+};
+
 interface VideoCaptureHost {
-  // TODO(mcasas): Migrate the rest of the messages, https://crbug.com/651897.
+  // Start the |session_id| session with |params|. The video capture will be
+  // identified as |device_id|, a new id picked by the renderer process.
+  // |observer| will be used for notifications.
+  Start(int32 device_id, int32 session_id, media.mojom.VideoCaptureParams params,
+        VideoCaptureObserver observer);
 
   // Closes the video capture specified by |device_id|.
   Stop(int32 device_id);
@@ -13,7 +99,23 @@ interface VideoCaptureHost {
   // Pauses the video capture specified by |device_id|.
   Pause(int32 device_id);
 
+  // Resume |device_id| video capture, in |session_id| and with |params|.
+  Resume(int32 device_id, int32 session_id, media.mojom.VideoCaptureParams params);
+
   // Requests that the video capturer send a frame "soon" (e.g., to resolve
   // picture loss or quality issues).
   RequestRefreshFrame(int32 device_id);
+
+  // Indicates that a renderer has finished using a previously shared buffer.
+  ReleaseBuffer(int32 device_id, int32 buffer_id,
+                gpu.mojom.SyncToken sync_token,
+                double consumer_resource_utilization);
+
+  // Get the formats supported by a device referenced by |session_id|.
+  GetDeviceSupportedFormats(int32 device_id, int32 session_id)
+    => (array<media.mojom.VideoCaptureFormat> formats_supported);
+
+  // Get the format(s) in use by a device referenced by |session_id|.
+  GetDeviceFormatsInUse(int32 device_id, int32 session_id)
+    => (array<media.mojom.VideoCaptureFormat> formats_in_use);
 };
diff --git a/chromium/content/common/view_messages.h b/chromium/content/common/view_messages.h
index c40d6484445..26143d401d4 100644
--- a/chromium/content/common/view_messages.h
+++ b/chromium/content/common/view_messages.h
@@ -40,6 +40,7 @@
 #include "media/base/channel_layout.h"
 #include "media/base/ipc/media_param_traits.h"
 #include "media/base/media_log_event.h"
+#include "media/capture/ipc/capture_param_traits.h"
 #include "net/base/network_change_notifier.h"
 #include "third_party/WebKit/public/platform/WebDisplayMode.h"
 #include "third_party/WebKit/public/platform/WebFloatPoint.h"
@@ -64,7 +65,6 @@
 #include "ui/gfx/ipc/color/gfx_param_traits.h"
 #include "ui/gfx/ipc/gfx_param_traits.h"
 #include "ui/gfx/ipc/skia/gfx_skia_param_traits.h"
-#include "ui/gfx/range/range.h"
 
 #if defined(OS_MACOSX)
 #include "third_party/WebKit/public/platform/WebScrollbarButtonsPlacement.h"
@@ -180,11 +180,10 @@ IPC_STRUCT_TRAITS_BEGIN(content::ResizeParams)
   IPC_STRUCT_TRAITS_MEMBER(screen_info)
   IPC_STRUCT_TRAITS_MEMBER(new_size)
   IPC_STRUCT_TRAITS_MEMBER(physical_backing_size)
-  IPC_STRUCT_TRAITS_MEMBER(top_controls_shrink_blink_size)
+  IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
   IPC_STRUCT_TRAITS_MEMBER(top_controls_height)
   IPC_STRUCT_TRAITS_MEMBER(bottom_controls_height)
   IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
-  IPC_STRUCT_TRAITS_MEMBER(resizer_rect)
   IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
   IPC_STRUCT_TRAITS_MEMBER(display_mode)
   IPC_STRUCT_TRAITS_MEMBER(needs_resize_ack)
@@ -246,6 +245,9 @@ IPC_STRUCT_TRAITS_BEGIN(content::RendererPreferences)
   IPC_STRUCT_TRAITS_MEMBER(plugin_fullscreen_allowed)
   IPC_STRUCT_TRAITS_MEMBER(use_video_overlay_for_embedded_encrypted_video)
   IPC_STRUCT_TRAITS_MEMBER(network_contry_iso)
+#if defined(OS_LINUX)
+  IPC_STRUCT_TRAITS_MEMBER(system_font_family_name)
+#endif
 #if defined(OS_WIN)
   IPC_STRUCT_TRAITS_MEMBER(caption_font_family_name)
   IPC_STRUCT_TRAITS_MEMBER(caption_font_height)
@@ -362,17 +364,6 @@ IPC_STRUCT_BEGIN(ViewHostMsg_UpdateRect_Params)
   IPC_STRUCT_MEMBER(int, flags)
 IPC_STRUCT_END()
 
-#if defined(OS_MACOSX)
-IPC_STRUCT_BEGIN(ViewMsg_UpdateScrollbarTheme_Params)
-  IPC_STRUCT_MEMBER(float, initial_button_delay)
-  IPC_STRUCT_MEMBER(float, autoscroll_button_delay)
-  IPC_STRUCT_MEMBER(bool, jump_on_track_click)
-  IPC_STRUCT_MEMBER(blink::ScrollerStyle, preferred_scroller_style)
-  IPC_STRUCT_MEMBER(bool, redraw)
-  IPC_STRUCT_MEMBER(blink::WebScrollbarButtonsPlacement, button_placement)
-IPC_STRUCT_END()
-#endif
-
 // Messages sent from the browser to the renderer.
 
 #if defined(OS_ANDROID)
@@ -419,10 +410,6 @@ IPC_MESSAGE_ROUTED1(ViewMsg_EnableDeviceEmulation,
 // Disables device emulation, enabled previously by EnableDeviceEmulation.
 IPC_MESSAGE_ROUTED0(ViewMsg_DisableDeviceEmulation)
 
-// Tells the render view that the resize rect has changed.
-IPC_MESSAGE_ROUTED1(ViewMsg_ChangeResizeRect,
-                    gfx::Rect /* resizer_rect */)
-
 // Sent to inform the view that it was hidden.  This allows it to reduce its
 // resource utilization.
 IPC_MESSAGE_ROUTED0(ViewMsg_WasHidden)
@@ -467,13 +454,6 @@ IPC_MESSAGE_ROUTED1(ViewMsg_SetPageScale, float /* page_scale_factor */)
 IPC_MESSAGE_ROUTED1(ViewMsg_Zoom,
                     content::PageZoom /* function */)
 
-// Set the zoom level for a particular url that the renderer is in the
-// process of loading.  This will be stored, to be used if the load commits
-// and ignored otherwise.
-IPC_MESSAGE_ROUTED2(ViewMsg_SetZoomLevelForLoadingURL,
-                    GURL /* url */,
-                    double /* zoom_level */)
-
 // Used to tell a render view whether it should expose various bindings
 // that allow JS content extended privileges.  See BindingsPolicy for valid
 // flag values.
@@ -538,9 +518,6 @@ IPC_MESSAGE_ROUTED1(ViewMsg_DisableAutoResize,
 IPC_MESSAGE_ROUTED1(ViewMsg_SetTextDirection,
                     blink::WebTextDirection /* direction */)
 
-// Tells the renderer to clear the focused element (if any).
-IPC_MESSAGE_ROUTED0(ViewMsg_ClearFocusedElement)
-
 // Make the RenderView background transparent or opaque.
 IPC_MESSAGE_ROUTED1(ViewMsg_SetBackgroundOpaque, bool /* opaque */)
 
@@ -569,12 +546,6 @@ IPC_MESSAGE_ROUTED0(ViewMsg_WorkerScriptLoadFailed)
 // This message is sent only if the worker successfully loaded the script.
 IPC_MESSAGE_ROUTED0(ViewMsg_WorkerConnected)
 
-// Tells the renderer that the network type has changed so that navigator.onLine
-// and navigator.connection can be updated.
-IPC_MESSAGE_CONTROL2(ViewMsg_NetworkConnectionChanged,
-                     net::NetworkChangeNotifier::ConnectionType /* type */,
-                     double /* max bandwidth mbps */)
-
 // Sent by the browser to synchronize with the next compositor frame. Used only
 // for tests.
 IPC_MESSAGE_ROUTED1(ViewMsg_WaitForNextFrameForTests, int /* routing_id */)
@@ -591,11 +562,6 @@ IPC_MESSAGE_ROUTED2(ViewMsg_PpapiBrokerChannelCreated,
 // or not.
 IPC_MESSAGE_ROUTED1(ViewMsg_PpapiBrokerPermissionResult,
                     bool /* result */)
-
-// Tells the renderer to empty its plugin list cache, optional reloading
-// pages containing plugins.
-IPC_MESSAGE_CONTROL1(ViewMsg_PurgePluginListCache,
-                     bool /* reload_pages */)
 #endif
 
 // An acknowledge to ViewHostMsg_MultipleTargetsTouched to notify the renderer
@@ -606,32 +572,14 @@ IPC_MESSAGE_ROUTED1(ViewMsg_ReleaseDisambiguationPopupBitmap,
 // Fetches complete rendered content of a web page as plain text.
 IPC_MESSAGE_ROUTED0(ViewMsg_GetRenderedText)
 
-#if defined(OS_MACOSX)
-// Notification of a change in scrollbar appearance and/or behavior.
-IPC_MESSAGE_CONTROL1(ViewMsg_UpdateScrollbarTheme,
-                     ViewMsg_UpdateScrollbarTheme_Params /* params */)
-
-// Notification that the OS X Aqua color preferences changed.
-IPC_MESSAGE_CONTROL3(ViewMsg_SystemColorsChanged,
-                     int /* AppleAquaColorVariant */,
-                     std::string /* AppleHighlightedTextColor */,
-                     std::string /* AppleHighlightColor */)
-#endif
-
 #if defined(OS_ANDROID)
-// Tells the renderer to suspend/resume the webkit timers.
-IPC_MESSAGE_CONTROL1(ViewMsg_SetWebKitSharedTimersSuspended,
-                     bool /* suspend */)
-
-// Notifies the renderer whether hiding/showing the top controls is enabled
+// Notifies the renderer whether hiding/showing the browser controls is enabled
 // and whether or not to animate to the proper state.
-IPC_MESSAGE_ROUTED3(ViewMsg_UpdateTopControlsState,
+IPC_MESSAGE_ROUTED3(ViewMsg_UpdateBrowserControlsState,
                     bool /* enable_hiding */,
                     bool /* enable_showing */,
                     bool /* animate */)
 
-IPC_MESSAGE_ROUTED0(ViewMsg_ShowImeIfNeeded)
-
 // Extracts the data at the given rect, returning it through the
 // ViewHostMsg_SmartClipDataExtracted IPC.
 IPC_MESSAGE_ROUTED1(ViewMsg_ExtractSmartClipData,
@@ -646,10 +594,6 @@ IPC_MESSAGE_ROUTED3(ViewMsg_ReclaimCompositorResources,
                     bool /* is_swap_ack */,
                     cc::ReturnedResourceArray /* resources */)
 
-// Sent by browser to give renderer compositor a new namespace ID for any
-// SurfaceSequences it has to create.
-IPC_MESSAGE_ROUTED1(ViewMsg_SetFrameSinkId, cc::FrameSinkId /* frame_sink_id */)
-
 IPC_MESSAGE_ROUTED0(ViewMsg_SelectWordAroundCaret)
 
 // Sent by the browser to ask the renderer to redraw. Robust to events that can
@@ -678,20 +622,6 @@ IPC_MESSAGE_ROUTED1(ViewMsg_HandleCompositorProto,
 IPC_MESSAGE_ROUTED1(ViewHostMsg_SetNeedsBeginFrames,
                     bool /* enabled */)
 
-// Similar to ViewHostMsg_CreateWindow, except used for sub-widgets, like
-// <select> dropdowns.  This message is sent to the WebContentsImpl that
-// contains the widget being created.
-IPC_SYNC_MESSAGE_CONTROL2_1(ViewHostMsg_CreateWidget,
-                            int /* opener_id */,
-                            blink::WebPopupType /* popup type */,
-                            int /* route_id */)
-
-// Similar to ViewHostMsg_CreateWidget except the widget is a full screen
-// window.
-IPC_SYNC_MESSAGE_CONTROL1_1(ViewHostMsg_CreateFullscreenWidget,
-                            int /* opener_id */,
-                            int /* route_id */)
-
 // These three messages are sent to the parent RenderViewHost to display the
 // page/widget that was created by
 // CreateWindow/CreateWidget/CreateFullscreenWidget. routing_id
@@ -740,9 +670,7 @@ IPC_MESSAGE_CONTROL1(ViewHostMsg_Close_ACK,
 IPC_MESSAGE_ROUTED0(ViewHostMsg_ClosePage_ACK)
 
 // Notifies the browser that we have session history information.
-// page_id: unique ID that allows us to distinguish between history entries.
-IPC_MESSAGE_ROUTED2(ViewHostMsg_UpdateState,
-                    int32_t /* page_id */,
+IPC_MESSAGE_ROUTED1(ViewHostMsg_UpdateState,
                     content::PageState /* state */)
 
 // Notifies the browser that we want to show a destination url for a potential
@@ -763,14 +691,6 @@ IPC_MESSAGE_ROUTED1(ViewHostMsg_UpdateRect,
 
 IPC_MESSAGE_ROUTED0(ViewHostMsg_Focus)
 
-// Message sent from renderer to the browser when focus changes inside the
-// webpage. The first parameter says whether the newly focused element needs
-// keyboard input (true for textfields, text areas and content editable divs).
-// The second parameter is the node bounds relative to RenderWidgetHostView.
-IPC_MESSAGE_ROUTED2(ViewHostMsg_FocusedNodeChanged,
-                    bool /* is_editable_node */,
-                    gfx::Rect /* node_bounds */)
-
 IPC_MESSAGE_ROUTED1(ViewHostMsg_SetCursor, content::WebCursor)
 
 // Get the list of proxies to use for |url|, as a semicolon delimited list
@@ -845,15 +765,6 @@ IPC_MESSAGE_ROUTED2(ViewHostMsg_SetTooltipText,
                     base::string16 /* tooltip text string */,
                     blink::WebTextDirection /* text direction hint */)
 
-// Notification that the text selection has changed.
-// Note: The secound parameter is the character based offset of the
-// base::string16
-// text in the document.
-IPC_MESSAGE_ROUTED3(ViewHostMsg_SelectionChanged,
-                    base::string16 /* text covers the selection range */,
-                    uint32_t /* the offset of the text in the document */,
-                    gfx::Range /* selection range in the document */)
-
 // Notification that the selection bounds have changed.
 IPC_MESSAGE_ROUTED1(ViewHostMsg_SelectionBoundsChanged,
                     ViewHostMsg_SelectionBounds_Params)
diff --git a/chromium/content/common/zygote_commands_linux.h b/chromium/content/common/zygote_commands_linux.h
index 0fed210c8ae..c67593d085b 100644
--- a/chromium/content/common/zygote_commands_linux.h
+++ b/chromium/content/common/zygote_commands_linux.h
@@ -28,8 +28,7 @@ static const char kZygoteChildPingMessage[] = "CHILD_PING";
 const size_t kZygoteMaxMessageLength = 8192;
 
 // File descriptors initialized by the Zygote Host
-const int kZygoteSocketPairFd =
-    kPrimaryIPCChannel + base::GlobalDescriptors::kBaseDescriptor;
+const int kZygoteSocketPairFd = base::GlobalDescriptors::kBaseDescriptor;
 
 // These are the command codes used on the wire between the browser and the
 // zygote.