BASELINE: Update Chromium to 69.0.3497.70

Change-Id: I2b7b56e4e7a8b26656930def0d4575dc32b900a0
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

86 files changed, 1669 insertions, 504 deletions

diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn
index 93b61314c26..cb9b7ba284b 100644
--- a/chromium/content/public/browser/BUILD.gn
+++ b/chromium/content/public/browser/BUILD.gn
@@ -29,7 +29,6 @@ jumbo_source_set("browser_sources") {
     "android/compositor.h",
     "android/compositor_client.h",
     "android/content_protocol_handler.h",
-    "android/content_view_layer_renderer.h",
     "android/devtools_auth.h",
     "android/java_interfaces.h",
     "android/motion_event_action.h",
@@ -39,6 +38,8 @@ jumbo_source_set("browser_sources") {
     "appcache_service.h",
     "audio_service_info.cc",
     "audio_service_info.h",
+    "authenticator_request_client_delegate.cc",
+    "authenticator_request_client_delegate.h",
     "ax_event_notification_details.cc",
     "ax_event_notification_details.h",
     "background_fetch_delegate.cc",
@@ -101,6 +102,7 @@ jumbo_source_set("browser_sources") {
     "desktop_media_id.cc",
     "desktop_media_id.h",
     "devtools_agent_host.h",
+    "devtools_agent_host_client.cc",
     "devtools_agent_host_client.h",
     "devtools_agent_host_observer.cc",
     "devtools_agent_host_observer.h",
@@ -119,6 +121,7 @@ jumbo_source_set("browser_sources") {
     "download_manager_delegate.cc",
     "download_manager_delegate.h",
     "download_request_utils.h",
+    "download_utils.h",
     "favicon_status.cc",
     "favicon_status.h",
     "file_url_loader.h",
@@ -152,9 +155,7 @@ jumbo_source_set("browser_sources") {
     "local_storage_usage_info.h",
     "login_delegate.h",
     "manifest_icon_downloader.h",
-    "manifest_icon_selector.h",
     "media_capture_devices.h",
-    "media_controller.h",
     "media_device_id.cc",
     "media_device_id.h",
     "media_request_state.h",
@@ -178,6 +179,8 @@ jumbo_source_set("browser_sources") {
     "navigation_throttle.h",
     "navigation_type.h",
     "navigation_ui_data.h",
+    "network_connection_tracker.cc",
+    "network_connection_tracker.h",
     "network_quality_observer_factory.h",
     "network_service_instance.h",
     "notification_database_data.cc",
@@ -197,7 +200,8 @@ jumbo_source_set("browser_sources") {
     "payment_app_provider.h",
     "pepper_flash_settings_helper.h",
     "pepper_vpn_provider_resource_host_proxy.h",
-    "permission_manager.h",
+    "permission_controller.h",
+    "permission_controller_delegate.h",
     "permission_type.h",
     "picture_in_picture_window_controller.h",
     "platform_notification_context.h",
@@ -264,6 +268,7 @@ jumbo_source_set("browser_sources") {
     "ssl_host_state_delegate.h",
     "ssl_status.cc",
     "ssl_status.h",
+    "startup_data.h",
     "storage_partition.h",
     "stored_payment_app.cc",
     "stored_payment_app.h",
@@ -279,6 +284,7 @@ jumbo_source_set("browser_sources") {
     "url_data_source.cc",
     "url_data_source.h",
     "url_loader_request_interceptor.h",
+    "video_capture_device_launcher.cc",
     "video_capture_device_launcher.h",
     "visibility.h",
     "vpn_service_proxy.h",
@@ -342,13 +348,13 @@ jumbo_source_set("browser_sources") {
   deps = [
     "//cc",
     "//content/browser",  # Must not be public_deps!
-    "//device/geolocation",
     "//gpu",
     "//gpu/command_buffer/service:gles2",
     "//media",
     "//media/capture",
     "//net",
     "//ppapi/c",
+    "//services/device/public/cpp/geolocation",
     "//services/service_manager/embedder:embedder_result_codes",
     "//ui/accessibility",
     "//ui/base",
diff --git a/chromium/content/public/browser/DEPS b/chromium/content/public/browser/DEPS
index 782fb0e3ad4..3b73764c818 100644
--- a/chromium/content/public/browser/DEPS
+++ b/chromium/content/public/browser/DEPS
@@ -3,9 +3,8 @@ include_rules = [
   # TODO(qinmin): move it to services/download when download becomes a service.
   "+components/download/public/common",
   "+components/viz/common",
-  "+device/geolocation/public/cpp",
   "+device/usb/public/mojom",
-  "+services/device/public/mojom",
+  "+services/device/public",
   "+services/network/public/cpp",
   "+services/service_manager/sandbox",
   "+services/resource_coordinator/public",
@@ -27,4 +26,8 @@ specific_include_rules = {
     # content/browser and chrome/browser.
     "+third_party/webrtc/modules/desktop_capture/desktop_capture_options.h",
   ],
+
+  ".*unittest\.cc": [
+    "+services/network/network_service.h",
+  ],
 }
diff --git a/chromium/content/public/browser/android/content_view_layer_renderer.h b/chromium/content/public/browser/android/content_view_layer_renderer.h
deleted file mode 100644
index 09bf2f6f32d..00000000000
--- a/chromium/content/public/browser/android/content_view_layer_renderer.h
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_CONTENT_VIEW_LAYER_RENDERER_H_
-#define CONTENT_PUBLIC_BROWSER_ANDROID_CONTENT_VIEW_LAYER_RENDERER_H_
-
-namespace cc {
-class Layer;
-}
-
-namespace content {
-
-// This interface is used by consumers of the ContentViewRenderView to
-// attach/detach layers.
-class ContentViewLayerRenderer {
- public:
-  virtual void AttachLayer(cc::Layer* layer) = 0;
-  virtual void DetachLayer(cc::Layer* layer) = 0;
-
- protected:
-  virtual ~ContentViewLayerRenderer() {}
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_CONTENT_VIEW_LAYER_RENDERER_H_
diff --git a/chromium/content/public/browser/authenticator_request_client_delegate.cc b/chromium/content/public/browser/authenticator_request_client_delegate.cc
new file mode 100644
index 00000000000..2f06e057efa
--- /dev/null
+++ b/chromium/content/public/browser/authenticator_request_client_delegate.cc
@@ -0,0 +1,41 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/authenticator_request_client_delegate.h"
+
+#include "base/callback.h"
+#include "base/strings/string_piece.h"
+
+namespace content {
+
+AuthenticatorRequestClientDelegate::AuthenticatorRequestClientDelegate() =
+    default;
+AuthenticatorRequestClientDelegate::~AuthenticatorRequestClientDelegate() =
+    default;
+
+void AuthenticatorRequestClientDelegate::DidStartRequest() {}
+
+bool AuthenticatorRequestClientDelegate::ShouldPermitIndividualAttestation(
+    const std::string& relying_party_id) {
+  return false;
+}
+
+void AuthenticatorRequestClientDelegate::ShouldReturnAttestation(
+    const std::string& relying_party_id,
+    base::OnceCallback<void(bool)> callback) {
+  std::move(callback).Run(true);
+}
+
+bool AuthenticatorRequestClientDelegate::IsFocused() {
+  return true;
+}
+
+#if defined(OS_MACOSX)
+base::Optional<AuthenticatorRequestClientDelegate::TouchIdAuthenticatorConfig>
+AuthenticatorRequestClientDelegate::GetTouchIdAuthenticatorConfig() const {
+  return base::nullopt;
+}
+#endif
+
+}  // namespace content
diff --git a/chromium/content/public/browser/authenticator_request_client_delegate.h b/chromium/content/public/browser/authenticator_request_client_delegate.h
new file mode 100644
index 00000000000..55b41750a5d
--- /dev/null
+++ b/chromium/content/public/browser/authenticator_request_client_delegate.h
@@ -0,0 +1,85 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_AUTHENTICATOR_REQUEST_CLIENT_DELEGATE_H_
+#define CONTENT_PUBLIC_BROWSER_AUTHENTICATOR_REQUEST_CLIENT_DELEGATE_H_
+
+#include <string>
+
+#include "base/callback_forward.h"
+#include "base/macros.h"
+#include "base/optional.h"
+#include "build/build_config.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Interface that the embedder should implement to provide the //content layer
+// with embedder-specific configuration for a single Web Authentication API [1]
+// request serviced in a given RenderFrame.
+//
+// [1]: See https://www.w3.org/TR/webauthn/.
+class CONTENT_EXPORT AuthenticatorRequestClientDelegate {
+ public:
+  AuthenticatorRequestClientDelegate();
+  virtual ~AuthenticatorRequestClientDelegate();
+
+  // Notifies the delegate that the request is actually starting.
+  virtual void DidStartRequest();
+
+  // Returns true if the given relying party ID is permitted to receive
+  // individual attestation certificates. This:
+  //  a) triggers a signal to the security key that returning individual
+  //     attestation certificates is permitted, and
+  //  b) skips any permission prompt for attestation.
+  virtual bool ShouldPermitIndividualAttestation(
+      const std::string& relying_party_id);
+
+  // Invokes |callback| with |true| if the given relying party ID is permitted
+  // to receive attestation certificates from a device. Otherwise invokes
+  // |callback| with |false|.
+  //
+  // Since these certificates may uniquely identify the authenticator, the
+  // embedder may choose to show a permissions prompt to the user, and only
+  // invoke |callback| afterwards. This may hairpin |callback|.
+  virtual void ShouldReturnAttestation(const std::string& relying_party_id,
+                                       base::OnceCallback<void(bool)> callback);
+
+  // Returns whether the WebContents corresponding to |render_frame_host| is the
+  // active tab in the focused window. We do not want to allow
+  // authenticatorMakeCredential operations to be triggered by background tabs.
+  //
+  // Note that the default implementation of this function, and the
+  // implementation in ChromeContentBrowserClient for Android, return |true| so
+  // that testing is possible.
+  virtual bool IsFocused();
+
+#if defined(OS_MACOSX)
+  struct TouchIdAuthenticatorConfig {
+    // The keychain-access-group value used for WebAuthn credentials
+    // stored in the macOS keychain by the built-in Touch ID
+    // authenticator. For more information on this, refer to
+    // |device::fido::TouchIdAuthenticator|.
+    std::string keychain_access_group;
+    // The secret used to derive key material when encrypting WebAuthn
+    // credential metadata for storage in the macOS keychain. Chrome returns
+    // different secrets for each user profile in order to logically separate
+    // credentials per profile.
+    std::string metadata_secret;
+  };
+
+  // Returns configuration data for the built-in Touch ID platform
+  // authenticator. May return nullopt if the authenticator is not used or not
+  // available.
+  virtual base::Optional<TouchIdAuthenticatorConfig>
+  GetTouchIdAuthenticatorConfig() const;
+#endif
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(AuthenticatorRequestClientDelegate);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_AUTHENTICATOR_REQUEST_CLIENT_DELEGATE_H_
diff --git a/chromium/content/public/browser/ax_event_notification_details.cc b/chromium/content/public/browser/ax_event_notification_details.cc
index 97dbc5ba3f8..fb2694ea914 100644
--- a/chromium/content/public/browser/ax_event_notification_details.cc
+++ b/chromium/content/public/browser/ax_event_notification_details.cc
@@ -4,14 +4,11 @@
 
 #include "content/public/browser/ax_event_notification_details.h"
 
+#include "ui/accessibility/ax_event.h"
+
 namespace content {
 
-AXEventNotificationDetails::AXEventNotificationDetails()
-    : event_type(ax::mojom::Event::kNone),
-      id(-1),
-      ax_tree_id(-1),
-      event_from(ax::mojom::EventFrom::kNone),
-      action_request_id(-1) {}
+AXEventNotificationDetails::AXEventNotificationDetails() : ax_tree_id(-1) {}
 
 AXEventNotificationDetails::AXEventNotificationDetails(
     const AXEventNotificationDetails& other) = default;
diff --git a/chromium/content/public/browser/ax_event_notification_details.h b/chromium/content/public/browser/ax_event_notification_details.h
index 6732cc3c0d5..7a38ebe7548 100644
--- a/chromium/content/public/browser/ax_event_notification_details.h
+++ b/chromium/content/public/browser/ax_event_notification_details.h
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "content/common/content_export.h"
+#include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/accessibility/ax_relative_bounds.h"
 #include "ui/accessibility/ax_tree_data.h"
@@ -23,12 +24,14 @@ struct CONTENT_EXPORT AXEventNotificationDetails {
   AXEventNotificationDetails(const AXEventNotificationDetails& other);
   ~AXEventNotificationDetails();
 
-  ui::AXTreeUpdate update;
-  ax::mojom::Event event_type;
-  int id;
+  // The unique ID of the accessibility tree this event bundle applies to.
   int ax_tree_id;
-  ax::mojom::EventFrom event_from;
-  int action_request_id;
+
+  // Zero or more updates to the accessibility tree to apply first.
+  std::vector<ui::AXTreeUpdate> updates;
+
+  // Zero or more events to fire after the tree updates have been applied.
+  std::vector<ui::AXEvent> events;
 };
 
 // Use this object in conjunction with the
diff --git a/chromium/content/public/browser/background_fetch_delegate.h b/chromium/content/public/browser/background_fetch_delegate.h
index 275814357b6..bf9e3ff76ab 100644
--- a/chromium/content/public/browser/background_fetch_delegate.h
+++ b/chromium/content/public/browser/background_fetch_delegate.h
@@ -37,6 +37,7 @@ enum class BackgroundFetchReasonToAbort {
   CANCELLED_FROM_UI,
   ABORTED_BY_DEVELOPER,
   TOTAL_DOWNLOAD_SIZE_EXCEEDED,
+  SERVICE_WORKER_UNAVAILABLE,
 };
 
 // Interface for launching background fetches. Implementing classes would
@@ -79,6 +80,9 @@ class CONTENT_EXPORT BackgroundFetchDelegate {
         const std::string& download_guid,
         std::unique_ptr<BackgroundFetchResult> result) = 0;
 
+    // Called when the UI of a background fetch job is activated.
+    virtual void OnUIActivated(const std::string& job_unique_id) = 0;
+
     // Called by the delegate when it's shutting down to signal that the
     // delegate is no longer valid.
     virtual void OnDelegateShutdown() = 0;
@@ -113,6 +117,11 @@ class CONTENT_EXPORT BackgroundFetchDelegate {
   // Aborts any downloads associated with |job_unique_id|.
   virtual void Abort(const std::string& job_unique_id) = 0;
 
+  // Updates the UI shown for the fetch job associated with |job_unique_id| to
+  // display a new |title|.
+  virtual void UpdateUI(const std::string& job_unique_id,
+                        const std::string& title) = 0;
+
   // Set the client that the delegate should communicate changes to.
   void SetDelegateClient(base::WeakPtr<Client> client) { client_ = client; }
 
diff --git a/chromium/content/public/browser/background_fetch_response.cc b/chromium/content/public/browser/background_fetch_response.cc
index b27cd14524a..2866062274f 100644
--- a/chromium/content/public/browser/background_fetch_response.cc
+++ b/chromium/content/public/browser/background_fetch_response.cc
@@ -11,20 +11,23 @@ BackgroundFetchResponse::BackgroundFetchResponse(
     const scoped_refptr<const net::HttpResponseHeaders>& headers)
     : url_chain(url_chain), headers(headers) {}
 
-BackgroundFetchResponse::~BackgroundFetchResponse() {}
+BackgroundFetchResponse::~BackgroundFetchResponse() = default;
 
 BackgroundFetchResult::BackgroundFetchResult(base::Time response_time,
                                              FailureReason failure_reason)
     : response_time(response_time), failure_reason(failure_reason) {}
 
-BackgroundFetchResult::BackgroundFetchResult(base::Time response_time,
-                                             const base::FilePath& path,
-                                             uint64_t file_size)
+BackgroundFetchResult::BackgroundFetchResult(
+    base::Time response_time,
+    const base::FilePath& path,
+    base::Optional<storage::BlobDataHandle> blob_handle,
+    uint64_t file_size)
     : response_time(response_time),
       file_path(path),
+      blob_handle(blob_handle),
       file_size(file_size),
       failure_reason(FailureReason::NONE) {}
 
-BackgroundFetchResult::~BackgroundFetchResult() {}
+BackgroundFetchResult::~BackgroundFetchResult() = default;
 
 }  // namespace content
diff --git a/chromium/content/public/browser/background_fetch_response.h b/chromium/content/public/browser/background_fetch_response.h
index 00bf91c49ea..9575776194a 100644
--- a/chromium/content/public/browser/background_fetch_response.h
+++ b/chromium/content/public/browser/background_fetch_response.h
@@ -8,9 +8,11 @@
 #include <vector>
 
 #include "base/files/file_path.h"
+#include "base/optional.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "net/http/http_response_headers.h"
+#include "storage/browser/blob/blob_data_handle.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -60,12 +62,14 @@ struct CONTENT_EXPORT BackgroundFetchResult {
   // Constructor for successful downloads.
   BackgroundFetchResult(base::Time response_time,
                         const base::FilePath& path,
+                        base::Optional<storage::BlobDataHandle> blob_handle,
                         uint64_t file_size);
 
   ~BackgroundFetchResult();
 
   const base::Time response_time;
   const base::FilePath file_path;
+  base::Optional<storage::BlobDataHandle> blob_handle;
   const uint64_t file_size = 0;
   FailureReason failure_reason;
 
diff --git a/chromium/content/public/browser/background_tracing_manager.h b/chromium/content/public/browser/background_tracing_manager.h
index dca9d8a3e46..b4cd53f742d 100644
--- a/chromium/content/public/browser/background_tracing_manager.h
+++ b/chromium/content/public/browser/background_tracing_manager.h
@@ -41,9 +41,9 @@ class BackgroundTracingManager {
   //
   using FinishedProcessingCallback = base::OnceCallback<void(bool success)>;
   using ReceiveCallback =
-      base::OnceCallback<void(const scoped_refptr<base::RefCountedString>&,
-                              std::unique_ptr<const base::DictionaryValue>,
-                              FinishedProcessingCallback)>;
+      base::RepeatingCallback<void(const scoped_refptr<base::RefCountedString>&,
+                                   std::unique_ptr<const base::DictionaryValue>,
+                                   FinishedProcessingCallback)>;
 
   // Set the triggering rules for when to start recording.
   //
diff --git a/chromium/content/public/browser/browser_child_process_host.h b/chromium/content/public/browser/browser_child_process_host.h
index 3d9a91c4e88..d3e119342c8 100644
--- a/chromium/content/public/browser/browser_child_process_host.h
+++ b/chromium/content/public/browser/browser_child_process_host.h
@@ -83,6 +83,9 @@ class CONTENT_EXPORT BrowserChildProcessHost : public IPC::Sender {
   // Sets the user-visible name of the process.
   virtual void SetName(const base::string16& name) = 0;
 
+  // Sets the name of the process used for metrics reporting.
+  virtual void SetMetricsName(const std::string& metrics_name) = 0;
+
   // Set the handle of the process. BrowserChildProcessHost will do this when
   // the Launch method is used to start the process. However if the owner
   // of this object doesn't call Launch and starts the process in another way,
diff --git a/chromium/content/public/browser/browser_context.h b/chromium/content/public/browser/browser_context.h
index b5cad2b7364..4f794e25ac7 100644
--- a/chromium/content/public/browser/browser_context.h
+++ b/chromium/content/public/browser/browser_context.h
@@ -20,6 +20,7 @@
 #include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_job_factory.h"
 #include "services/service_manager/embedder/embedded_service_info.h"
+#include "third_party/blink/public/mojom/blob/blob.mojom.h"
 
 #if !defined(OS_ANDROID)
 #include "content/public/browser/zoom_level_delegate.h"
@@ -66,7 +67,8 @@ class BrowsingDataRemover;
 class BrowsingDataRemoverDelegate;
 class DownloadManager;
 class DownloadManagerDelegate;
-class PermissionManager;
+class PermissionController;
+class PermissionControllerDelegate;
 struct PushEventPayload;
 class PushMessagingService;
 class ResourceContext;
@@ -101,6 +103,10 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // for this |context|.
   static BrowsingDataRemover* GetBrowsingDataRemover(BrowserContext* context);
 
+  // Returns the PermissionController associated with this context. There's
+  // always a PermissionController instance for each BrowserContext.
+  static PermissionController* GetPermissionController(BrowserContext* context);
+
   // Returns a StoragePartition for the given SiteInstance. By default this will
   // create a new StoragePartition if it doesn't exist, unless |can_create| is
   // false.
@@ -147,6 +153,14 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   static BlobContextGetter GetBlobStorageContext(
       BrowserContext* browser_context);
 
+  // Returns a mojom::BlobPtr for a specific blob. If no blob exists with the
+  // given UUID, the BlobPtr pipe will close.
+  // This method should be called on the UI thread.
+  // TODO(mek): Blob UUIDs should be entirely internal to the blob system, so
+  // eliminate this method in favor of just passing around the BlobPtr directly.
+  static blink::mojom::BlobPtr GetBlobPtr(BrowserContext* browser_context,
+                                          const std::string& uuid);
+
   // Delivers a push message with |data| to the Service Worker identified by
   // |origin| and |service_worker_registration_id|.
   static void DeliverPushMessage(
@@ -247,9 +261,12 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // return nullptr, implementing the default exception storage strategy.
   virtual SSLHostStateDelegate* GetSSLHostStateDelegate() = 0;
 
-  // Returns the PermissionManager associated with that context if any, nullptr
-  // otherwise.
-  virtual PermissionManager* GetPermissionManager() = 0;
+  // Returns the PermissionControllerDelegate associated with this context if
+  // any, nullptr otherwise.
+  //
+  // Note: if you want to check a permission status, you probably need
+  // BrowserContext::GetPermissionController() instead.
+  virtual PermissionControllerDelegate* GetPermissionControllerDelegate() = 0;
 
   // Returns the BackgroundFetchDelegate associated with that context if any,
   // nullptr otherwise.
diff --git a/chromium/content/public/browser/browser_main_parts.h b/chromium/content/public/browser/browser_main_parts.h
index 4b8b672fd40..2013a970877 100644
--- a/chromium/content/public/browser/browser_main_parts.h
+++ b/chromium/content/public/browser/browser_main_parts.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_BROWSER_MAIN_PARTS_H_
 #define CONTENT_PUBLIC_BROWSER_BROWSER_MAIN_PARTS_H_
 
+#include "base/callback.h"
 #include "content/common/content_export.h"
 
 namespace content {
@@ -95,6 +96,10 @@ class CONTENT_EXPORT BrowserMainParts {
   // May set |result_code|, which will be returned by |BrowserMain()|.
   virtual bool MainMessageLoopRun(int* result_code);
 
+  // Provides an embedder with a Closure which will quit the default main
+  // message loop. This is call only if MainMessageLoopRun returns false.
+  virtual void PreDefaultMainMessageLoopRun(base::OnceClosure quit_closure) {}
+
   // This happens after the main message loop has stopped, but before
   // threads are stopped.
   virtual void PostMainMessageLoopRun() {}
diff --git a/chromium/content/public/browser/browsing_data_remover.h b/chromium/content/public/browser/browsing_data_remover.h
index ba4694da241..67596f77697 100644
--- a/chromium/content/public/browser/browsing_data_remover.h
+++ b/chromium/content/public/browser/browsing_data_remover.h
@@ -168,7 +168,7 @@ class BrowsingDataRemover {
 
   // Like Remove(), but in case of URL-keyed only removes data whose URL match
   // |filter_builder| (e.g. are on certain origin or domain).
-  // RemoveWithFilter() currently only works with FILTERABLE_DATATYPES.
+  // RemoveWithFilter() currently only works with FILTERABLE_DATA_TYPES.
   virtual void RemoveWithFilter(
       const base::Time& delete_begin,
       const base::Time& delete_end,
diff --git a/chromium/content/public/browser/child_process_data.h b/chromium/content/public/browser/child_process_data.h
index 9c19261ca4f..887d06dd084 100644
--- a/chromium/content/public/browser/child_process_data.h
+++ b/chromium/content/public/browser/child_process_data.h
@@ -21,6 +21,9 @@ struct ChildProcessData {
   // for workers it might be the domain that it's from.
   base::string16 name;
 
+  // The non-localized name of the process used for metrics reporting.
+  std::string metrics_name;
+
   // The unique identifier for this child process. This identifier is NOT a
   // process ID, and will be unique for all types of child process for
   // one run of the browser.
diff --git a/chromium/content/public/browser/child_process_security_policy.h b/chromium/content/public/browser/child_process_security_policy.h
index 9ebdbd08c7c..1c56f734cfc 100644
--- a/chromium/content/public/browser/child_process_security_policy.h
+++ b/chromium/content/public/browser/child_process_security_policy.h
@@ -162,13 +162,20 @@ class ChildProcessSecurityPolicy {
   virtual void GrantDeleteFromFileSystem(int child_id,
                                          const std::string& filesystem_id) = 0;
 
-  // Grants the child process the capability to access URLs with the provided
+  // Grants the child process the capability to commit URLs with the provided
+  // origin. Usage should be extremely rare: the content framework already
+  // automatically grants this privilege as needed on successful navigation to a
+  // URL.
+  // If you think you need this, please reach out to site-isolation-dev@ first.
+  virtual void GrantCommitOrigin(int child_id, const url::Origin& origin) = 0;
+  //
+  // Grants the child process the capability to request URLs with the provided
   // origin.
-  virtual void GrantOrigin(int child_id, const url::Origin& origin) = 0;
+  virtual void GrantRequestOrigin(int child_id, const url::Origin& origin) = 0;
 
-  // Grants the child process the capability to access URLs of the provided
+  // Grants the child process the capability to request URLs of the provided
   // scheme.
-  virtual void GrantScheme(int child_id, const std::string& scheme) = 0;
+  virtual void GrantRequestScheme(int child_id, const std::string& scheme) = 0;
 
   // Returns true if read access has been granted to |filesystem_id|.
   virtual bool CanReadFileSystem(int child_id,
@@ -205,15 +212,6 @@ class ChildProcessSecurityPolicy {
   // AddIsolatedOrigin).
   virtual bool CanAccessDataForOrigin(int child_id, const GURL& url) = 0;
 
-  // Returns true if GrantOrigin was called earlier with the same parameters.
-  //
-  // TODO(alexmos): This currently exists to support checking whether a
-  // <webview> guest process has permission to request blob URLs in its
-  // embedder's origin on the IO thread.  This should be removed once that
-  // check is superseded by a UI thread check.  See https://crbug.com/656752.
-  virtual bool HasSpecificPermissionForOrigin(int child_id,
-                                              const url::Origin& origin) = 0;
-
   // This function will check whether |origin| requires process isolation, and
   // if so, it will return true and put the most specific matching isolated
   // origin into |result|.
diff --git a/chromium/content/public/browser/child_process_termination_info.h b/chromium/content/public/browser/child_process_termination_info.h
index 37a325679b1..afd672e709d 100644
--- a/chromium/content/public/browser/child_process_termination_info.h
+++ b/chromium/content/public/browser/child_process_termination_info.h
@@ -10,6 +10,10 @@
 #include "build/build_config.h"
 #include "content/public/common/result_codes.h"
 
+#if defined(OS_ANDROID)
+#include "base/android/child_process_binding_types.h"
+#endif
+
 namespace content {
 
 struct ChildProcessTerminationInfo {
@@ -27,10 +31,16 @@ struct ChildProcessTerminationInfo {
 
 #if defined(OS_ANDROID)
   // True if child service has strong or moderate binding at time of death.
-  bool has_oom_protection_bindings = false;
+  base::android::ChildBindingState binding_state =
+      base::android::ChildBindingState::UNBOUND;
 
   // True if child service was explicitly killed by browser.
   bool was_killed_intentionally_by_browser = false;
+
+  // Counts of remaining child processes with corresponding binding.
+  int remaining_process_with_strong_binding = 0;
+  int remaining_process_with_moderate_binding = 0;
+  int remaining_process_with_waived_binding = 0;
 #endif
 };
 
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index a8927d0ba8d..2a896c7072c 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -11,6 +11,7 @@
 #include "base/guid.h"
 #include "base/logging.h"
 #include "build/build_config.h"
+#include "content/public/browser/authenticator_request_client_delegate.h"
 #include "content/public/browser/client_certificate_delegate.h"
 #include "content/public/browser/login_delegate.h"
 #include "content/public/browser/memory_coordinator_delegate.h"
@@ -20,16 +21,16 @@
 #include "content/public/browser/url_loader_request_interceptor.h"
 #include "content/public/browser/vpn_service_proxy.h"
 #include "content/public/common/url_loader_throttle.h"
-#include "device/geolocation/public/cpp/location_provider.h"
 #include "media/audio/audio_manager.h"
-#include "media/base/cdm_factory.h"
 #include "media/media_buildflags.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "net/ssl/client_cert_identity.h"
 #include "net/ssl/client_cert_store.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "services/device/public/cpp/geolocation/location_provider.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/network_service.mojom.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 #include "storage/browser/quota/quota_manager.h"
 #include "ui/gfx/image/image_skia.h"
@@ -78,6 +79,10 @@ GURL ContentBrowserClient::GetEffectiveURL(BrowserContext* browser_context,
   return url;
 }
 
+bool ContentBrowserClient::ShouldUseMobileFlingCurve() const {
+  return false;
+}
+
 bool ContentBrowserClient::ShouldUseProcessPerSite(
     BrowserContext* browser_context, const GURL& effective_url) {
   return false;
@@ -113,6 +118,11 @@ bool ContentBrowserClient::LogWebUIUrl(const GURL& web_ui_url) const {
   return false;
 }
 
+bool ContentBrowserClient::IsWebUIAllowedToMakeNetworkRequests(
+    const url::Origin& origin) {
+  return false;
+}
+
 bool ContentBrowserClient::IsHandledURL(const GURL& url) {
   return false;
 }
@@ -180,9 +190,11 @@ bool ContentBrowserClient::OverridesAudioManager() {
   return false;
 }
 
-std::unique_ptr<media::CdmFactory> ContentBrowserClient::CreateCdmFactory() {
-  return nullptr;
-}
+void ContentBrowserClient::GetHardwareSecureDecryptionCaps(
+    const std::string& key_system,
+    const base::flat_set<media::CdmProxy::Protocol>& cdm_proxy_protocols,
+    base::flat_set<media::VideoCodec>* video_codecs,
+    base::flat_set<media::EncryptionMode>* encryption_schemes) {}
 
 bool ContentBrowserClient::ShouldAssignSiteForURL(const GURL& url) {
   return true;
@@ -258,6 +270,10 @@ bool ContentBrowserClient::IsDataSaverEnabled(BrowserContext* context) {
   return false;
 }
 
+void ContentBrowserClient::UpdateRendererPreferencesForWorker(
+    BrowserContext* browser_context,
+    RendererPreferences* out_prefs) {}
+
 bool ContentBrowserClient::AllowGetCookie(const GURL& url,
                                           const GURL& first_party,
                                           const net::CookieList& cookie_list,
@@ -272,11 +288,24 @@ bool ContentBrowserClient::AllowSetCookie(const GURL& url,
                                           const net::CanonicalCookie& cookie,
                                           ResourceContext* context,
                                           int render_process_id,
-                                          int render_frame_id,
-                                          const net::CookieOptions& options) {
+                                          int render_frame_id) {
   return true;
 }
 
+void ContentBrowserClient::OnCookiesRead(int process_id,
+                                         int routing_id,
+                                         const GURL& url,
+                                         const GURL& first_party_url,
+                                         const net::CookieList& cookie_list,
+                                         bool blocked_by_policy) {}
+
+void ContentBrowserClient::OnCookieChange(int process_id,
+                                          int routing_id,
+                                          const GURL& url,
+                                          const GURL& first_party_url,
+                                          const net::CanonicalCookie& cookie,
+                                          bool blocked_by_policy) {}
+
 void ContentBrowserClient::AllowWorkerFileSystem(
     const GURL& url,
     ResourceContext* context,
@@ -345,16 +374,21 @@ ContentBrowserClient::OverrideSystemLocationProvider() {
   return nullptr;
 }
 
-void ContentBrowserClient::GetGeolocationRequestContext(
-    base::OnceCallback<void(scoped_refptr<net::URLRequestContextGetter>)>
-        callback) {
-  std::move(callback).Run(scoped_refptr<net::URLRequestContextGetter>(nullptr));
+scoped_refptr<network::SharedURLLoaderFactory>
+ContentBrowserClient::GetSystemSharedURLLoaderFactory() {
+  return nullptr;
 }
 
 std::string ContentBrowserClient::GetGeolocationApiKey() {
   return std::string();
 }
 
+#if defined(OS_ANDROID)
+bool ContentBrowserClient::ShouldUseGmsCoreGeolocationProvider() {
+  return false;
+}
+#endif
+
 std::string ContentBrowserClient::GetStoragePartitionIdForSite(
     BrowserContext* browser_context,
     const GURL& site) {
@@ -549,16 +583,14 @@ ContentBrowserClient::OutOfProcessServiceInfo::OutOfProcessServiceInfo() =
     default;
 
 ContentBrowserClient::OutOfProcessServiceInfo::OutOfProcessServiceInfo(
-    const base::string16& process_name)
-    : process_name(process_name) {
-  DCHECK(!process_name.empty());
-}
+    const ProcessNameCallback& process_name_callback)
+    : process_name_callback(process_name_callback) {}
 
 ContentBrowserClient::OutOfProcessServiceInfo::OutOfProcessServiceInfo(
-    const base::string16& process_name,
+    const ProcessNameCallback& process_name_callback,
     const std::string& process_group)
-    : process_name(process_name), process_group(process_group) {
-  DCHECK(!process_name.empty());
+    : process_name_callback(process_name_callback),
+      process_group(process_group) {
   DCHECK(!process_group.empty());
 }
 
@@ -575,6 +607,11 @@ ContentBrowserClient::GetExtraServiceManifests() {
   return std::vector<ContentBrowserClient::ServiceManifestInfo>();
 }
 
+std::vector<service_manager::Identity>
+ContentBrowserClient::GetStartupServices() {
+  return std::vector<service_manager::Identity>();
+}
+
 std::unique_ptr<MemoryCoordinatorDelegate>
 ContentBrowserClient::GetMemoryCoordinatorDelegate() {
   return std::unique_ptr<MemoryCoordinatorDelegate>();
@@ -609,12 +646,28 @@ void ContentBrowserClient::RegisterNonNetworkSubresourceURLLoaderFactories(
     NonNetworkURLLoaderFactoryMap* factories) {}
 
 bool ContentBrowserClient::WillCreateURLLoaderFactory(
+    BrowserContext* browser_context,
     RenderFrameHost* frame,
     bool is_navigation,
     network::mojom::URLLoaderFactoryRequest* factory_request) {
   return false;
 }
 
+void ContentBrowserClient::WillCreateWebSocket(
+    RenderFrameHost* frame,
+    network::mojom::WebSocketRequest* request,
+    network::mojom::AuthenticationHandlerPtr* auth_handler) {}
+
+std::vector<std::unique_ptr<URLLoaderRequestInterceptor>>
+ContentBrowserClient::WillCreateURLLoaderRequestInterceptors(
+    NavigationUIData* navigation_ui_data,
+    int frame_tree_node_id) {
+  return std::vector<std::unique_ptr<URLLoaderRequestInterceptor>>();
+}
+
+void ContentBrowserClient::OnNetworkServiceCreated(
+    network::mojom::NetworkService* network_service) {}
+
 network::mojom::NetworkContextPtr ContentBrowserClient::CreateNetworkContext(
     BrowserContext* context,
     bool in_memory,
@@ -628,7 +681,6 @@ network::mojom::NetworkContextPtr ContentBrowserClient::CreateNetworkContext(
   context_params->user_agent = GetContentClient()->GetUserAgent();
   context_params->accept_language = "en-us,en";
   context_params->enable_data_url_support = true;
-  context_params->enable_file_url_support = true;
   GetNetworkService()->CreateNetworkContext(MakeRequest(&network_context),
                                             std::move(context_params));
   return network_context;
@@ -679,22 +731,10 @@ bool ContentBrowserClient::ShouldCreateTaskScheduler() {
   return true;
 }
 
-bool ContentBrowserClient::ShouldPermitIndividualAttestationForWebauthnRPID(
-    content::BrowserContext* browser_context,
-    const std::string& rp_id) {
-  return false;
-}
-
-void ContentBrowserClient::ShouldReturnAttestationForWebauthnRPID(
-    content::RenderFrameHost* rfh,
-    const std::string& rp_id,
-    const url::Origin& origin,
-    base::OnceCallback<void(bool)> callback) {
-  std::move(callback).Run(true);
-}
-
-bool ContentBrowserClient::IsFocused(content::WebContents* web_contents) {
-  return true;
+std::unique_ptr<AuthenticatorRequestClientDelegate>
+ContentBrowserClient::GetWebAuthenticationRequestDelegate(
+    RenderFrameHost* render_frame_host) {
+  return std::make_unique<AuthenticatorRequestClientDelegate>();
 }
 
 std::unique_ptr<net::ClientCertStore>
@@ -705,8 +745,10 @@ ContentBrowserClient::CreateClientCertStore(ResourceContext* resource_context) {
 scoped_refptr<LoginDelegate> ContentBrowserClient::CreateLoginDelegate(
     net::AuthChallengeInfo* auth_info,
     content::ResourceRequestInfo::WebContentsGetter web_contents_getter,
+    const GlobalRequestID& request_id,
     bool is_request_for_main_frame,
     const GURL& url,
+    scoped_refptr<net::HttpResponseHeaders> response_headers,
     bool first_auth_attempt,
     LoginAuthRequiredCallback auth_required_callback) {
   return nullptr;
@@ -729,11 +771,4 @@ ContentBrowserClient::CreateWindowForPictureInPicture(
   return nullptr;
 }
 
-std::vector<std::unique_ptr<URLLoaderRequestInterceptor>>
-ContentBrowserClient::WillCreateURLLoaderRequestInterceptors(
-    NavigationUIData* navigation_ui_data,
-    int frame_tree_node_id) {
-  return std::vector<std::unique_ptr<URLLoaderRequestInterceptor>>();
-}
-
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index e9c6b810e05..fd5d62fee11 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -14,11 +14,13 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/containers/flat_set.h"
 #include "base/optional.h"
 #include "base/task_scheduler/task_scheduler.h"
 #include "base/values.h"
 #include "build/build_config.h"
 #include "content/public/browser/certificate_request_result_type.h"
+#include "content/public/browser/global_request_id.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/overlay_window.h"
 #include "content/public/browser/resource_request_info.h"
@@ -29,11 +31,15 @@
 #include "content/public/common/window_container_type.mojom.h"
 #include "device/usb/public/mojom/chooser_service.mojom.h"
 #include "device/usb/public/mojom/device_manager.mojom.h"
+#include "media/base/video_codecs.h"
+#include "media/cdm/cdm_proxy.h"
 #include "media/media_buildflags.h"
 #include "media/mojo/interfaces/remoting.mojom.h"
 #include "net/base/mime_util.h"
 #include "net/cookies/canonical_cookie.h"
-#include "services/network/public/mojom/network_service.mojom.h"
+#include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/mojom/network_context.mojom.h"
+#include "services/network/public/mojom/websocket.mojom.h"
 #include "services/service_manager/embedder/embedded_service_info.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
@@ -74,13 +80,17 @@ class ImageSkia;
 namespace media {
 class AudioLogFactory;
 class AudioManager;
-class CdmFactory;
+enum class EncryptionMode;
 }
 
 namespace mojo {
 class ScopedInterfaceEndpointHandle;
 }
 
+namespace network {
+class SharedURLLoaderFactory;
+}
+
 namespace service_manager {
 class Identity;
 class Service;
@@ -93,19 +103,17 @@ class AuthCredentials;
 class ClientCertIdentity;
 using ClientCertIdentityList = std::vector<std::unique_ptr<ClientCertIdentity>>;
 class ClientCertStore;
-class CookieOptions;
 class HttpRequestHeaders;
 class NetLog;
 class SSLCertRequestInfo;
 class SSLInfo;
 class URLRequest;
 class URLRequestContext;
-class URLRequestContextGetter;
 }  // namespace net
 
 namespace network {
 namespace mojom {
-class NetworkContext;
+class NetworkService;
 }
 struct ResourceRequest;
 }  // namespace network
@@ -133,6 +141,7 @@ class FileSystemBackend;
 namespace content {
 
 enum class PermissionType;
+class AuthenticatorRequestClientDelegate;
 class BrowserChildProcessHost;
 class BrowserContext;
 class BrowserMainParts;
@@ -166,6 +175,7 @@ class WebContentsViewDelegate;
 struct MainFunctionParams;
 struct OpenURLParams;
 struct Referrer;
+struct RendererPreferences;
 struct WebPreferences;
 
 CONTENT_EXPORT void OverrideOnBindInterface(
@@ -240,6 +250,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual GURL GetEffectiveURL(BrowserContext* browser_context,
                                const GURL& url);
 
+  // Returns whether gesture fling events should use the mobile-behavior gesture
+  // curve for scrolling.
+  virtual bool ShouldUseMobileFlingCurve() const;
+
   // Returns whether all instances of the specified effective URL should be
   // rendered by the same process, rather than using process-per-site-instance.
   virtual bool ShouldUseProcessPerSite(BrowserContext* browser_context,
@@ -297,6 +311,13 @@ class CONTENT_EXPORT ContentBrowserClient {
   // chrome://) URLs are logged. Returns whether the URL was actually logged.
   virtual bool LogWebUIUrl(const GURL& web_ui_url) const;
 
+  // http://crbug.com/829412
+  // Renderers with WebUI bindings shouldn't make http(s) requests for security
+  // reasons (e.g. to avoid malicious responses being able to run code in
+  // priviliged renderers). Fix these webui's to make requests through C++
+  // code instead.
+  virtual bool IsWebUIAllowedToMakeNetworkRequests(const url::Origin& origin);
+
   // Returns whether a specified URL is handled by the embedder's internal
   // protocol handlers.
   virtual bool IsHandledURL(const GURL& url);
@@ -457,6 +478,14 @@ class CONTENT_EXPORT ContentBrowserClient {
 
   virtual bool IsDataSaverEnabled(BrowserContext* context);
 
+  // Updates the given prefs for Service Worker and Shared Worker. The prefs
+  // are to be sent to the renderer process when a worker is created. Note that
+  // We don't use this method for Dedicated Workers as they inherit preferences
+  // from their closest ancestor frame.
+  virtual void UpdateRendererPreferencesForWorker(
+      BrowserContext* browser_context,
+      RendererPreferences* out_prefs);
+
   // Allow the embedder to return additional headers that should be sent when
   // fetching |url| as well as add extra load flags.
   virtual void NavigationRequestStarted(
@@ -465,6 +494,14 @@ class CONTENT_EXPORT ContentBrowserClient {
       std::unique_ptr<net::HttpRequestHeaders>* extra_headers,
       int* extra_load_flags) {}
 
+  // Allow the embedder to modify headers for a redirect. If non-nullopt,
+  // |*modified_request_headers| are applied to the request headers after
+  // updating them for the redirect.
+  virtual void NavigationRequestRedirected(
+      int frame_tree_node_id,
+      const GURL& url,
+      base::Optional<net::HttpRequestHeaders>* modified_request_headers) {}
+
   // Allow the embedder to control if the given cookie can be read.
   // This is called on the IO thread.
   virtual bool AllowGetCookie(const GURL& url,
@@ -481,8 +518,24 @@ class CONTENT_EXPORT ContentBrowserClient {
                               const net::CanonicalCookie& cookie,
                               ResourceContext* context,
                               int render_process_id,
-                              int render_frame_id,
-                              const net::CookieOptions& options);
+                              int render_frame_id);
+
+  // Notifies the embedder that an attempt has been made to read the cookies in
+  // |cookie_list|.
+  virtual void OnCookiesRead(int process_id,
+                             int routing_id,
+                             const GURL& url,
+                             const GURL& first_party_url,
+                             const net::CookieList& cookie_list,
+                             bool blocked_by_policy);
+
+  // Notifies the embedder that an attempt has been made to set |cookie|.
+  virtual void OnCookieChange(int process_id,
+                              int routing_id,
+                              const GURL& url,
+                              const GURL& first_party_url,
+                              const net::CanonicalCookie& cookie,
+                              bool blocked_by_policy);
 
   // Allow the embedder to control if access to file system by a shared worker
   // is allowed.
@@ -542,14 +595,11 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual std::unique_ptr<device::LocationProvider>
   OverrideSystemLocationProvider();
 
-  // Allows the embedder to provide a URLRequestContextGetter to use for network
-  // geolocation queries.
-  // * May be called from any thread. A URLRequestContextGetter is then provided
-  //   by invoking |callback| on the calling thread.
-  // * Default implementation provides nullptr URLRequestContextGetter.
-  virtual void GetGeolocationRequestContext(
-      base::OnceCallback<void(scoped_refptr<net::URLRequestContextGetter>)>
-          callback);
+  // Returns a SharedURLLoaderFactory attached to the system network context.
+  // Must be called on the UI thread. The default implementation returns
+  // nullptr.
+  virtual scoped_refptr<network::SharedURLLoaderFactory>
+  GetSystemSharedURLLoaderFactory();
 
   // Allows an embedder to provide a Google API Key to use for network
   // geolocation queries.
@@ -557,6 +607,11 @@ class CONTENT_EXPORT ContentBrowserClient {
   // * Default implementation returns empty string, meaning send no API key.
   virtual std::string GetGeolocationApiKey();
 
+#if defined(OS_ANDROID)
+  // Allows an embedder to decide whether to use the GmsCoreLocationProvider.
+  virtual bool ShouldUseGmsCoreGeolocationProvider();
+#endif
+
   // Allow the embedder to specify a string version of the storage partition
   // config with a site.
   virtual std::string GetStoragePartitionIdForSite(
@@ -834,15 +889,18 @@ class CONTENT_EXPORT ContentBrowserClient {
       const std::string& name,
       mojo::ScopedMessagePipeHandle* handle) {}
 
+  using ProcessNameCallback = base::RepeatingCallback<base::string16()>;
+
   struct CONTENT_EXPORT OutOfProcessServiceInfo {
     OutOfProcessServiceInfo();
-    OutOfProcessServiceInfo(const base::string16& process_name);
-    OutOfProcessServiceInfo(const base::string16& process_name,
+    OutOfProcessServiceInfo(const ProcessNameCallback& process_name_callback);
+    OutOfProcessServiceInfo(const ProcessNameCallback& process_name_callback,
                             const std::string& process_group);
     ~OutOfProcessServiceInfo();
 
-    // The display name of the service process launched for the service.
-    base::string16 process_name;
+    // The callback function to get the display name of the service process
+    // launched for the service.
+    ProcessNameCallback process_name_callback;
 
     // If provided, a string which groups this service into a process shared
     // by other services using the same string.
@@ -880,6 +938,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   // with the service manager context.
   virtual std::vector<ServiceManifestInfo> GetExtraServiceManifests();
 
+  // Allows the embedder to have a list of services started after the
+  // in-process Service Manager has been initialized.
+  virtual std::vector<service_manager::Identity> GetStartupServices();
+
   // Allows to override the visibility state of a RenderFrameHost.
   // |visibility_state| should not be null. It will only be set if needed.
   virtual void OverridePageVisibilityState(
@@ -939,9 +1001,17 @@ class CONTENT_EXPORT ContentBrowserClient {
   // returns a non-null value.
   virtual bool OverridesAudioManager();
 
-  // Creates and returns a factory used for creating CDM instances for playing
-  // protected content.
-  virtual std::unique_ptr<media::CdmFactory> CreateCdmFactory();
+  // Gets supported hardware secure |video_codecs| and |encryption_schemes| for
+  // the purpose of decrypting encrypted media using a Content Decryption Module
+  // (CDM) and a CdmProxy associated with |key_system|. The CDM supports all
+  // protocols in |cdm_proxy_protocols|, but only one CdmProxy protocol will be
+  // supported by the CdmProxy on the system, for which the capabilities will
+  // be returned.
+  virtual void GetHardwareSecureDecryptionCaps(
+      const std::string& key_system,
+      const base::flat_set<media::CdmProxy::Protocol>& cdm_proxy_protocols,
+      base::flat_set<media::VideoCodec>* video_codecs,
+      base::flat_set<media::EncryptionMode>* encryption_schemes);
 
   // Populates |mappings| with all files that need to be mapped before launching
   // a child process.
@@ -986,7 +1056,8 @@ class CONTENT_EXPORT ContentBrowserClient {
   GetTaskSchedulerInitParams();
 
   // Allows the embedder to register one or more URLLoaderThrottles for a
-  // URL request. This is used only when --enable-network-service is in effect.
+  // navigation request.
+  // This is called both when the network service is enabled and disabled.
   // This is called on the IO thread.
   virtual std::vector<std::unique_ptr<URLLoaderThrottle>>
   CreateURLLoaderThrottles(
@@ -1019,20 +1090,39 @@ class CONTENT_EXPORT ContentBrowserClient {
       NonNetworkURLLoaderFactoryMap* factories);
 
   // Allows the embedder to intercept URLLoaderFactory interfaces used for
-  // navigation or being brokered on behalf of a renderer fetching subresources.
+  // navigation or being brokered on behalf of a renderer fetching subresources,
+  // or for non-navigation requests initiated by the browser on behalf of a
+  // BrowserContext.
+  //
   // |*factory_request| is always valid upon entry and MUST be valid upon
   // return. The embedder may swap out the value of |*factory_request| for its
-  // own, in which case it must return |true| to indicate that its proxying
+  // own, in which case it must return |true| to indicate that it's proxying
   // requests for the URLLoaderFactory. Otherwise |*factory_request| is left
   // unmodified and this must return |false|.
   //
   // Always called on the UI thread and only when the Network Service is
   // enabled.
+  //
+  // Note that |frame| may be null if this is a browser-initiated,
+  // non-navigation request, e.g. a request made via
+  // |StoragePartition::GetURLLoaderFactoryForBrowserProcess()|.
   virtual bool WillCreateURLLoaderFactory(
+      BrowserContext* browser_context,
       RenderFrameHost* frame,
       bool is_navigation,
       network::mojom::URLLoaderFactoryRequest* factory_request);
 
+  // Allows the embedder to intercept a WebSocket connection. |*request|
+  // is always valid upon entry and MUST be valid upon return. The embedder
+  // may swap out the value of |*request| for its own.
+  //
+  // Always called on the UI thread and only when the Network Service is
+  // enabled.
+  virtual void WillCreateWebSocket(
+      RenderFrameHost* frame,
+      network::mojom::WebSocketRequest* request,
+      network::mojom::AuthenticationHandlerPtr* authentication_handler);
+
   // Allows the embedder to returns a list of request interceptors that can
   // intercept a navigation request.
   //
@@ -1042,6 +1132,13 @@ class CONTENT_EXPORT ContentBrowserClient {
   WillCreateURLLoaderRequestInterceptors(NavigationUIData* navigation_ui_data,
                                          int frame_tree_node_id);
 
+  // Called when the NetworkService, accessible through
+  // content::GetNetworkService(), is created. Implementations should avoid
+  // calling into GetNetworkService() again to avoid re-entrancy if the service
+  // fails to start.
+  virtual void OnNetworkServiceCreated(
+      network::mojom::NetworkService* network_service);
+
   // Creates a NetworkContext for a BrowserContext's StoragePartition. If the
   // network service is enabled, it must return a NetworkContext using the
   // network service. If the network service is disabled, the embedder may
@@ -1123,38 +1220,14 @@ class CONTENT_EXPORT ContentBrowserClient {
   // BrowserMainLoop, BrowserMainLoop itself is responsible for that.
   virtual bool ShouldCreateTaskScheduler();
 
-  // Returns true if the given Webauthn[1] RP ID[2] is permitted to receive
-  // individual attestation certificates. This a) triggers a signal to the
-  // security key that returning individual attestation certificates is
-  // permitted and b) skips any permission prompt for attestation.
-  //
-  // [1] https://www.w3.org/TR/webauthn/
-  // [2] https://www.w3.org/TR/webauthn/#relying-party-identifier
-  virtual bool ShouldPermitIndividualAttestationForWebauthnRPID(
-      content::BrowserContext* browser_context,
-      const std::string& rp_id);
-
-  // Invokes |callback| with |true| if the given Webauthn RP ID (see references
-  // above) is permitted to receive attestation certificates from a device.
-  // Otherwise invokes |callback| with |false|.
-  //
-  // Since these certificates may uniquely identify the authenticator, the
-  // embedder may choose to show a permissions prompt to the user, and only
-  // invoke |callback| afterwards. This may hairpin |callback|.
-  virtual void ShouldReturnAttestationForWebauthnRPID(
-      content::RenderFrameHost* rfh,
-      const std::string& rp_id,
-      const url::Origin& origin,
-      base::OnceCallback<void(bool)> callback);
-
-  // Returns whether |web_contents| is the active tab in the focused window.
-  // As an example, webauthn uses this because it doesn't want to allow
-  // authenticator operations to be triggered by background tabs.
-  //
-  // Note that the default implementation of this function, and the
-  // implementation in ChromeContentBrowserClient for Android, return |true| so
-  // that testing is possible.
-  virtual bool IsFocused(content::WebContents* web_contents);
+  // Returns an AuthenticatorRequestClientDelegate subclass instance to provide
+  // embedder-specific configuration for a single Web Authentication API request
+  // being serviced in a given RenderFrame. The instance is guaranteed to be
+  // destroyed before the RenderFrame goes out of scope. The embedder may choose
+  // to return nullptr to indicate that the request cannot be serviced right
+  // now.
+  virtual std::unique_ptr<AuthenticatorRequestClientDelegate>
+  GetWebAuthenticationRequestDelegate(RenderFrameHost* render_frame_host);
 
   // Get platform ClientCertStore. May return nullptr.
   virtual std::unique_ptr<net::ClientCertStore> CreateClientCertStore(
@@ -1171,8 +1244,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual scoped_refptr<LoginDelegate> CreateLoginDelegate(
       net::AuthChallengeInfo* auth_info,
       content::ResourceRequestInfo::WebContentsGetter web_contents_getter,
+      const GlobalRequestID& request_id,
       bool is_request_for_main_frame,
       const GURL& url,
+      scoped_refptr<net::HttpResponseHeaders> response_headers,
       bool first_auth_attempt,
       LoginAuthRequiredCallback auth_required_callback);
 
diff --git a/chromium/content/public/browser/devtools_agent_host_client.cc b/chromium/content/public/browser/devtools_agent_host_client.cc
new file mode 100644
index 00000000000..06c611e6737
--- /dev/null
+++ b/chromium/content/public/browser/devtools_agent_host_client.cc
@@ -0,0 +1,15 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/devtools_agent_host_client.h"
+
+namespace content {
+
+bool DevToolsAgentHostClient::MayAttachToRenderer(
+    content::RenderFrameHost* render_frame_host,
+    bool is_webui) {
+  return true;
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/devtools_agent_host_client.h b/chromium/content/public/browser/devtools_agent_host_client.h
index c8f08114876..53e560ae28e 100644
--- a/chromium/content/public/browser/devtools_agent_host_client.h
+++ b/chromium/content/public/browser/devtools_agent_host_client.h
@@ -12,6 +12,7 @@
 namespace content {
 
 class DevToolsAgentHost;
+class RenderFrameHost;
 
 // DevToolsAgentHostClient can attach to a DevToolsAgentHost and start
 // debugging it.
@@ -25,6 +26,11 @@ class CONTENT_EXPORT DevToolsAgentHostClient {
 
   // This method is called when attached agent host is closed.
   virtual void AgentHostClosed(DevToolsAgentHost* agent_host) = 0;
+
+  // Returns true if the client is allowed to attach to the given renderer.
+  // Note: this method may be called before navigation commits.
+  virtual bool MayAttachToRenderer(content::RenderFrameHost* render_frame_host,
+                                   bool is_webui);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/devtools_agent_host_observer.cc b/chromium/content/public/browser/devtools_agent_host_observer.cc
index 3020923243b..0dc6ae58a9c 100644
--- a/chromium/content/public/browser/devtools_agent_host_observer.cc
+++ b/chromium/content/public/browser/devtools_agent_host_observer.cc
@@ -32,4 +32,8 @@ void DevToolsAgentHostObserver::DevToolsAgentHostDestroyed(
     DevToolsAgentHost* agent_host) {
 }
 
+void DevToolsAgentHostObserver::DevToolsAgentHostCrashed(
+    DevToolsAgentHost* agent_host,
+    base::TerminationStatus status) {}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/devtools_agent_host_observer.h b/chromium/content/public/browser/devtools_agent_host_observer.h
index 88d345e8c2c..a971b751160 100644
--- a/chromium/content/public/browser/devtools_agent_host_observer.h
+++ b/chromium/content/public/browser/devtools_agent_host_observer.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_DEVTOOLS_AGENT_HOST_OBSERVER_H_
 #define CONTENT_PUBLIC_BROWSER_DEVTOOLS_AGENT_HOST_OBSERVER_H_
 
+#include "base/process/kill.h"
 #include "content/common/content_export.h"
 
 namespace content {
@@ -33,6 +34,10 @@ class CONTENT_EXPORT DevToolsAgentHostObserver {
   // Called when client has detached from DevToolsAgentHost.
   virtual void DevToolsAgentHostDetached(DevToolsAgentHost* agent_host);
 
+  // Called when DevToolsAgentHost crashed.
+  virtual void DevToolsAgentHostCrashed(DevToolsAgentHost* agent_host,
+                                        base::TerminationStatus status);
+
   // Called when DevToolsAgentHost was destroyed.
   virtual void DevToolsAgentHostDestroyed(DevToolsAgentHost* agent_host);
 };
diff --git a/chromium/content/public/browser/devtools_manager_delegate.cc b/chromium/content/public/browser/devtools_manager_delegate.cc
index 9d659510a10..fb839936bf4 100644
--- a/chromium/content/public/browser/devtools_manager_delegate.cc
+++ b/chromium/content/public/browser/devtools_manager_delegate.cc
@@ -22,6 +22,10 @@ std::string DevToolsManagerDelegate::GetTargetDescription(WebContents* wc) {
   return std::string();
 }
 
+bool DevToolsManagerDelegate::AllowInspectingWebContents(WebContents* wc) {
+  return true;
+}
+
 DevToolsAgentHost::List DevToolsManagerDelegate::RemoteDebuggingTargets() {
   return DevToolsAgentHost::GetOrCreateAll();
 }
diff --git a/chromium/content/public/browser/devtools_manager_delegate.h b/chromium/content/public/browser/devtools_manager_delegate.h
index b0f44feed19..d0fea8b66aa 100644
--- a/chromium/content/public/browser/devtools_manager_delegate.h
+++ b/chromium/content/public/browser/devtools_manager_delegate.h
@@ -36,6 +36,9 @@ class CONTENT_EXPORT DevToolsManagerDelegate {
   // Returns DevToolsAgentHost title to use for given |web_contents| target.
   virtual std::string GetTargetDescription(WebContents* web_contents);
 
+  // Returns whether embedder allows to inspect given |web_contents|.
+  virtual bool AllowInspectingWebContents(WebContents* web_contents);
+
   // Returns all targets embedder would like to report as debuggable
   // remotely.
   virtual DevToolsAgentHost::List RemoteDebuggingTargets();
diff --git a/chromium/content/public/browser/download_manager.h b/chromium/content/public/browser/download_manager.h
index 0708c4157d0..09476abd2f4 100644
--- a/chromium/content/public/browser/download_manager.h
+++ b/chromium/content/public/browser/download_manager.h
@@ -223,6 +223,11 @@ class CONTENT_EXPORT DownloadManager : public base::SupportsUserData::Data {
   // finish asynchronously after this method returns.
   virtual void CheckForHistoryFilesRemoval() = 0;
 
+  // Called when download history query completes. Call
+  // |load_history_downloads_cb| to load all the history downloads.
+  virtual void OnHistoryQueryComplete(
+      base::OnceClosure load_history_downloads_cb) = 0;
+
   // Get the download item for |id| if present, no matter what type of download
   // it is or state it's in.
   // DEPRECATED: Don't add new callers for GetDownload(uint32_t). Instead keep
diff --git a/chromium/content/public/browser/download_utils.h b/chromium/content/public/browser/download_utils.h
new file mode 100644
index 00000000000..af5e7ee4af0
--- /dev/null
+++ b/chromium/content/public/browser/download_utils.h
@@ -0,0 +1,28 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_DOWNLOAD_UTILS_H_
+#define CONTENT_PUBLIC_BROWSER_DOWNLOAD_UTILS_H_
+
+#include "content/common/content_export.h"
+
+#include <string>
+
+class GURL;
+namespace net {
+class HttpResponseHeaders;
+}
+
+namespace content {
+namespace download_utils {
+
+// Returns true if the given response must be downloaded because of the headers.
+CONTENT_EXPORT bool MustDownload(const GURL& url,
+                                 const net::HttpResponseHeaders* headers,
+                                 const std::string& mime_type);
+
+}  // namespace download_utils
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_DOWNLOAD_UTILS_H_
diff --git a/chromium/content/public/browser/gpu_client.h b/chromium/content/public/browser/gpu_client.h
index 77a7e386c5d..d5d249bf4f6 100644
--- a/chromium/content/public/browser/gpu_client.h
+++ b/chromium/content/public/browser/gpu_client.h
@@ -9,7 +9,6 @@
 
 #include "base/callback_forward.h"
 #include "content/common/content_export.h"
-#include "content/public/browser/browser_thread.h"
 #include "services/ui/public/interfaces/gpu.mojom.h"
 
 namespace content {
@@ -21,9 +20,10 @@ class CONTENT_EXPORT GpuClient {
 
   using ConnectionErrorHandlerClosure =
       base::OnceCallback<void(GpuClient* client)>;
-  static std::unique_ptr<GpuClient, BrowserThread::DeleteOnIOThread> Create(
+  static std::unique_ptr<GpuClient, base::OnTaskRunnerDeleter> Create(
       ui::mojom::GpuRequest request,
-      ConnectionErrorHandlerClosure connection_error_handler);
+      ConnectionErrorHandlerClosure connection_error_handler,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/gpu_utils.cc b/chromium/content/public/browser/gpu_utils.cc
index 52db4930d03..78d1c9897aa 100644
--- a/chromium/content/public/browser/gpu_utils.cc
+++ b/chromium/content/public/browser/gpu_utils.cc
@@ -14,11 +14,11 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "gpu/command_buffer/service/service_utils.h"
+#include "gpu/config/gpu_switches.h"
 #include "media/media_buildflags.h"
 
 namespace {
 
-#if defined(OS_WIN)
 bool GetUintFromSwitch(const base::CommandLine* command_line,
                        const base::StringPiece& switch_string,
                        uint32_t* value) {
@@ -27,7 +27,6 @@ bool GetUintFromSwitch(const base::CommandLine* command_line,
   std::string switch_value(command_line->GetSwitchValueASCII(switch_string));
   return base::StringToUint(switch_value, value);
 }
-#endif  // defined(OS_WIN)
 
 void RunTaskOnTaskRunner(
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
@@ -81,6 +80,8 @@ const gpu::GpuPreferences GetGpuPreferencesFromCommandLine() {
       command_line->HasSwitch(switches::kDisableSoftwareRasterizer);
   gpu_preferences.log_gpu_control_list_decisions =
       command_line->HasSwitch(switches::kLogGpuControlListDecisions);
+  GetUintFromSwitch(command_line, switches::kMaxActiveWebGLContexts,
+                    &gpu_preferences.max_active_webgl_contexts);
   gpu_preferences.gpu_startup_dialog =
       command_line->HasSwitch(switches::kGpuStartupDialog);
   gpu_preferences.disable_gpu_watchdog =
@@ -88,6 +89,15 @@ const gpu::GpuPreferences GetGpuPreferencesFromCommandLine() {
       (gpu_preferences.single_process || gpu_preferences.in_process_gpu);
   gpu_preferences.gpu_sandbox_start_early =
       command_line->HasSwitch(switches::kGpuSandboxStartEarly);
+
+  gpu_preferences.enable_oop_rasterization =
+      command_line->HasSwitch(switches::kEnableOopRasterization);
+  gpu_preferences.disable_oop_rasterization =
+      command_line->HasSwitch(switches::kDisableOopRasterization);
+
+  gpu_preferences.enable_vulkan =
+      command_line->HasSwitch(switches::kEnableVulkan);
+
   // Some of these preferences are set or adjusted in
   // GpuDataManagerImplPrivate::AppendGpuCommandLine.
   return gpu_preferences;
diff --git a/chromium/content/public/browser/gpu_utils.h b/chromium/content/public/browser/gpu_utils.h
index cc12e5b0c46..e4c9ad2c8b0 100644
--- a/chromium/content/public/browser/gpu_utils.h
+++ b/chromium/content/public/browser/gpu_utils.h
@@ -7,7 +7,7 @@
 
 #include "base/callback_forward.h"
 #include "content/common/content_export.h"
-#include "gpu/command_buffer/service/gpu_preferences.h"
+#include "gpu/config/gpu_preferences.h"
 
 namespace content {
 
diff --git a/chromium/content/public/browser/keyboard_event_processing_result.h b/chromium/content/public/browser/keyboard_event_processing_result.h
index ba43542c7ab..4030a527e7c 100644
--- a/chromium/content/public/browser/keyboard_event_processing_result.h
+++ b/chromium/content/public/browser/keyboard_event_processing_result.h
@@ -11,9 +11,6 @@ enum class KeyboardEventProcessingResult {
   // The event was handled.
   HANDLED,
 
-  // The event was handled, and we want to be notified of the keyup event too.
-  HANDLED_WANTS_KEY_UP,
-
 #if defined(USE_AURA)
   // The event was handled, but don't update the underlying event. A value
   // HANDLED results in calling ui::Event::SetHandled(), where as this does not.
diff --git a/chromium/content/public/browser/manifest_icon_selector.h b/chromium/content/public/browser/manifest_icon_selector.h
deleted file mode 100644
index e535ec07f18..00000000000
--- a/chromium/content/public/browser/manifest_icon_selector.h
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_MANIFEST_ICON_SELECTOR_H_
-#define CONTENT_PUBLIC_BROWSER_MANIFEST_ICON_SELECTOR_H_
-
-#include "base/macros.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/common/manifest/manifest.h"
-#include "url/gurl.h"
-
-namespace content {
-
-// Selects the square icon with the supported image MIME types and the specified
-// icon purpose that most closely matches the size constraints.
-// This follows very basic heuristics -- improvements are welcome.
-class CONTENT_EXPORT ManifestIconSelector {
- public:
-  // Runs the algorithm to find the best matching icon in the icons listed in
-  // the Manifest. Size is defined in pixels.
-  //
-  // Any icon returned will be close as possible to |ideal_icon_size_in_px|
-  // with a size not less than |minimum_icon_size_in_px|. Additionally, it must
-  // be square, have supported image MIME types, and have icon purpose
-  // |purpose|.
-  //
-  // Returns the icon url if a suitable icon is found. An empty URL otherwise.
-  static GURL FindBestMatchingIcon(
-      const std::vector<blink::Manifest::Icon>& icons,
-      int ideal_icon_size_in_px,
-      int minimum_icon_size_in_px,
-      blink::Manifest::Icon::IconPurpose purpose);
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(ManifestIconSelector);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_MANIFEST_ICON_SELECTOR_H_
diff --git a/chromium/content/public/browser/media_controller.h b/chromium/content/public/browser/media_controller.h
deleted file mode 100644
index 707a109e469..00000000000
--- a/chromium/content/public/browser/media_controller.h
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_MEDIA_CONTROLLER_H_
-#define CONTENT_PUBLIC_BROWSER_MEDIA_CONTROLLER_H_
-
-#include "base/time/time.h"
-
-namespace content {
-
-// High level interface that allows a controller to issue simple media commands.
-// Modeled after the media_router.mojom.MediaController interface.
-// State changes will be signaled via the MediaStatusObserver interface.
-// TODO(tguilbert): Add MediaStatusObserver interface.
-class MediaController {
- public:
-  virtual ~MediaController() = default;
-
-  // Starts playing the media if it is paused. Is a no-op if not supported by
-  // the media or the media is already playing.
-  virtual void Play() = 0;
-
-  // Pauses the media if it is playing. Is a no-op if not supported by the media
-  // or the media is already paused.
-  virtual void Pause() = 0;
-
-  // Mutes the media if |mute| is true, and unmutes it if false. Is a no-op if
-  // not supported by the media.
-  virtual void SetMute(bool mute) = 0;
-
-  // Changes the current volume of the media, with 1 being the highest and 0
-  // being the lowest/no sound. Does not change the (un)muted state of the
-  // media. Is a no-op if not supported by the media.
-  virtual void SetVolume(float volume) = 0;
-
-  // Sets the current playback position. |time| must be less than or equal to
-  // the duration of the media. Is a no-op if the media doesn't support seeking.
-  virtual void Seek(base::TimeDelta time) = 0;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_MEDIA_CONTROLLER_H_
diff --git a/chromium/content/public/browser/navigation_controller.cc b/chromium/content/public/browser/navigation_controller.cc
index f4423936060..31668bd14ef 100644
--- a/chromium/content/public/browser/navigation_controller.cc
+++ b/chromium/content/public/browser/navigation_controller.cc
@@ -20,9 +20,6 @@ NavigationController::LoadURLParams::LoadURLParams(const GURL& url)
       post_data(nullptr),
       can_load_local_resources(false),
       should_replace_current_entry(false),
-#if defined(OS_ANDROID)
-      intent_received_timestamp(0),
-#endif
       has_user_gesture(false),
       should_clear_history_list(false),
       started_from_context_menu(false),
diff --git a/chromium/content/public/browser/navigation_controller.h b/chromium/content/public/browser/navigation_controller.h
index 3e4fe938dd9..03d9b48e877 100644
--- a/chromium/content/public/browser/navigation_controller.h
+++ b/chromium/content/public/browser/navigation_controller.h
@@ -94,7 +94,7 @@ class NavigationController {
   };
 
   // Creates a navigation entry and translates the virtual url to a real one.
-  // This is a general call; prefer LoadURL[FromRenderer]/TransferURL below.
+  // This is a general call; prefer LoadURL[WithParams] below.
   // Extra headers are separated by \n.
   CONTENT_EXPORT static std::unique_ptr<NavigationEntry> CreateNavigationEntry(
       const GURL& url,
@@ -143,11 +143,6 @@ class NavigationController {
     // UserAgentOverrideOption definition.
     UserAgentOverrideOption override_user_agent;
 
-    // Marks the new navigation as being transferred from one RVH to another.
-    // In this case the browser can recycle the old request once the new
-    // renderer wants to navigate. Identifies the request ID of the old request.
-    GlobalRequestID transferred_global_request_id;
-
     // Used in LOAD_TYPE_DATA loads only. Used for specifying a base URL
     // for pages loaded via data URLs.
     GURL base_url_for_data_url;
@@ -180,13 +175,6 @@ class NavigationController {
     // navigated. This is currently only used in tests.
     std::string frame_name;
 
-#if defined(OS_ANDROID)
-    // On Android, for a load triggered by an intent, the time Chrome received
-    // the original intent that prompted the load (in milliseconds active time
-    // since boot).
-    int64_t intent_received_timestamp;
-#endif
-
     // Indicates that the navigation was triggered by a user gesture.
     bool has_user_gesture;
 
diff --git a/chromium/content/public/browser/navigation_handle.h b/chromium/content/public/browser/navigation_handle.h
index 0ee6b89e56a..2bace920726 100644
--- a/chromium/content/public/browser/navigation_handle.h
+++ b/chromium/content/public/browser/navigation_handle.h
@@ -75,12 +75,19 @@ class CONTENT_EXPORT NavigationHandle {
   // of the main frame. This remains constant over the navigation lifetime.
   virtual bool IsParentMainFrame() = 0;
 
-  // Whether the navigation was initated by the renderer process. Examples of
+  // Whether the navigation was initiated by the renderer process. Examples of
   // renderer-initiated navigations include:
   //  * <a> link click
   //  * changing window.location.href
   //  * redirect via the <meta http-equiv="refresh"> tag
   //  * using window.history.pushState
+  //
+  // This method returns false for browser-initiated navigations, including:
+  //  * any navigation initiated from the omnibox
+  //  * navigations via suggestions in browser UI
+  //  * navigations via browser UI: Ctrl-R, refresh/forward/back/home buttons
+  //  * using window.history.forward() or window.history.back()
+  //  * any other "explicit" URL navigations, e.g. bookmarks
   virtual bool IsRendererInitiated() = 0;
 
   // Returns the FrameTreeNode ID for the frame in which the navigation is
diff --git a/chromium/content/public/browser/network_connection_tracker.cc b/chromium/content/public/browser/network_connection_tracker.cc
new file mode 100644
index 00000000000..1b1612e8c6e
--- /dev/null
+++ b/chromium/content/public/browser/network_connection_tracker.cc
@@ -0,0 +1,177 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/network_connection_tracker.h"
+
+#include <utility>
+
+#include "base/task_runner.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "services/network/public/mojom/network_change_manager.mojom.h"
+#include "services/network/public/mojom/network_service.mojom.h"
+
+namespace content {
+
+namespace {
+
+// Wraps a |user_callback| when GetConnectionType() is called on a different
+// thread than NetworkConnectionTracker's thread.
+void OnGetConnectionType(
+    scoped_refptr<base::TaskRunner> task_runner,
+    NetworkConnectionTracker::ConnectionTypeCallback user_callback,
+    network::mojom::ConnectionType connection_type) {
+  task_runner->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          [](NetworkConnectionTracker::ConnectionTypeCallback callback,
+             network::mojom::ConnectionType type) {
+            std::move(callback).Run(type);
+          },
+          std::move(user_callback), connection_type));
+}
+
+static const int32_t kConnectionTypeInvalid = -1;
+
+}  // namespace
+
+NetworkConnectionTracker::NetworkConnectionTracker(
+    base::RepeatingCallback<network::mojom::NetworkService*()> callback)
+    : get_network_service_callback_(callback),
+      task_runner_(base::ThreadTaskRunnerHandle::Get()),
+      connection_type_(kConnectionTypeInvalid),
+      network_change_observer_list_(
+          new base::ObserverListThreadSafe<NetworkConnectionObserver>(
+              base::ObserverListPolicy::EXISTING_ONLY)),
+      binding_(this) {
+  Initialize();
+  DCHECK(binding_.is_bound());
+}
+
+NetworkConnectionTracker::~NetworkConnectionTracker() {
+  network_change_observer_list_->AssertEmpty();
+}
+
+bool NetworkConnectionTracker::GetConnectionType(
+    network::mojom::ConnectionType* type,
+    ConnectionTypeCallback callback) {
+  // |connection_type_| is initialized when NetworkService starts up. In most
+  // cases, it won't be kConnectionTypeInvalid and code will return early.
+  base::subtle::Atomic32 type_value =
+      base::subtle::NoBarrier_Load(&connection_type_);
+  if (type_value != kConnectionTypeInvalid) {
+    *type = static_cast<network::mojom::ConnectionType>(type_value);
+    return true;
+  }
+  base::AutoLock lock(lock_);
+  // Check again after getting the lock, and return early if
+  // OnInitialConnectionType() is called after first NoBarrier_Load.
+  type_value = base::subtle::NoBarrier_Load(&connection_type_);
+  if (type_value != kConnectionTypeInvalid) {
+    *type = static_cast<network::mojom::ConnectionType>(type_value);
+    return true;
+  }
+  if (!task_runner_->RunsTasksInCurrentSequence()) {
+    connection_type_callbacks_.push_back(base::BindOnce(
+        &OnGetConnectionType, base::SequencedTaskRunnerHandle::Get(),
+        std::move(callback)));
+  } else {
+    connection_type_callbacks_.push_back(std::move(callback));
+  }
+  return false;
+}
+
+// static
+bool NetworkConnectionTracker::IsConnectionCellular(
+    network::mojom::ConnectionType type) {
+  bool is_cellular = false;
+  switch (type) {
+    case network::mojom::ConnectionType::CONNECTION_2G:
+    case network::mojom::ConnectionType::CONNECTION_3G:
+    case network::mojom::ConnectionType::CONNECTION_4G:
+      is_cellular = true;
+      break;
+    case network::mojom::ConnectionType::CONNECTION_UNKNOWN:
+    case network::mojom::ConnectionType::CONNECTION_ETHERNET:
+    case network::mojom::ConnectionType::CONNECTION_WIFI:
+    case network::mojom::ConnectionType::CONNECTION_NONE:
+    case network::mojom::ConnectionType::CONNECTION_BLUETOOTH:
+      is_cellular = false;
+      break;
+  }
+  return is_cellular;
+}
+
+void NetworkConnectionTracker::AddNetworkConnectionObserver(
+    NetworkConnectionObserver* observer) {
+  network_change_observer_list_->AddObserver(observer);
+}
+
+void NetworkConnectionTracker::RemoveNetworkConnectionObserver(
+    NetworkConnectionObserver* observer) {
+  network_change_observer_list_->RemoveObserver(observer);
+}
+
+NetworkConnectionTracker::NetworkConnectionTracker()
+    : connection_type_(kConnectionTypeInvalid),
+      network_change_observer_list_(
+          new base::ObserverListThreadSafe<NetworkConnectionObserver>(
+              base::ObserverListPolicy::EXISTING_ONLY)),
+      binding_(this) {}
+
+void NetworkConnectionTracker::OnInitialConnectionType(
+    network::mojom::ConnectionType type) {
+  base::AutoLock lock(lock_);
+  base::subtle::NoBarrier_Store(&connection_type_,
+                                static_cast<base::subtle::Atomic32>(type));
+  while (!connection_type_callbacks_.empty()) {
+    std::move(connection_type_callbacks_.front()).Run(type);
+    connection_type_callbacks_.pop_front();
+  }
+}
+
+void NetworkConnectionTracker::OnNetworkChanged(
+    network::mojom::ConnectionType type) {
+  base::subtle::NoBarrier_Store(&connection_type_,
+                                static_cast<base::subtle::Atomic32>(type));
+  network_change_observer_list_->Notify(
+      FROM_HERE, &NetworkConnectionObserver::OnConnectionChanged, type);
+}
+
+void NetworkConnectionTracker::Initialize() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(!binding_.is_bound());
+
+  network::mojom::NetworkService* network_service =
+      get_network_service_callback_.Run();
+
+  // Get NetworkChangeManagerPtr.
+  network::mojom::NetworkChangeManagerPtr manager_ptr;
+  network::mojom::NetworkChangeManagerRequest request(
+      mojo::MakeRequest(&manager_ptr));
+  network_service->GetNetworkChangeManager(std::move(request));
+
+  // Request notification from NetworkChangeManagerPtr.
+  network::mojom::NetworkChangeManagerClientPtr client_ptr;
+  network::mojom::NetworkChangeManagerClientRequest client_request(
+      mojo::MakeRequest(&client_ptr));
+  binding_.Bind(std::move(client_request));
+  manager_ptr->RequestNotifications(std::move(client_ptr));
+
+  // base::Unretained is safe as |binding_| is owned by |this|.
+  binding_.set_connection_error_handler(base::BindRepeating(
+      &NetworkConnectionTracker::HandleNetworkServicePipeBroken,
+      base::Unretained(this)));
+}
+
+void NetworkConnectionTracker::HandleNetworkServicePipeBroken() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  binding_.Close();
+  // Reset |connection_type_| to invalid, so future GetConnectionType() can be
+  // delayed after network service has restarted, and that there isn't an
+  // incorrectly cached state.
+  base::subtle::NoBarrier_Store(&connection_type_, kConnectionTypeInvalid);
+  Initialize();
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/network_connection_tracker.h b/chromium/content/public/browser/network_connection_tracker.h
new file mode 100644
index 00000000000..1eb2c8eb499
--- /dev/null
+++ b/chromium/content/public/browser/network_connection_tracker.h
@@ -0,0 +1,136 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_NETWORK_CONNECTION_TRACKER_H_
+#define CONTENT_PUBLIC_BROWSER_NETWORK_CONNECTION_TRACKER_H_
+
+#include <list>
+#include <memory>
+
+#include "base/atomicops.h"
+#include "base/callback.h"
+#include "base/gtest_prod_util.h"
+#include "base/macros.h"
+#include "base/observer_list_threadsafe.h"
+#include "base/sequence_checker.h"
+#include "base/synchronization/lock.h"
+#include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/network/public/mojom/network_change_manager.mojom.h"
+#include "services/network/public/mojom/network_service.mojom.h"
+
+namespace content {
+
+// This class subscribes to network change events from
+// network::mojom::NetworkChangeManager and propogates these notifications to
+// its NetworkConnectionObservers registered through
+// AddNetworkConnectionObserver()/RemoveNetworkConnectionObserver().
+class CONTENT_EXPORT NetworkConnectionTracker
+    : public network::mojom::NetworkChangeManagerClient {
+ public:
+  using ConnectionTypeCallback =
+      base::OnceCallback<void(network::mojom::ConnectionType)>;
+
+  class CONTENT_EXPORT NetworkConnectionObserver {
+   public:
+    // Please refer to NetworkChangeManagerClient::OnNetworkChanged for when
+    // this method is invoked.
+    virtual void OnConnectionChanged(network::mojom::ConnectionType type) = 0;
+
+   protected:
+    virtual ~NetworkConnectionObserver() {}
+  };
+
+  // Constructs a NetworkConnectionTracker. |callback| should return the network
+  // service that is in use. NetworkConnectionTracker does not need to be
+  // destroyed before the network service.
+  explicit NetworkConnectionTracker(
+      base::RepeatingCallback<network::mojom::NetworkService*()> callback);
+
+  ~NetworkConnectionTracker() override;
+
+  // If connection type can be retrieved synchronously, returns true and |type|
+  // will contain the current connection type; Otherwise, returns false and
+  // does not modify |type|, in which case, |callback| will be called on the
+  // calling thread when connection type is ready. This method is thread safe.
+  // Please also refer to net::NetworkChangeNotifier::GetConnectionType() for
+  // documentation.
+  virtual bool GetConnectionType(network::mojom::ConnectionType* type,
+                                 ConnectionTypeCallback callback);
+
+  // Returns true if |type| is a cellular connection.
+  // Returns false if |type| is CONNECTION_UNKNOWN, and thus, depending on the
+  // implementation of GetConnectionType(), it is possible that
+  // IsConnectionCellular(GetConnectionType()) returns false even if the
+  // current connection is cellular.
+  static bool IsConnectionCellular(network::mojom::ConnectionType type);
+
+  // Registers |observer| to receive notifications of network changes. The
+  // thread on which this is called is the thread on which |observer| will be
+  // called back with notifications.
+  void AddNetworkConnectionObserver(NetworkConnectionObserver* observer);
+
+  // Unregisters |observer| from receiving notifications.  This must be called
+  // on the same thread on which AddNetworkConnectionObserver() was called.
+  // All observers must be unregistered before |this| is destroyed.
+  void RemoveNetworkConnectionObserver(NetworkConnectionObserver* observer);
+
+ protected:
+  // Constructor used in testing to mock out network service.
+  NetworkConnectionTracker();
+
+  // NetworkChangeManagerClient implementation. Protected for testing.
+  void OnInitialConnectionType(network::mojom::ConnectionType type) override;
+  void OnNetworkChanged(network::mojom::ConnectionType type) override;
+
+ private:
+  FRIEND_TEST_ALL_PREFIXES(NetworkGetConnectionTest,
+                           GetConnectionTypeOnDifferentThread);
+
+  // Starts listening for connection change notifications from
+  // |network_service|. Observers may be added and GetConnectionType called, but
+  // no network information will be provided until this method is called. For
+  // unit tests, this class can be subclassed, and OnInitialConnectionType /
+  // OnNetworkChanged may be called directly, instead of providing a
+  // NetworkService.
+  void Initialize();
+
+  // Serves as a connection error handler, and is invoked when network service
+  // restarts.
+  void HandleNetworkServicePipeBroken();
+
+  // Callback to get the current network service raw mojo pointer. This is to
+  // ensure that |this| can survive crashes and restarts of network service.
+  const base::RepeatingCallback<network::mojom::NetworkService*()>
+      get_network_service_callback_;
+
+  // The task runner that |this| lives on.
+  scoped_refptr<base::SequencedTaskRunner> task_runner_;
+
+  // Protect access to |connection_type_callbacks_|.
+  base::Lock lock_;
+
+  // Saves user callback if GetConnectionType() cannot complete synchronously.
+  std::list<ConnectionTypeCallback> connection_type_callbacks_;
+
+  // |connection_type_| is set on one thread but read on many threads.
+  // The default value is -1 before OnInitialConnectionType().
+  base::subtle::Atomic32 connection_type_;
+
+  const scoped_refptr<base::ObserverListThreadSafe<NetworkConnectionObserver>>
+      network_change_observer_list_;
+
+  mojo::Binding<network::mojom::NetworkChangeManagerClient> binding_;
+
+  // Only the initialization and re-initialization of |this| are required to
+  // be bound to the same sequence.
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  DISALLOW_COPY_AND_ASSIGN(NetworkConnectionTracker);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_NETWORK_CONNECTION_TRACKER_H_
diff --git a/chromium/content/public/browser/network_connection_tracker_unittest.cc b/chromium/content/public/browser/network_connection_tracker_unittest.cc
new file mode 100644
index 00000000000..65689197fb1
--- /dev/null
+++ b/chromium/content/public/browser/network_connection_tracker_unittest.cc
@@ -0,0 +1,343 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/network_connection_tracker.h"
+
+#include "base/macros.h"
+#include "base/run_loop.h"
+#include "base/test/scoped_task_environment.h"
+#include "base/threading/thread.h"
+#include "base/threading/thread_checker.h"
+#include "net/base/mock_network_change_notifier.h"
+#include "services/network/network_service.h"
+#include "services/network/public/mojom/network_change_manager.mojom.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+class TestNetworkConnectionObserver
+    : public NetworkConnectionTracker::NetworkConnectionObserver {
+ public:
+  explicit TestNetworkConnectionObserver(NetworkConnectionTracker* tracker)
+      : num_notifications_(0),
+        tracker_(tracker),
+        run_loop_(std::make_unique<base::RunLoop>()),
+        connection_type_(network::mojom::ConnectionType::CONNECTION_UNKNOWN) {
+    tracker_->AddNetworkConnectionObserver(this);
+  }
+
+  ~TestNetworkConnectionObserver() override {
+    tracker_->RemoveNetworkConnectionObserver(this);
+  }
+
+  // Helper to synchronously get connection type from NetworkConnectionTracker.
+  network::mojom::ConnectionType GetConnectionTypeSync() {
+    network::mojom::ConnectionType type;
+    base::RunLoop run_loop;
+    bool sync = tracker_->GetConnectionType(
+        &type, base::BindOnce(
+                   &TestNetworkConnectionObserver::GetConnectionTypeCallback,
+                   &run_loop, &type));
+    if (!sync)
+      run_loop.Run();
+    return type;
+  }
+
+  // NetworkConnectionObserver implementation:
+  void OnConnectionChanged(network::mojom::ConnectionType type) override {
+    EXPECT_EQ(type, GetConnectionTypeSync());
+
+    num_notifications_++;
+    connection_type_ = type;
+    run_loop_->Quit();
+  }
+
+  size_t num_notifications() const { return num_notifications_; }
+  void WaitForNotification() {
+    run_loop_->Run();
+    run_loop_.reset(new base::RunLoop());
+  }
+
+  network::mojom::ConnectionType connection_type() const {
+    return connection_type_;
+  }
+
+ private:
+  static void GetConnectionTypeCallback(base::RunLoop* run_loop,
+                                        network::mojom::ConnectionType* out,
+                                        network::mojom::ConnectionType type) {
+    *out = type;
+    run_loop->Quit();
+  }
+
+  size_t num_notifications_;
+  NetworkConnectionTracker* tracker_;
+  std::unique_ptr<base::RunLoop> run_loop_;
+  network::mojom::ConnectionType connection_type_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestNetworkConnectionObserver);
+};
+
+// A helper class to call NetworkConnectionTracker::GetConnectionType().
+class ConnectionTypeGetter {
+ public:
+  explicit ConnectionTypeGetter(NetworkConnectionTracker* tracker)
+      : tracker_(tracker),
+        connection_type_(network::mojom::ConnectionType::CONNECTION_UNKNOWN) {}
+  ~ConnectionTypeGetter() {}
+
+  bool GetConnectionType() {
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+    return tracker_->GetConnectionType(
+        &connection_type_,
+        base::BindOnce(&ConnectionTypeGetter::OnGetConnectionType,
+                       base::Unretained(this)));
+  }
+
+  void WaitForConnectionType(
+      network::mojom::ConnectionType expected_connection_type) {
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+    run_loop_.Run();
+    EXPECT_EQ(expected_connection_type, connection_type_);
+  }
+
+  network::mojom::ConnectionType connection_type() const {
+    return connection_type_;
+  }
+
+ private:
+  void OnGetConnectionType(network::mojom::ConnectionType type) {
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+    connection_type_ = type;
+    run_loop_.Quit();
+  }
+
+  base::RunLoop run_loop_;
+  NetworkConnectionTracker* tracker_;
+  network::mojom::ConnectionType connection_type_;
+  THREAD_CHECKER(thread_checker_);
+
+  DISALLOW_COPY_AND_ASSIGN(ConnectionTypeGetter);
+};
+
+}  // namespace
+
+class NetworkConnectionTrackerTest : public testing::Test {
+ public:
+  NetworkConnectionTrackerTest() {}
+
+  ~NetworkConnectionTrackerTest() override {}
+
+  void Initialize() {
+    network::mojom::NetworkServicePtr network_service_ptr;
+    network::mojom::NetworkServiceRequest network_service_request =
+        mojo::MakeRequest(&network_service_ptr);
+    network_service_ =
+        network::NetworkService::Create(std::move(network_service_request),
+                                        /*netlog=*/nullptr);
+    tracker_ = std::make_unique<NetworkConnectionTracker>(
+        base::BindRepeating(&NetworkConnectionTrackerTest::network_service,
+                            base::Unretained(this)));
+    observer_ = std::make_unique<TestNetworkConnectionObserver>(tracker_.get());
+  }
+
+  network::mojom::NetworkService* network_service() {
+    return network_service_.get();
+  }
+
+  NetworkConnectionTracker* network_connection_tracker() {
+    return tracker_.get();
+  }
+
+  TestNetworkConnectionObserver* network_connection_observer() {
+    return observer_.get();
+  }
+
+  // Simulates a connection type change and broadcast it to observers.
+  void SimulateConnectionTypeChange(
+      net::NetworkChangeNotifier::ConnectionType type) {
+    mock_network_change_notifier_.NotifyObserversOfNetworkChangeForTests(type);
+  }
+
+  // Sets the current connection type of the mock network change notifier.
+  void SetConnectionType(net::NetworkChangeNotifier::ConnectionType type) {
+    mock_network_change_notifier_.SetConnectionType(type);
+  }
+
+ private:
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
+  net::test::MockNetworkChangeNotifier mock_network_change_notifier_;
+  std::unique_ptr<network::NetworkService> network_service_;
+  std::unique_ptr<NetworkConnectionTracker> tracker_;
+  std::unique_ptr<TestNetworkConnectionObserver> observer_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetworkConnectionTrackerTest);
+};
+
+TEST_F(NetworkConnectionTrackerTest, ObserverNotified) {
+  Initialize();
+  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_UNKNOWN,
+            network_connection_observer()->connection_type());
+
+  // Simulate a network change.
+  SimulateConnectionTypeChange(
+      net::NetworkChangeNotifier::ConnectionType::CONNECTION_3G);
+
+  network_connection_observer()->WaitForNotification();
+  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_3G,
+            network_connection_observer()->connection_type());
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(1u, network_connection_observer()->num_notifications());
+}
+
+TEST_F(NetworkConnectionTrackerTest, UnregisteredObserverNotNotified) {
+  Initialize();
+  auto network_connection_observer2 =
+      std::make_unique<TestNetworkConnectionObserver>(
+          network_connection_tracker());
+
+  // Simulate a network change.
+  SimulateConnectionTypeChange(
+      net::NetworkChangeNotifier::ConnectionType::CONNECTION_WIFI);
+
+  network_connection_observer2->WaitForNotification();
+  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_WIFI,
+            network_connection_observer2->connection_type());
+  network_connection_observer()->WaitForNotification();
+  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_WIFI,
+            network_connection_observer()->connection_type());
+  base::RunLoop().RunUntilIdle();
+
+  network_connection_observer2.reset();
+
+  // Simulate an another network change.
+  SimulateConnectionTypeChange(
+      net::NetworkChangeNotifier::ConnectionType::CONNECTION_2G);
+  network_connection_observer()->WaitForNotification();
+  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_2G,
+            network_connection_observer()->connection_type());
+  EXPECT_EQ(2u, network_connection_observer()->num_notifications());
+}
+
+TEST_F(NetworkConnectionTrackerTest, GetConnectionType) {
+  SetConnectionType(net::NetworkChangeNotifier::ConnectionType::CONNECTION_3G);
+  // Creates a  NetworkService now so it initializes a NetworkChangeManager
+  // with initial connection type as CONNECTION_3G.
+  Initialize();
+
+  ConnectionTypeGetter getter1(network_connection_tracker());
+  ConnectionTypeGetter getter2(network_connection_tracker());
+  // These two GetConnectionType() will finish asynchonously because network
+  // service is not yet set up.
+  EXPECT_FALSE(getter1.GetConnectionType());
+  EXPECT_FALSE(getter2.GetConnectionType());
+
+  getter1.WaitForConnectionType(
+      /*expected_connection_type=*/network::mojom::ConnectionType::
+          CONNECTION_3G);
+  getter2.WaitForConnectionType(
+      /*expected_connection_type=*/network::mojom::ConnectionType::
+          CONNECTION_3G);
+
+  ConnectionTypeGetter getter3(network_connection_tracker());
+  // This GetConnectionType() should finish synchronously.
+  EXPECT_TRUE(getter3.GetConnectionType());
+  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_3G,
+            getter3.connection_type());
+}
+
+// Tests that GetConnectionType returns false and doesn't modify its |type|
+// parameter when the connection type is unavailable.
+TEST_F(NetworkConnectionTrackerTest, GetConnectionTypeUnavailable) {
+  // Returns a dummy network service that has not been initialized.
+  network::mojom::NetworkServicePtr* network_service_ptr =
+      new network::mojom::NetworkServicePtr;
+
+  network::mojom::NetworkServiceRequest request =
+      mojo::MakeRequest(network_service_ptr);
+  base::RepeatingCallback<network::mojom::NetworkService*()> callback =
+      base::BindRepeating(
+          [](network::mojom::NetworkService* service) { return service; },
+          base::Unretained(network_service_ptr->get()));
+
+  auto tracker = std::make_unique<NetworkConnectionTracker>(callback);
+  auto type = network::mojom::ConnectionType::CONNECTION_3G;
+  bool sync = tracker->GetConnectionType(&type, base::DoNothing());
+
+  EXPECT_FALSE(sync);
+  EXPECT_EQ(type, network::mojom::ConnectionType::CONNECTION_3G);
+  delete network_service_ptr;
+}
+
+// Tests GetConnectionType() on a different thread.
+class NetworkGetConnectionTest : public NetworkConnectionTrackerTest {
+ public:
+  NetworkGetConnectionTest()
+      : getter_thread_("NetworkGetConnectionTestThread") {
+    getter_thread_.Start();
+    Initialize();
+  }
+
+  ~NetworkGetConnectionTest() override {}
+
+  void GetConnectionType() {
+    DCHECK(getter_thread_.task_runner()->RunsTasksInCurrentSequence());
+    getter_ =
+        std::make_unique<ConnectionTypeGetter>(network_connection_tracker());
+    EXPECT_FALSE(getter_->GetConnectionType());
+  }
+
+  void WaitForConnectionType(
+      network::mojom::ConnectionType expected_connection_type) {
+    DCHECK(getter_thread_.task_runner()->RunsTasksInCurrentSequence());
+    getter_->WaitForConnectionType(expected_connection_type);
+  }
+
+  base::Thread* getter_thread() { return &getter_thread_; }
+
+ private:
+  base::Thread getter_thread_;
+
+  // Accessed on |getter_thread_|.
+  std::unique_ptr<ConnectionTypeGetter> getter_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetworkGetConnectionTest);
+};
+
+TEST_F(NetworkGetConnectionTest, GetConnectionTypeOnDifferentThread) {
+  // Flush pending OnInitialConnectionType() notification and force |tracker| to
+  // use async for GetConnectionType() calls.
+  base::RunLoop().RunUntilIdle();
+  base::subtle::NoBarrier_Store(&network_connection_tracker()->connection_type_,
+                                -1);
+  {
+    base::RunLoop run_loop;
+    getter_thread()->task_runner()->PostTaskAndReply(
+        FROM_HERE,
+        base::BindOnce(&NetworkGetConnectionTest::GetConnectionType,
+                       base::Unretained(this)),
+        base::BindOnce([](base::RunLoop* run_loop) { run_loop->Quit(); },
+                       base::Unretained(&run_loop)));
+    run_loop.Run();
+  }
+
+  network_connection_tracker()->OnInitialConnectionType(
+      network::mojom::ConnectionType::CONNECTION_3G);
+  {
+    base::RunLoop run_loop;
+    getter_thread()->task_runner()->PostTaskAndReply(
+        FROM_HERE,
+        base::BindOnce(&NetworkGetConnectionTest::WaitForConnectionType,
+                       base::Unretained(this),
+                       /*expected_connection_type=*/
+                       network::mojom::ConnectionType::CONNECTION_3G),
+        base::BindOnce([](base::RunLoop* run_loop) { run_loop->Quit(); },
+                       base::Unretained(&run_loop)));
+    run_loop.Run();
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/notification_database_data.cc b/chromium/content/public/browser/notification_database_data.cc
index b942ed93bd9..a623afec6d6 100644
--- a/chromium/content/public/browser/notification_database_data.cc
+++ b/chromium/content/public/browser/notification_database_data.cc
@@ -2,11 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/time/time.h"
 #include "content/public/browser/notification_database_data.h"
 
 namespace content {
 
-NotificationDatabaseData::NotificationDatabaseData() = default;
+NotificationDatabaseData::NotificationDatabaseData()
+    : creation_time_millis(base::Time::Now()) {}
 
 NotificationDatabaseData::NotificationDatabaseData(
     const NotificationDatabaseData& other) = default;
diff --git a/chromium/content/public/browser/notification_database_data.h b/chromium/content/public/browser/notification_database_data.h
index 8d1298f0eb1..0f8744da64f 100644
--- a/chromium/content/public/browser/notification_database_data.h
+++ b/chromium/content/public/browser/notification_database_data.h
@@ -8,6 +8,7 @@
 #include <stdint.h>
 #include <string>
 
+#include "base/optional.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "content/public/common/platform_notification_data.h"
@@ -69,14 +70,14 @@ struct CONTENT_EXPORT NotificationDatabaseData {
 
   // Amount of time, in ms, between when the notification is shown and the
   // first click.
-  base::TimeDelta time_until_first_click_millis;
+  base::Optional<base::TimeDelta> time_until_first_click_millis;
 
   // Amount of time, in ms, between when the notification is shown and the
   // last click.
-  base::TimeDelta time_until_last_click_millis;
+  base::Optional<base::TimeDelta> time_until_last_click_millis;
 
   // Amount of time, in ms, between when the notification is shown and closed.
-  base::TimeDelta time_until_close_millis;
+  base::Optional<base::TimeDelta> time_until_close_millis;
 
   // Why the notification was closed.
   ClosedReason closed_reason = ClosedReason::UNKNOWN;
diff --git a/chromium/content/public/browser/notification_event_dispatcher.h b/chromium/content/public/browser/notification_event_dispatcher.h
index 2d0b88d1902..57afa43cb7a 100644
--- a/chromium/content/public/browser/notification_event_dispatcher.h
+++ b/chromium/content/public/browser/notification_event_dispatcher.h
@@ -26,6 +26,7 @@ class CONTENT_EXPORT NotificationEventDispatcher {
  public:
   static NotificationEventDispatcher* GetInstance();
 
+  using NotificationClickEventCallback = base::OnceCallback<void(bool)>;
   using NotificationDispatchCompleteCallback =
       base::OnceCallback<void(PersistentNotificationStatus)>;
 
@@ -59,7 +60,8 @@ class CONTENT_EXPORT NotificationEventDispatcher {
   virtual void DispatchNonPersistentShowEvent(
       const std::string& notification_id) = 0;
   virtual void DispatchNonPersistentClickEvent(
-      const std::string& notification_id) = 0;
+      const std::string& notification_id,
+      NotificationClickEventCallback callback) = 0;
   virtual void DispatchNonPersistentCloseEvent(
       const std::string& notification_id,
       base::OnceClosure completed_closure) = 0;
diff --git a/chromium/content/public/browser/notification_registrar.cc b/chromium/content/public/browser/notification_registrar.cc
index 189008957cb..5fed6a27595 100644
--- a/chromium/content/public/browser/notification_registrar.cc
+++ b/chromium/content/public/browser/notification_registrar.cc
@@ -9,6 +9,7 @@
 #include <algorithm>
 
 #include "base/logging.h"
+#include "base/stl_util.h"
 #include "content/browser/notification_service_impl.h"
 
 namespace content {
@@ -62,8 +63,8 @@ void NotificationRegistrar::Remove(NotificationObserver* observer,
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   Record record = { observer, type, source };
-  RecordVector::iterator found = std::find(
-      registered_.begin(), registered_.end(), record);
+  RecordVector::iterator found =
+      std::find(registered_.begin(), registered_.end(), record);
   DCHECK(found != registered_.end());
 
   registered_.erase(found);
@@ -109,8 +110,7 @@ bool NotificationRegistrar::IsRegistered(NotificationObserver* observer,
                                          const NotificationSource& source) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   Record record = { observer, type, source };
-  return std::find(registered_.begin(), registered_.end(), record) !=
-      registered_.end();
+  return base::ContainsValue(registered_, record);
 }
 
 }  // namespace content
diff --git a/chromium/content/public/browser/overlay_window.h b/chromium/content/public/browser/overlay_window.h
index 553fc063922..8f04e7e4e63 100644
--- a/chromium/content/public/browser/overlay_window.h
+++ b/chromium/content/public/browser/overlay_window.h
@@ -27,6 +27,12 @@ class PictureInPictureWindowController;
 // browser windows.
 class OverlayWindow {
  public:
+  enum PlaybackState {
+    kPlaying = 0,
+    kPaused,
+    kNoVideo,
+  };
+
   OverlayWindow() = default;
   virtual ~OverlayWindow() = default;
 
@@ -45,16 +51,14 @@ class OverlayWindow {
   // Retrieves the window's current bounds, including its window.
   virtual gfx::Rect GetBounds() const = 0;
   virtual void UpdateVideoSize(const gfx::Size& natural_size) = 0;
+  virtual void SetPlaybackState(PlaybackState playback_state) = 0;
 
-  // Retrieve the ui::Layers corresponding to the video and controls.
+  // Retrieves the ui::Layers corresponding to the window and video.
+  virtual ui::Layer* GetWindowBackgroundLayer() = 0;
   virtual ui::Layer* GetVideoLayer() = 0;
-  virtual ui::Layer* GetControlsBackgroundLayer() = 0;
-  virtual ui::Layer* GetCloseControlsLayer() = 0;
-  virtual ui::Layer* GetPlayPauseControlsLayer() = 0;
 
-  // Retrieves the bounds of the media controls.
-  virtual gfx::Rect GetCloseControlsBounds() = 0;
-  virtual gfx::Rect GetPlayPauseControlsBounds() = 0;
+  // Retrieves the bounds of the video.
+  virtual gfx::Rect GetVideoBounds() = 0;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(OverlayWindow);
diff --git a/chromium/content/public/browser/permission_controller.h b/chromium/content/public/browser/permission_controller.h
new file mode 100644
index 00000000000..de585e5a8e1
--- /dev/null
+++ b/chromium/content/public/browser/permission_controller.h
@@ -0,0 +1,51 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_H_
+#define CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_H_
+
+#include "base/supports_user_data.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/permission_type.h"
+#include "third_party/blink/public/platform/modules/permissions/permission_status.mojom.h"
+
+class GURL;
+
+namespace content {
+class RenderFrameHost;
+
+// This class allows the content layer to manipulate permissions. It's behavior
+// is defined by the embedder via PermissionControllerDelegate implementation.
+class CONTENT_EXPORT PermissionController
+    : public base::SupportsUserData::Data {
+ public:
+  // Constant retured when registering and subscribing if
+  // cancelling/unsubscribing at a later stage would have no effect.
+  static const int kNoPendingOperation = -1;
+
+  ~PermissionController() override{};
+
+  // Returns the permission status of a given requesting_origin/embedding_origin
+  // tuple. This is not taking a RenderFrameHost because the call might happen
+  // outside of a frame context. Prefer GetPermissionStatusForFrame (below)
+  // whenever possible.
+  virtual blink::mojom::PermissionStatus GetPermissionStatus(
+      PermissionType permission,
+      const GURL& requesting_origin,
+      const GURL& embedding_origin) = 0;
+
+  // Returns the permission status for a given frame. Use this over
+  // GetPermissionStatus whenever possible.
+  // TODO(raymes): Currently we still pass the |requesting_origin| as a separate
+  // parameter because we can't yet guarantee that it matches the last committed
+  // origin of the RenderFrameHost. See https://crbug.com/698985.
+  virtual blink::mojom::PermissionStatus GetPermissionStatusForFrame(
+      PermissionType permission,
+      RenderFrameHost* render_frame_host,
+      const GURL& requesting_origin) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_H_
diff --git a/chromium/content/public/browser/permission_manager.h b/chromium/content/public/browser/permission_controller_delegate.h
index f96a3ca325a..2a81ed3d815 100644
--- a/chromium/content/public/browser/permission_manager.h
+++ b/chromium/content/public/browser/permission_controller_delegate.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PUBLIC_BROWSER_PERMISSION_MANAGER_H_
-#define CONTENT_PUBLIC_BROWSER_PERMISSION_MANAGER_H_
+#ifndef CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_DELEGATE_H_
+#define CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_DELEGATE_H_
 
 #include "content/common/content_export.h"
 #include "third_party/blink/public/platform/modules/permissions/permission_status.mojom.h"
@@ -14,16 +14,9 @@ namespace content {
 enum class PermissionType;
 class RenderFrameHost;
 
-// This class allows the content layer to manipulate permissions. It has to be
-// implemented by the embedder which ultimately handles the permission
-// management for the content layer.
-class CONTENT_EXPORT PermissionManager {
+class CONTENT_EXPORT PermissionControllerDelegate {
  public:
-  // Constant retured when registering and subscribing if
-  // cancelling/unsubscribing at a later stage would have no effect.
-  static const int kNoPendingOperation = -1;
-
-  virtual ~PermissionManager() = default;
+  virtual ~PermissionControllerDelegate() = default;
 
   // Requests a permission on behalf of a frame identified by
   // render_frame_host.
@@ -103,4 +96,4 @@ class CONTENT_EXPORT PermissionManager {
 
 }  // namespace content
 
-#endif // CONTENT_PUBLIC_BROWSER_PERMISSION_MANAGER_H_
+#endif  // CONTENT_PUBLIC_BROWSER_PERMISSION_CONTROLLER_DELEGATE_H_
diff --git a/chromium/content/public/browser/picture_in_picture_window_controller.h b/chromium/content/public/browser/picture_in_picture_window_controller.h
index a6292fa8e29..6df6f227d86 100644
--- a/chromium/content/public/browser/picture_in_picture_window_controller.h
+++ b/chromium/content/public/browser/picture_in_picture_window_controller.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_PICTURE_IN_PICTURE_WINDOW_CONTROLLER_H_
 #define CONTENT_PUBLIC_BROWSER_PICTURE_IN_PICTURE_WINDOW_CONTROLLER_H_
 
+#include <string>
 #include "content/common/content_export.h"
 
 namespace gfx {
@@ -37,13 +38,23 @@ class PictureInPictureWindowController {
   // Returns the size of the window in pixels.
   virtual gfx::Size Show() = 0;
 
-  virtual void Close() = 0;
+  // Called to notify the controller that the window was requested to be closed
+  // by the user or the content.
+  virtual void Close(bool should_pause_video) = 0;
+
+  // Called by the window implementation to notify the controller that the
+  // window was requested to be closed and destroyed by the system.
+  virtual void OnWindowDestroyed() = 0;
+
+  virtual void ClickCustomControl(const std::string& control_id) = 0;
   virtual void EmbedSurface(const viz::SurfaceId& surface_id,
                             const gfx::Size& natural_size) = 0;
   virtual OverlayWindow* GetWindowForTesting() = 0;
   virtual void UpdateLayerBounds() = 0;
   virtual bool IsPlayerActive() = 0;
   virtual WebContents* GetInitiatorWebContents() = 0;
+  virtual void UpdatePlaybackState(bool is_playing,
+                                   bool reached_end_of_stream) = 0;
 
   // Commands.
   // Returns true if the player is active (i.e. currently playing) after this
diff --git a/chromium/content/public/browser/platform_notification_context.h b/chromium/content/public/browser/platform_notification_context.h
index 71da1d11c7a..973fbeafe24 100644
--- a/chromium/content/public/browser/platform_notification_context.h
+++ b/chromium/content/public/browser/platform_notification_context.h
@@ -38,12 +38,31 @@ class PlatformNotificationContext
 
   using DeleteResultCallback = base::Callback<void(bool /* success */)>;
 
+  // Reasons for updating a notification, triggering a read.
+  enum class Interaction {
+    // No interaction was taken with the notification.
+    NONE,
+
+    // An action button in the notification was clicked.
+    ACTION_BUTTON_CLICKED,
+
+    // The notification itself was clicked.
+    CLICKED,
+
+    // The notification was closed.
+    CLOSED
+  };
+
   // Reads the data associated with |notification_id| belonging to |origin|
   // from the database. |callback| will be invoked with the success status
   // and a reference to the notification database data when completed.
-  virtual void ReadNotificationData(const std::string& notification_id,
-                                    const GURL& origin,
-                                    const ReadResultCallback& callback) = 0;
+  // |interaction| is passed in for UKM logging purposes and does not
+  // otherwise affect the read.
+  virtual void ReadNotificationDataAndRecordInteraction(
+      const std::string& notification_id,
+      const GURL& origin,
+      Interaction interaction,
+      const ReadResultCallback& callback) = 0;
 
   // Reads all data associated with |service_worker_registration_id| belonging
   // to |origin| from the database. |callback| will be invoked with the success
@@ -58,6 +77,7 @@ class PlatformNotificationContext
   // the notification id when written successfully. The notification ID field
   // for |database_data| will be generated, and thus must be empty.
   virtual void WriteNotificationData(
+      int64_t persistent_notification_id,
       const GURL& origin,
       const NotificationDatabaseData& database_data,
       const WriteResultCallback& callback) = 0;
diff --git a/chromium/content/public/browser/platform_notification_service.h b/chromium/content/public/browser/platform_notification_service.h
index 53fc4eb4393..228fc30240c 100644
--- a/chromium/content/public/browser/platform_notification_service.h
+++ b/chromium/content/public/browser/platform_notification_service.h
@@ -23,7 +23,6 @@ namespace content {
 class BrowserContext;
 struct NotificationResources;
 struct PlatformNotificationData;
-class ResourceContext;
 
 // The service using which notifications can be presented to the user. There
 // should be a unique instance of the PlatformNotificationService depending
@@ -36,23 +35,6 @@ class CONTENT_EXPORT PlatformNotificationService {
       base::Callback<void(std::unique_ptr<std::set<std::string>>,
                           bool /* supports synchronization */)>;
 
-  // Checks if |origin| has permission to display Web Notifications.
-  // This method must only be called on the UI thread.
-  virtual blink::mojom::PermissionStatus CheckPermissionOnUIThread(
-      BrowserContext* browser_context,
-      const GURL& origin,
-      int render_process_id) = 0;
-
-  // Checks if |origin| has permission to display Web Notifications. This method
-  // exists to serve the synchronous IPC required by the Notification.permission
-  // JavaScript getter, and should not be used for other purposes. See
-  // https://crbug.com/446497 for the plan to deprecate this method.
-  // This method must only be called on the IO thread.
-  virtual blink::mojom::PermissionStatus CheckPermissionOnIOThread(
-      ResourceContext* resource_context,
-      const GURL& origin,
-      int render_process_id) = 0;
-
   // Displays the notification described in |notification_data| to the user.
   // This method must be called on the UI thread.
   virtual void DisplayNotification(
@@ -88,6 +70,11 @@ class CONTENT_EXPORT PlatformNotificationService {
   virtual void GetDisplayedNotifications(
       BrowserContext* browser_context,
       const DisplayedNotificationsCallback& callback) = 0;
+
+  // Reads the value of the next persistent notification ID from the profile and
+  // increments the value, as it is called once per notification write.
+  virtual int64_t ReadNextPersistentNotificationId(
+      BrowserContext* browser_context) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/presentation_service_delegate.h b/chromium/content/public/browser/presentation_service_delegate.h
index 4c1b22497e1..03202644b97 100644
--- a/chromium/content/public/browser/presentation_service_delegate.h
+++ b/chromium/content/public/browser/presentation_service_delegate.h
@@ -12,8 +12,8 @@
 
 #include "base/callback.h"
 #include "content/common/content_export.h"
-#include "content/public/browser/media_controller.h"
 #include "content/public/common/presentation_connection_message.h"
+#include "media/base/media_controller.h"
 #include "third_party/blink/public/platform/modules/presentation/presentation.mojom.h"
 
 namespace content {
@@ -174,7 +174,7 @@ class CONTENT_EXPORT ControllerPresentationServiceDelegate
   // |render_process_id|, |render_frame_id|: ID of originating frame.
   // |presentation_id|: The ID of the presentation for which we want a
   // Controller.
-  virtual std::unique_ptr<MediaController> GetMediaController(
+  virtual std::unique_ptr<media::MediaController> GetMediaController(
       int render_process_id,
       int render_frame_id,
       const std::string& presentation_id) = 0;
diff --git a/chromium/content/public/browser/push_messaging_service.cc b/chromium/content/public/browser/push_messaging_service.cc
index 72225f7210a..7ade5bc90bf 100644
--- a/chromium/content/public/browser/push_messaging_service.cc
+++ b/chromium/content/public/browser/push_messaging_service.cc
@@ -18,10 +18,11 @@ namespace {
 void CallStringCallbackFromIO(
     const PushMessagingService::StringCallback& callback,
     const std::vector<std::string>& data,
-    ServiceWorkerStatusCode service_worker_status) {
+    blink::ServiceWorkerStatusCode service_worker_status) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  bool success = service_worker_status == SERVICE_WORKER_OK;
-  bool not_found = service_worker_status == SERVICE_WORKER_ERROR_NOT_FOUND;
+  bool success = service_worker_status == blink::ServiceWorkerStatusCode::kOk;
+  bool not_found =
+      service_worker_status == blink::ServiceWorkerStatusCode::kErrorNotFound;
   std::string result;
   if (success) {
     DCHECK_EQ(1u, data.size());
@@ -32,7 +33,7 @@ void CallStringCallbackFromIO(
 }
 
 void CallClosureFromIO(const base::Closure& callback,
-                       ServiceWorkerStatusCode status) {
+                       blink::ServiceWorkerStatusCode status) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   BrowserThread::PostTask(BrowserThread::UI, FROM_HERE, callback);
 }
diff --git a/chromium/content/public/browser/reload_type.h b/chromium/content/public/browser/reload_type.h
index 77c6e9bd1b8..d6e66c92350 100644
--- a/chromium/content/public/browser/reload_type.h
+++ b/chromium/content/public/browser/reload_type.h
@@ -19,10 +19,10 @@ enum class ReloadType {
   BYPASSING_CACHE,
   // Reloads the current entry using the original URL used to create it.  This
   // is used for cases where the user wants to refresh a page using a different
-  // user agent after following a redirect.
-  ORIGINAL_REQUEST_URL,
-  // Reloads the current entry with previews disabled.
-  DISABLE_PREVIEWS
+  // user agent after following a redirect. It is also used in the case of an
+  // intervention (i.e., preview) being served on the page and the user
+  // requesting the page without the intervention.
+  ORIGINAL_REQUEST_URL
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/render_frame_host.h b/chromium/content/public/browser/render_frame_host.h
index f5dced5b834..5a8553521db 100644
--- a/chromium/content/public/browser/render_frame_host.h
+++ b/chromium/content/public/browser/render_frame_host.h
@@ -15,6 +15,8 @@
 #include "content/public/common/file_chooser_params.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom.h"
 #include "third_party/blink/public/mojom/page/page_visibility_state.mojom.h"
 #include "third_party/blink/public/platform/web_sudden_termination_disabler_type.h"
 #include "ui/gfx/geometry/rect.h"
@@ -24,6 +26,7 @@
 
 namespace blink {
 class AssociatedInterfaceProvider;
+struct WebMediaPlayerAction;
 namespace mojom {
 enum class FeaturePolicyFeature;
 }  // namespace mojom
@@ -198,9 +201,8 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // call are visible on screen. The call completes asynchronously by running
   // the supplied |callback| with a value of true upon successful completion and
   // false otherwise (when the frame is destroyed, detached, etc..).
-  typedef base::Callback<void(bool)> VisualStateCallback;
-  virtual void InsertVisualStateCallback(
-      const VisualStateCallback& callback) = 0;
+  using VisualStateCallback = base::OnceCallback<void(bool)>;
+  virtual void InsertVisualStateCallback(VisualStateCallback callback) = 0;
 
   // Copies the image at the location in viewport coordinates (not frame
   // coordinates) to the clipboard. If there is no image at that location, does
@@ -301,6 +303,22 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // RenderFrameHost.
   virtual void ViewSource() = 0;
 
+  // Starts pausing subresource loading on this frame and returns
+  // PauseSubresourceLoadingHandle that controls the pausing behavior.  As long
+  // as this handle is live, pausing will continue until an internal
+  // navigation happens in the frame.
+  virtual blink::mojom::PauseSubresourceLoadingHandlePtr
+  PauseSubresourceLoading() = 0;
+
+  // Run the given action on the media player location at the given point.
+  virtual void ExecuteMediaPlayerActionAtLocation(
+      const gfx::Point& location,
+      const blink::WebMediaPlayerAction& action) = 0;
+
+  // Creates a Network Service-backed factory from appropriate |NetworkContext|.
+  virtual void CreateNetworkServiceDefaultFactory(
+      network::mojom::URLLoaderFactoryRequest default_factory_request) = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/chromium/content/public/browser/render_frame_metadata_provider.h b/chromium/content/public/browser/render_frame_metadata_provider.h
index 6ee7068fcdd..3072f9c45ae 100644
--- a/chromium/content/public/browser/render_frame_metadata_provider.h
+++ b/chromium/content/public/browser/render_frame_metadata_provider.h
@@ -29,7 +29,9 @@ class CONTENT_EXPORT RenderFrameMetadataProvider {
    public:
     virtual ~Observer() {}
 
-    virtual void OnRenderFrameMetadataChanged() = 0;
+    virtual void OnRenderFrameMetadataChangedBeforeActivation(
+        const cc::RenderFrameMetadata& metadata) = 0;
+    virtual void OnRenderFrameMetadataChangedAfterActivation() = 0;
     virtual void OnRenderFrameSubmission() = 0;
 
     // Called to indicate that the viz::LocalSurfaceId within the
diff --git a/chromium/content/public/browser/render_process_host.h b/chromium/content/public/browser/render_process_host.h
index df65dddfb96..19d9c106e87 100644
--- a/chromium/content/public/browser/render_process_host.h
+++ b/chromium/content/public/browser/render_process_host.h
@@ -22,6 +22,7 @@
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_sender.h"
 #include "media/media_buildflags.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "third_party/blink/public/platform/modules/cache_storage/cache_storage.mojom.h"
 #include "ui/gfx/native_widget_types.h"
 
@@ -223,13 +224,11 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
 
   // Returns true iff the Init() was called and the process hasn't died yet.
   //
-  // Note that even if HasConnection() returns true, then (for a short duration
-  // after calling Init()) the process might not be fully spawned *yet* - e.g.
-  // IsReady() might return false and GetProcess() might still return an invalid
-  // process with a null handle.
-  //
-  // TODO(lukasza): Rename to IsInitializedAndNotDead().
-  virtual bool HasConnection() const = 0;
+  // Note that even if IsInitializedAndNotDead() returns true, then (for a short
+  // duration after calling Init()) the process might not be fully spawned
+  // *yet*.  For example - IsReady() might return false and GetProcess() might
+  // still return an invalid process with a null handle.
+  virtual bool IsInitializedAndNotDead() const = 0;
 
   // Returns the renderer channel.
   virtual IPC::ChannelProxy* GetChannel() = 0;
@@ -393,6 +392,16 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   virtual resource_coordinator::ProcessResourceCoordinator*
   GetProcessResourceCoordinator() = 0;
 
+  // Create an URLLoaderFactory for this process.
+  // When NetworkService is enabled, |request| will be bound with a new
+  // URLLoaderFactory created from the storage partition's Network Context. Note
+  // that the URLLoaderFactory returned by this method does NOT support
+  // auto-reconnect after a crash of Network Service.
+  // When NetworkService is not enabled, |request| will be bound with a
+  // URLLoaderFactory which routes requests to ResourceDispatcherHost.
+  virtual void CreateURLLoaderFactory(
+      network::mojom::URLLoaderFactoryRequest request) = 0;
+
   // Whether this process is locked out from ever being reused for sites other
   // than the ones it currently has.
   virtual void SetIsNeverSuitableForReuse() = 0;
@@ -420,6 +429,13 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // crbug.com/738634.
   virtual bool HostHasNotBeenUsed() = 0;
 
+  // Locks this RenderProcessHost to the 'origin' |lock_url|. This method is
+  // public so that it can be called from SiteInstanceImpl, and used by
+  // MockRenderProcessHost. It isn't meant to be called outside of content.
+  // TODO(creis): Rename LockToOrigin to LockToPrincipal. See
+  // https://crbug.com/846155.
+  virtual void LockToOrigin(const GURL& lock_url) = 0;
+
   // Binds |request| to the CacheStorageDispatcherHost instance. The binding is
   // sent to the IO thread. This is for internal use only, and is only exposed
   // here to support MockRenderProcessHost usage in tests.
diff --git a/chromium/content/public/browser/render_process_host_observer.h b/chromium/content/public/browser/render_process_host_observer.h
index 2cfd0cc25bd..fca52416394 100644
--- a/chromium/content/public/browser/render_process_host_observer.h
+++ b/chromium/content/public/browser/render_process_host_observer.h
@@ -27,13 +27,6 @@ class CONTENT_EXPORT RenderProcessHostObserver {
   // but may or may not be allowed.
   virtual void RenderProcessShutdownRequested(RenderProcessHost* host) {}
 
-  // This method is invoked when the process is going to exit and should not be
-  // used for further navigations. Note that this is a COURTESY callback, not
-  // guaranteed to be called for any particular process. Because this is the
-  // first step in an orderly shutdown of a render process, do not expect that
-  // a new render process will be hosted with this RenderProcessHost.
-  virtual void RenderProcessWillExit(RenderProcessHost* host) {}
-
   // This method is invoked when the process of the observed RenderProcessHost
   // exits (either normally or with a crash). To determine if the process closed
   // normally or crashed, examine the |status| parameter.
diff --git a/chromium/content/public/browser/render_view_host.h b/chromium/content/public/browser/render_view_host.h
index b42a63674ce..f376ec12e50 100644
--- a/chromium/content/public/browser/render_view_host.h
+++ b/chromium/content/public/browser/render_view_host.h
@@ -20,7 +20,6 @@ class FilePath;
 }
 
 namespace blink {
-struct WebMediaPlayerAction;
 struct WebPluginAction;
 }
 
@@ -98,12 +97,6 @@ class CONTENT_EXPORT RenderViewHost : public IPC::Sender {
   // Instructs the RenderView to send back updates to the preferred size.
   virtual void EnablePreferredSizeMode() = 0;
 
-  // Tells the renderer to perform the given action on the media player
-  // located at the given point.
-  virtual void ExecuteMediaPlayerActionAtLocation(
-      const gfx::Point& location,
-      const blink::WebMediaPlayerAction& action) = 0;
-
   // Tells the renderer to perform the given action on the plugin located at
   // the given point.
   virtual void ExecutePluginActionAtLocation(
diff --git a/chromium/content/public/browser/render_widget_host.h b/chromium/content/public/browser/render_widget_host.h
index f547b65c75b..29e577f2c4c 100644
--- a/chromium/content/public/browser/render_widget_host.h
+++ b/chromium/content/public/browser/render_widget_host.h
@@ -7,6 +7,9 @@
 
 #include <stdint.h>
 
+#include <memory>
+#include <vector>
+
 #include "base/callback.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/native_web_keyboard_event.h"
@@ -195,14 +198,6 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   // Returns true if the renderer is loading, false if not.
   virtual bool IsLoading() const = 0;
 
-  // Restart the active hang monitor timeout if the renderer is actively
-  // waiting on a response. Clears all existing timeouts and starts with
-  // a new one.  This can be because the renderer has become
-  // active, the tab is being hidden, or the user has chosen to wait some more
-  // to give the tab a chance to become active and we don't want to display a
-  // warning too soon.
-  virtual void RestartHangMonitorTimeoutIfNecessary() = 0;
-
   // Returns true if the renderer is considered unresponsive.
   virtual bool IsCurrentlyUnresponsive() const = 0;
 
@@ -264,7 +259,7 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
       const gfx::PointF& client_pt,
       const gfx::PointF& screen_pt,
       blink::WebDragOperationsMask operations_allowed,
-      int key_modifiers){};
+      int key_modifiers) {}
   virtual void DragTargetDragOver(
       const gfx::PointF& client_pt,
       const gfx::PointF& screen_pt,
@@ -281,11 +276,11 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   // either in a drop or by being cancelled.
   virtual void DragSourceEndedAt(const gfx::PointF& client_pt,
                                  const gfx::PointF& screen_pt,
-                                 blink::WebDragOperation operation){};
+                                 blink::WebDragOperation operation) {}
 
   // Notifies the renderer that we're done with the drag and drop operation.
   // This allows the renderer to reset some state.
-  virtual void DragSourceSystemDragEnded() {};
+  virtual void DragSourceSystemDragEnded() {}
 
   // Filters drop data before it is passed to RenderWidgetHost.
   virtual void FilterDropData(DropData* drop_data) {}
diff --git a/chromium/content/public/browser/render_widget_host_view.h b/chromium/content/public/browser/render_widget_host_view.h
index 0f2bbdcf4b2..c4b21150bbc 100644
--- a/chromium/content/public/browser/render_widget_host_view.h
+++ b/chromium/content/public/browser/render_widget_host_view.h
@@ -16,6 +16,7 @@
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/gfx/geometry/point_conversions.h"
 #include "ui/gfx/native_widget_types.h"
+#include "ui/gfx/range/range.h"
 
 namespace gfx {
 class Point;
@@ -140,6 +141,12 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // Returns the currently selected text.
   virtual base::string16 GetSelectedText() = 0;
 
+  // Returns the currently selected text with the text before and after it.
+  virtual base::string16 GetSurroundingText() = 0;
+
+  // Returns the range of the selection in the page.
+  virtual gfx::Range GetSelectedRange() = 0;
+
   // This only returns non-null on platforms that implement touch
   // selection editing (TSE), currently Aura and (soon) Android.
   // TODO(wjmaclean): update this comment when OOPIF TSE is implemented on
diff --git a/chromium/content/public/browser/resource_context.h b/chromium/content/public/browser/resource_context.h
index 44b829b8b61..2e0006cd5fb 100644
--- a/chromium/content/public/browser/resource_context.h
+++ b/chromium/content/public/browser/resource_context.h
@@ -9,7 +9,6 @@
 #include "content/common/content_export.h"
 
 namespace net {
-class HostResolver;
 class URLRequestContext;
 }
 
@@ -23,7 +22,6 @@ class CONTENT_EXPORT ResourceContext : public base::SupportsUserData {
  public:
   ResourceContext();
   ~ResourceContext() override;
-  virtual net::HostResolver* GetHostResolver() = 0;
 
   // DEPRECATED: This is no longer a valid given isolated apps/sites and
   // storage partitioning. This getter returns the default context associated
diff --git a/chromium/content/public/browser/resource_hints.h b/chromium/content/public/browser/resource_hints.h
index e5b293eaa3a..b02d5907d30 100644
--- a/chromium/content/public/browser/resource_hints.h
+++ b/chromium/content/public/browser/resource_hints.h
@@ -7,6 +7,7 @@
 
 #include "content/common/content_export.h"
 #include "net/base/completion_callback.h"
+#include "net/dns/host_resolver.h"
 #include "net/http/http_request_info.h"
 #include "url/gurl.h"
 
@@ -16,6 +17,9 @@ namespace net {
 class URLRequestContextGetter;
 }
 
+// TODO(https://crbug.com/565719): Resource hints aren't used nor implemented in
+// content/. Either the preconnect/preresolve code should be moved to content/
+// or this should be moved outside of content/.
 namespace content {
 
 // A Preconnect instance maintains state while a TCP/IP connection is made, and
@@ -35,9 +39,11 @@ CONTENT_EXPORT void PreconnectUrl(net::URLRequestContextGetter* getter,
 
 // Issues a DNS request to |url|. Note that these requests are sent to the host
 // resolver with priority net::IDLE.
-CONTENT_EXPORT int PreresolveUrl(net::URLRequestContextGetter* getter,
-                                 const GURL& url,
-                                 const net::CompletionCallback& callback);
+CONTENT_EXPORT int PreresolveUrl(
+    net::URLRequestContextGetter* getter,
+    const GURL& url,
+    const net::CompletionCallback& callback,
+    std::unique_ptr<net::HostResolver::Request>* out_req);
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/resource_request_info.h b/chromium/content/public/browser/resource_request_info.h
index dee1f061b99..c0e13fb0c39 100644
--- a/chromium/content/public/browser/resource_request_info.h
+++ b/chromium/content/public/browser/resource_request_info.h
@@ -29,6 +29,8 @@ class WebContents;
 class ResourceRequestInfo {
  public:
   // Returns the ResourceRequestInfo associated with the given URLRequest.
+  CONTENT_EXPORT static ResourceRequestInfo* ForRequest(
+      net::URLRequest* request);
   CONTENT_EXPORT static const ResourceRequestInfo* ForRequest(
       const net::URLRequest* request);
 
@@ -187,8 +189,13 @@ class ResourceRequestInfo {
   // If and why this request was canceled by DevTools. TODO(johannes): Remove.
   virtual DevToolsStatus GetDevToolsStatus() const = 0;
 
-  // For net::ERR_BLOCKED_BY_CLIENT and net::ERR_BLOCKED_BY_RESPONSE
-  // errors, this will return the reason, otherwise base::nullopt.
+  // Used to annotate requests blocked using net::ERR_BLOCKED_BY_CLIENT and
+  // net::ERR_BLOCKED_BY_RESPONSE errors, with a ResourceRequestBlockedReason.
+  virtual void SetResourceRequestBlockedReason(
+      blink::ResourceRequestBlockedReason) = 0;
+
+  // Returns the ResourceRequestBlockedReason for this request, else
+  // base::nullopt.
   virtual base::Optional<blink::ResourceRequestBlockedReason>
   GetResourceRequestBlockedReason() const = 0;
 
diff --git a/chromium/content/public/browser/service_worker_context.h b/chromium/content/public/browser/service_worker_context.h
index 9d47e82a744..a8c957a414e 100644
--- a/chromium/content/public/browser/service_worker_context.h
+++ b/chromium/content/public/browser/service_worker_context.h
@@ -63,7 +63,7 @@ class ServiceWorkerContext {
   using StartServiceWorkerForNavigationHintCallback = base::OnceCallback<void(
       StartServiceWorkerForNavigationHintResult result)>;
 
-  using StartActiveWorkerCallback =
+  using StartWorkerCallback =
       base::OnceCallback<void(int process_id, int thread_id)>;
 
   // Registers the header name which should not be passed to the ServiceWorker.
@@ -164,14 +164,14 @@ class ServiceWorkerContext {
   // be called on the UI thread.
   virtual void ClearAllServiceWorkersForTest(base::OnceClosure callback) = 0;
 
-  // Starts the active worker of the registration whose scope is |pattern|.
+  // Starts the active worker of the registration whose scope is |pattern|. If
+  // there is no active worker, starts the installing worker.
   // |info_callback| is passed the worker's render process id and thread id.
   //
   // Must be called on IO thread.
-  virtual void StartActiveWorkerForPattern(
-      const GURL& pattern,
-      StartActiveWorkerCallback info_callback,
-      base::OnceClosure failure_callback) = 0;
+  virtual void StartWorkerForPattern(const GURL& pattern,
+                                     StartWorkerCallback info_callback,
+                                     base::OnceClosure failure_callback) = 0;
 
   // Starts the service worker for |document_url|. Called when a navigation to
   // that URL is predicted to occur soon. Must be called from the UI thread. The
diff --git a/chromium/content/public/browser/site_isolation_policy.cc b/chromium/content/public/browser/site_isolation_policy.cc
index f6736b39a3b..a3df9c3912a 100644
--- a/chromium/content/public/browser/site_isolation_policy.cc
+++ b/chromium/content/public/browser/site_isolation_policy.cc
@@ -20,6 +20,8 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/resource_type.h"
+#include "services/network/public/mojom/network_service.mojom.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -67,6 +69,37 @@ SiteIsolationPolicy::IsCrossSiteDocumentBlockingEnabled() {
 }
 
 // static
+void SiteIsolationPolicy::PopulateURLLoaderFactoryParamsPtrForCORB(
+    network::mojom::URLLoaderFactoryParams* params) {
+  switch (IsCrossSiteDocumentBlockingEnabled()) {
+    case SiteIsolationPolicy::XSDB_ENABLED_UNCONDITIONALLY:
+      params->is_corb_enabled = true;
+      break;
+    case SiteIsolationPolicy::XSDB_ENABLED_IF_ISOLATED: {
+      // TODO(lukasza): Take isolate-origins into account as well.
+      params->is_corb_enabled = UseDedicatedProcessesForAllSites();
+      break;
+    }
+    case SiteIsolationPolicy::XSDB_DISABLED:
+      params->is_corb_enabled = false;
+      break;
+  }
+
+  if (!params->is_corb_enabled)
+    return;
+
+  params->corb_detachable_resource_type = RESOURCE_TYPE_PREFETCH;
+  params->corb_excluded_resource_type = RESOURCE_TYPE_PLUGIN_RESOURCE;
+
+  const char* initiator_scheme_exception =
+      GetContentClient()
+          ->browser()
+          ->GetInitatorSchemeBypassingDocumentBlocking();
+  if (initiator_scheme_exception)
+    params->corb_excluded_initiator_scheme = initiator_scheme_exception;
+}
+
+// static
 bool SiteIsolationPolicy::IsTopDocumentIsolationEnabled() {
   // --site-per-process trumps --top-document-isolation.
   if (UseDedicatedProcessesForAllSites())
diff --git a/chromium/content/public/browser/site_isolation_policy.h b/chromium/content/public/browser/site_isolation_policy.h
index e0edfc6e8ee..53d829e5fa0 100644
--- a/chromium/content/public/browser/site_isolation_policy.h
+++ b/chromium/content/public/browser/site_isolation_policy.h
@@ -13,6 +13,12 @@
 #include "content/common/content_export.h"
 #include "url/origin.h"
 
+namespace network {
+namespace mojom {
+class URLLoaderFactoryParams;
+}
+}  // namespace network
+
 namespace content {
 
 // A centralized place for making policy decisions about out-of-process iframes,
@@ -36,6 +42,11 @@ class CONTENT_EXPORT SiteIsolationPolicy {
   static CrossSiteDocumentBlockingEnabledState
   IsCrossSiteDocumentBlockingEnabled();
 
+  // Populates CORB-related (Cross-Origin Read Blocking related) parts of the
+  // URLLoaderFactoryParams depending on the current Site Isolation policy.
+  static void PopulateURLLoaderFactoryParamsPtrForCORB(
+      network::mojom::URLLoaderFactoryParams* params);
+
   // Returns true if third-party subframes of a page should be kept in a
   // different process from the main frame.
   static bool IsTopDocumentIsolationEnabled();
diff --git a/chromium/content/public/browser/speech_recognition_event_listener.h b/chromium/content/public/browser/speech_recognition_event_listener.h
index 3da7413c4b5..db7f7c0d3ce 100644
--- a/chromium/content/public/browser/speech_recognition_event_listener.h
+++ b/chromium/content/public/browser/speech_recognition_event_listener.h
@@ -6,11 +6,15 @@
 #define CONTENT_PUBLIC_BROWSER_SPEECH_RECOGNITION_EVENT_LISTENER_H_
 
 #include "content/common/content_export.h"
-#include "content/public/common/speech_recognition_result.h"
+#include "third_party/blink/public/mojom/speech/speech_recognition_result.mojom.h"
 
-namespace content {
+namespace blink {
+namespace mojom {
+class SpeechRecognitionError;
+}
+}  // namespace blink
 
-struct SpeechRecognitionError;
+namespace content {
 
 // The interface to be implemented by consumers interested in receiving
 // speech recognition events.
@@ -40,14 +44,16 @@ class CONTENT_EXPORT SpeechRecognitionEventListener {
   virtual void OnAudioEnd(int session_id) = 0;
 
   // Invoked when a result is retrieved.
-  virtual void OnRecognitionResults(int session_id,
-      const SpeechRecognitionResults& results) = 0;
+  virtual void OnRecognitionResults(
+      int session_id,
+      const std::vector<blink::mojom::SpeechRecognitionResultPtr>& results) = 0;
 
   // Invoked if there was an error while capturing or recognizing audio.
   // The recognition has already been cancelled when this call is made and
   // no more events will be raised.
-  virtual void OnRecognitionError(int session_id,
-                                  const SpeechRecognitionError& error) = 0;
+  virtual void OnRecognitionError(
+      int session_id,
+      const blink::mojom::SpeechRecognitionError& error) = 0;
 
   // Informs of a change in the captured audio level, useful if displaying
   // a microphone volume indicator while recording.
diff --git a/chromium/content/public/browser/speech_recognition_manager.h b/chromium/content/public/browser/speech_recognition_manager.h
index 10f82b91beb..d6a01f81327 100644
--- a/chromium/content/public/browser/speech_recognition_manager.h
+++ b/chromium/content/public/browser/speech_recognition_manager.h
@@ -8,7 +8,7 @@
 #include "base/callback.h"
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
-#include "content/public/common/speech_recognition_result.h"
+#include "third_party/blink/public/mojom/speech/speech_recognition_result.mojom.h"
 
 namespace content {
 
diff --git a/chromium/content/public/browser/speech_recognition_manager_delegate.h b/chromium/content/public/browser/speech_recognition_manager_delegate.h
index c8223d12701..9a7c68e71b4 100644
--- a/chromium/content/public/browser/speech_recognition_manager_delegate.h
+++ b/chromium/content/public/browser/speech_recognition_manager_delegate.h
@@ -8,7 +8,6 @@
 #include <string>
 
 #include "base/callback_forward.h"
-#include "content/public/common/speech_recognition_error.h"
 
 namespace content {
 
diff --git a/chromium/content/public/browser/speech_recognition_session_config.h b/chromium/content/public/browser/speech_recognition_session_config.h
index 9b57ba02b31..b42c1cfae8c 100644
--- a/chromium/content/public/browser/speech_recognition_session_config.h
+++ b/chromium/content/public/browser/speech_recognition_session_config.h
@@ -14,8 +14,9 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/speech_recognition_session_context.h"
 #include "content/public/browser/speech_recognition_session_preamble.h"
-#include "content/public/common/speech_recognition_grammar.mojom.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "third_party/blink/public/mojom/speech/speech_recognition_grammar.mojom.h"
 #include "url/origin.h"
 
 namespace content {
@@ -29,7 +30,7 @@ struct CONTENT_EXPORT SpeechRecognitionSessionConfig {
   ~SpeechRecognitionSessionConfig();
 
   std::string language;
-  std::vector<mojom::SpeechRecognitionGrammar> grammars;
+  std::vector<blink::mojom::SpeechRecognitionGrammar> grammars;
   url::Origin origin;
   bool filter_profanities;
   bool continuous;
@@ -39,7 +40,11 @@ struct CONTENT_EXPORT SpeechRecognitionSessionConfig {
   std::string auth_scope;
   scoped_refptr<SpeechRecognitionSessionPreamble> preamble;
   SpeechRecognitionSessionContext initial_context;
-  scoped_refptr<net::URLRequestContextGetter> url_request_context_getter;
+  scoped_refptr<network::SharedURLLoaderFactory> shared_url_loader_factory;
+  // TODO(mmenke):  Remove this dependency.
+  scoped_refptr<net::URLRequestContextGetter>
+      deprecated_url_request_context_getter;
+
   base::WeakPtr<SpeechRecognitionEventListener> event_listener;
 };
 
diff --git a/chromium/content/public/browser/ssl_host_state_delegate.h b/chromium/content/public/browser/ssl_host_state_delegate.h
index f22ab2114f6..9d8f1c2288b 100644
--- a/chromium/content/public/browser/ssl_host_state_delegate.h
+++ b/chromium/content/public/browser/ssl_host_state_delegate.h
@@ -44,7 +44,7 @@ class SSLHostStateDelegate {
   // a specified |error| type.
   virtual void AllowCert(const std::string&,
                          const net::X509Certificate& cert,
-                         net::CertStatus error) = 0;
+                         int error) = 0;
 
   // Clear allow preferences matched by |host_filter|. If the filter is null,
   // clear all preferences.
@@ -56,7 +56,7 @@ class SSLHostStateDelegate {
   // prior to this query, otherwise false.
   virtual CertJudgment QueryPolicy(const std::string& host,
                                    const net::X509Certificate& cert,
-                                   net::CertStatus error,
+                                   int error,
                                    bool* expired_previous_decision) = 0;
 
   // Records that a host has run insecure content of the given |content_type|.
diff --git a/chromium/content/public/browser/startup_data.h b/chromium/content/public/browser/startup_data.h
new file mode 100644
index 00000000000..89f0c12eee1
--- /dev/null
+++ b/chromium/content/public/browser/startup_data.h
@@ -0,0 +1,18 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_STARTUP_DATA_H_
+#define CONTENT_PUBLIC_BROWSER_STARTUP_DATA_H_
+
+namespace content {
+
+// Data that //content routes through its embedder which should be handed back
+// to //content when the embedder launches it.
+struct StartupData {
+  virtual ~StartupData() = default;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_STARTUP_DATA_H_
diff --git a/chromium/content/public/browser/storage_partition.h b/chromium/content/public/browser/storage_partition.h
index 28e2c251a11..fe4b7cc8d99 100644
--- a/chromium/content/public/browser/storage_partition.h
+++ b/chromium/content/public/browser/storage_partition.h
@@ -224,6 +224,10 @@ class CONTENT_EXPORT StoragePartition {
   // Wait until all deletions tasks are finished. For test use only.
   virtual void WaitForDeletionTasksForTesting() = 0;
 
+  // Used in tests to force the cached SharedURLLoaderFactory to be dropped, as
+  // a way to work-around https://crbug.com/857577.
+  virtual void ResetURLLoaderFactoryForBrowserProcessForTesting() {}
+
  protected:
   virtual ~StoragePartition() {}
 };
diff --git a/chromium/content/public/browser/url_data_source.cc b/chromium/content/public/browser/url_data_source.cc
index 57579e32ab7..8161895bd95 100644
--- a/chromium/content/public/browser/url_data_source.cc
+++ b/chromium/content/public/browser/url_data_source.cc
@@ -34,10 +34,9 @@ bool URLDataSource::ShouldAddContentSecurityPolicy() const {
 }
 
 std::string URLDataSource::GetContentSecurityPolicyScriptSrc() const {
-  // Specific resources require unsafe-eval in the Content Security Policy.
-  // TODO(tsepez,mfoltz): Remove 'unsafe-eval' when tests have been fixed to
-  // not use eval()/new Function().  http://crbug.com/525224
-  return "script-src chrome://resources 'self' 'unsafe-eval';";
+  // Note: Do not add 'unsafe-eval' here. Instead override CSP for the
+  // specific pages that need it, see context http://crbug.com/525224.
+  return "script-src chrome://resources 'self';";
 }
 
 std::string URLDataSource::GetContentSecurityPolicyObjectSrc() const {
diff --git a/chromium/content/public/browser/url_data_source.h b/chromium/content/public/browser/url_data_source.h
index f6b187c558f..d6eab3dae07 100644
--- a/chromium/content/public/browser/url_data_source.h
+++ b/chromium/content/public/browser/url_data_source.h
@@ -103,8 +103,8 @@ class CONTENT_EXPORT URLDataSource {
   // may be marginally better than disabling CSP outright.
   // Do not override this method without first contacting the chrome security
   // team.
-  // By default, "script-src chrome://resources 'self' 'unsafe-eval';" is added
-  // to CSP. Override to change this.
+  // By default, "script-src chrome://resources 'self';" is added to CSP.
+  // Override to change this.
   virtual std::string GetContentSecurityPolicyScriptSrc() const;
 
   // It is OK to override the following methods to a custom CSP directive
diff --git a/chromium/content/public/browser/video_capture_device_launcher.cc b/chromium/content/public/browser/video_capture_device_launcher.cc
new file mode 100644
index 00000000000..176044a145e
--- /dev/null
+++ b/chromium/content/public/browser/video_capture_device_launcher.cc
@@ -0,0 +1,19 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/video_capture_device_launcher.h"
+
+#include "content/browser/renderer_host/media/in_process_video_capture_device_launcher.h"
+
+namespace content {
+
+// static
+std::unique_ptr<VideoCaptureDeviceLauncher>
+VideoCaptureDeviceLauncher::CreateInProcessVideoCaptureDeviceLauncher(
+    scoped_refptr<base::SingleThreadTaskRunner> device_task_runner) {
+  return std::make_unique<InProcessVideoCaptureDeviceLauncher>(
+      device_task_runner, nullptr);
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/video_capture_device_launcher.h b/chromium/content/public/browser/video_capture_device_launcher.h
index aa6b849818b..d2a3f83e9ab 100644
--- a/chromium/content/public/browser/video_capture_device_launcher.h
+++ b/chromium/content/public/browser/video_capture_device_launcher.h
@@ -35,6 +35,11 @@ class CONTENT_EXPORT VideoCaptureDeviceLauncher {
 
   virtual ~VideoCaptureDeviceLauncher() {}
 
+  // Creates an InProcessVideoCaptureDeviceLauncher.
+  static std::unique_ptr<VideoCaptureDeviceLauncher>
+  CreateInProcessVideoCaptureDeviceLauncher(
+      scoped_refptr<base::SingleThreadTaskRunner> device_task_runner);
+
   // The passed-in |done_cb| must guarantee that the context relevant
   // during the asynchronous processing stays alive.
   virtual void LaunchDeviceAsync(
diff --git a/chromium/content/public/browser/web_contents.h b/chromium/content/public/browser/web_contents.h
index dee5814a247..0f82f91e437 100644
--- a/chromium/content/public/browser/web_contents.h
+++ b/chromium/content/public/browser/web_contents.h
@@ -17,6 +17,7 @@
 #include "base/process/kill.h"
 #include "base/strings/string16.h"
 #include "base/supports_user_data.h"
+#include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/invalidate_type.h"
@@ -30,6 +31,7 @@
 #include "content/public/browser/web_ui.h"
 #include "content/public/common/stop_find_action.h"
 #include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_modes.h"
 #include "ui/accessibility/ax_tree_update.h"
@@ -215,6 +217,12 @@ class WebContents : public PageNavigator,
 
     // Sandboxing flags set on the new WebContents.
     blink::WebSandboxFlags starting_sandbox_flags;
+
+    // Value used to set the last time the WebContents was made active, this is
+    // the value that'll be returned by GetLastActiveTime(). If this is left
+    // default initialized then the value is not passed on to the WebContents
+    // and GetLastActiveTime() will return the WebContents' creation time.
+    base::TimeTicks last_active_time;
   };
 
   // Creates a new WebContents.
@@ -464,7 +472,7 @@ class WebContents : public PageNavigator,
 
   // Indicates whether this tab should be considered crashed. The setter will
   // also notify the delegate when the flag is changed.
-  virtual bool IsCrashed() const  = 0;
+  virtual bool IsCrashed() const = 0;
   virtual void SetIsCrashed(base::TerminationStatus status, int error_code) = 0;
 
   virtual base::TerminationStatus GetCrashedStatus() const = 0;
@@ -477,13 +485,14 @@ class WebContents : public PageNavigator,
   // change.
   virtual void NotifyNavigationStateChanged(InvalidateTypes changed_flags) = 0;
 
-  // Notifies the WebContents that audio started or stopped being audible.
-  virtual void OnAudioStateChanged(bool is_audio_playing) = 0;
+  // Notifies the WebContents that audio state has changed. The contents is
+  // aware of all of its potential sources of audio and needs to poll them
+  // directly to determine its aggregate audio state.
+  virtual void OnAudioStateChanged() = 0;
 
   // Get/Set the last time that the WebContents was made active (either when it
   // was created or shown with WasShown()).
   virtual base::TimeTicks GetLastActiveTime() const = 0;
-  virtual void SetLastActiveTime(base::TimeTicks last_active_time) = 0;
 
   // Invoked when the WebContents becomes shown/hidden. A hidden WebContents
   // isn't painted on the screen.
@@ -530,8 +539,10 @@ class WebContents : public PageNavigator,
   // Stop any pending navigation.
   virtual void Stop() = 0;
 
-  // Freeze the current page.
-  virtual void FreezePage() = 0;
+  // Freezes or unfreezes the current page. A frozen page runs as few tasks as
+  // possible. This cannot be called when the page is visible. If the page is
+  // made visible after this is called, it is automatically unfrozen.
+  virtual void SetPageFrozen(bool frozen) = 0;
 
   // Creates a new WebContents with the same state as this one. The returned
   // heap-allocated pointer is owned by the caller.
@@ -544,6 +555,13 @@ class WebContents : public PageNavigator,
   // reloads from the network.
   virtual void ReloadLoFiImages() = 0;
 
+  // Attains PauseSubresourceLoadingHandles for each frame in the web contents.
+  // As long as these handles are not deleted, subresources will continue to be
+  // deferred until an internal navigation happens in the frame. Holding handles
+  // for deleted or re-navigated frames has no effect.
+  virtual std::vector<blink::mojom::PauseSubresourceLoadingHandlePtr>
+  PauseSubresourceLoading() = 0;
+
   // Editing commands ----------------------------------------------------------
 
   virtual void Undo() = 0;
@@ -692,9 +710,7 @@ class WebContents : public PageNavigator,
   virtual void SystemDragEnded(RenderWidgetHost* source_rwh) = 0;
 
   // The user initiated navigation to this page (as opposed to a navigation that
-  // could have been triggered without user interaction). Used to avoid
-  // uninitiated user downloads (aka carpet bombing), see DownloadRequestLimiter
-  // for details.
+  // could have been triggered without user interaction).
   virtual void NavigatedByUser() = 0;
 
   // Indicates if this tab was explicitly closed by the user (control-w, close
@@ -784,13 +800,6 @@ class WebContents : public PageNavigator,
                             bool bypass_cache,
                             ImageDownloadCallback callback) = 0;
 
-  // Returns true if the WebContents is responsible for displaying a subframe
-  // in a different process from its parent page.
-  // TODO(lazyboy): https://crbug.com/542893: this doesn't really belong here.
-  // With site isolation, this should be removed since we can then embed iframes
-  // in different processes.
-  virtual bool IsSubframe() const = 0;
-
   // Finds text on a page. |search_text| should not be empty.
   virtual void Find(int request_id,
                     const base::string16& search_text,
@@ -800,9 +809,6 @@ class WebContents : public PageNavigator,
   // (and what action to take regarding the selection).
   virtual void StopFinding(StopFindAction action) = 0;
 
-  // Returns true if audio has recently been audible from the WebContents.
-  virtual bool WasRecentlyAudible() = 0;
-
   // Returns true if audio has been audible from the WebContents since the last
   // navigation.
   virtual bool WasEverAudible() = 0;
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index b6c6478c858..9d5eb003555 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -34,10 +34,6 @@ bool WebContentsDelegate::ShouldTransferNavigation(
   return true;
 }
 
-bool WebContentsDelegate::IsPopupOrPanel(const WebContents* source) const {
-  return false;
-}
-
 bool WebContentsDelegate::CanOverscrollContent() const { return false; }
 
 bool WebContentsDelegate::ShouldSuppressDialogs(WebContents* source) {
@@ -165,11 +161,11 @@ content::ColorChooser* WebContentsDelegate::OpenColorChooser(
 void WebContentsDelegate::RequestMediaAccessPermission(
     WebContents* web_contents,
     const MediaStreamRequest& request,
-    const MediaResponseCallback& callback) {
+    MediaResponseCallback callback) {
   LOG(ERROR) << "WebContentsDelegate::RequestMediaAccessPermission: "
              << "Not supported.";
-  callback.Run(MediaStreamDevices(), MEDIA_DEVICE_NOT_SUPPORTED,
-               std::unique_ptr<MediaStreamUI>());
+  std::move(callback).Run(MediaStreamDevices(), MEDIA_DEVICE_NOT_SUPPORTED,
+                          std::unique_ptr<MediaStreamUI>());
 }
 
 bool WebContentsDelegate::CheckMediaAccessPermission(
@@ -188,11 +184,6 @@ std::string WebContentsDelegate::GetDefaultMediaDeviceID(
 }
 
 #if defined(OS_ANDROID)
-base::android::ScopedJavaLocalRef<jobject>
-WebContentsDelegate::GetContentVideoViewEmbedder() {
-  return base::android::ScopedJavaLocalRef<jobject>();
-}
-
 bool WebContentsDelegate::ShouldBlockMediaRequest(const GURL& url) {
   return false;
 }
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index 4fc457c9e41..f7e72b32ee7 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -149,13 +149,10 @@ class CONTENT_EXPORT WebContentsDelegate {
   // it needs to do.
   virtual void CloseContents(WebContents* source) {}
 
-  // Request the delegate to move this WebContents to the specified position
-  // in screen coordinates.
-  virtual void MoveContents(WebContents* source, const gfx::Rect& pos) {}
-
-  // Called to determine if the WebContents is contained in a popup window
-  // or a panel window.
-  virtual bool IsPopupOrPanel(const WebContents* source) const;
+  // Request the delegate to resize this WebContents to the specified size in
+  // screen coordinates. The embedder is free to ignore the request.
+  virtual void SetContentsBounds(WebContents* source, const gfx::Rect& bounds) {
+  }
 
   // Notification that the target URL has changed.
   virtual void UpdateTargetURL(WebContents* source,
@@ -326,13 +323,18 @@ class CONTENT_EXPORT WebContentsDelegate {
   // the WebContents that is hung, and |render_widget_host| is the
   // RenderWidgetHost that, while routing events to it, discovered the hang.
   //
+  // |hang_monitor_restarter| can be used to restart the timer used to
+  // detect the hang.  The timer is typically restarted when the renderer has
+  // become active, the tab got hidden, or the user has chosen to wait some
+  // more.
+  //
   // Useful member functions on |render_widget_host|:
   // - Getting the hung render process: GetProcess()
   // - Querying whether the process is still hung: IsCurrentlyUnresponsive()
-  // - Waiting for the process to recover on its own:
-  //     RestartHangMonitorTimeoutIfNecessary()
-  virtual void RendererUnresponsive(WebContents* source,
-                                    RenderWidgetHost* render_widget_host) {}
+  virtual void RendererUnresponsive(
+      WebContents* source,
+      RenderWidgetHost* render_widget_host,
+      base::RepeatingClosure hang_monitor_restarter) {}
 
   // Notification that a process in the WebContents is no longer hung. |source|
   // is the WebContents that was hung, and |render_widget_host| is the
@@ -470,10 +472,9 @@ class CONTENT_EXPORT WebContentsDelegate {
   // request is denied, a call should be made to |callback| with an empty list
   // of devices. |request| has the details of the request (e.g. which of audio
   // and/or video devices are requested, and lists of available devices).
-  virtual void RequestMediaAccessPermission(
-      WebContents* web_contents,
-      const MediaStreamRequest& request,
-      const MediaResponseCallback& callback);
+  virtual void RequestMediaAccessPermission(WebContents* web_contents,
+                                            const MediaStreamRequest& request,
+                                            MediaResponseCallback callback);
 
   // Checks if we have permission to access the microphone or camera. Note that
   // this does not query the user. |type| must be MEDIA_DEVICE_AUDIO_CAPTURE
@@ -489,10 +490,6 @@ class CONTENT_EXPORT WebContentsDelegate {
                                               MediaStreamType type);
 
 #if defined(OS_ANDROID)
-  // Creates a view embedding the video view.
-  virtual base::android::ScopedJavaLocalRef<jobject>
-      GetContentVideoViewEmbedder();
-
   // Returns true if the given media should be blocked to load.
   virtual bool ShouldBlockMediaRequest(const GURL& url);
 
diff --git a/chromium/content/public/browser/web_contents_observer.cc b/chromium/content/public/browser/web_contents_observer.cc
index ba1f2108c37..8f2128db8f3 100644
--- a/chromium/content/public/browser/web_contents_observer.cc
+++ b/chromium/content/public/browser/web_contents_observer.cc
@@ -24,6 +24,35 @@ WebContentsObserver::~WebContentsObserver() {
     web_contents_->RemoveObserver(this);
 }
 
+WebContentsObserver::MediaPlayerId::MediaPlayerId(
+    RenderFrameHost* render_frame_host,
+    int delegate_id)
+    : render_frame_host(render_frame_host), delegate_id(delegate_id) {}
+
+WebContentsObserver::MediaPlayerId
+WebContentsObserver::MediaPlayerId::createMediaPlayerIdForTests() {
+  return WebContentsObserver::MediaPlayerId();
+}
+
+bool WebContentsObserver::MediaPlayerId::operator==(
+    WebContentsObserver::MediaPlayerId const& other) const {
+  return render_frame_host == other.render_frame_host &&
+         delegate_id == other.delegate_id;
+}
+
+bool WebContentsObserver::MediaPlayerId::operator!=(
+    const MediaPlayerId& other) const {
+  return render_frame_host != other.render_frame_host ||
+         delegate_id != other.delegate_id;
+}
+
+bool WebContentsObserver::MediaPlayerId::operator<(
+    const MediaPlayerId& other) const {
+  if (render_frame_host == other.render_frame_host)
+    return delegate_id < other.delegate_id;
+  return render_frame_host < other.render_frame_host;
+}
+
 WebContents* WebContentsObserver::web_contents() const {
   return web_contents_;
 }
diff --git a/chromium/content/public/browser/web_contents_observer.h b/chromium/content/public/browser/web_contents_observer.h
index 9a875c6bb40..35dab314009 100644
--- a/chromium/content/public/browser/web_contents_observer.h
+++ b/chromium/content/public/browser/web_contents_observer.h
@@ -25,6 +25,13 @@
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
+#include "ui/gfx/range/range.h"
+
+namespace blink {
+namespace mojom {
+enum class ViewportFit;
+}  // namespace mojom
+}  // namespace blink
 
 namespace gfx {
 class Size;
@@ -321,9 +328,8 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // signalled through this callback includes:
   // 1) any mouse down event (blink::WebInputEvent::MouseDown);
   // 2) the start of a scroll (blink::WebInputEvent::GestureScrollBegin);
-  // 3) any raw key down event (blink::WebInputEvent::RawKeyDown);
-  // 4) any touch event (inc. scrolls) (blink::WebInputEvent::TouchStart); and
-  // 5) a browser navigation or reload (blink::WebInputEvent::Undefined).
+  // 3) any raw key down event (blink::WebInputEvent::RawKeyDown); and
+  // 4) any touch event (inc. scrolls) (blink::WebInputEvent::TouchStart).
   virtual void DidGetUserInteraction(const blink::WebInputEvent::Type type) {}
 
   // This method is invoked when a RenderViewHost of this WebContents was
@@ -353,6 +359,9 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   virtual void PepperInstanceCreated() {}
   virtual void PepperInstanceDeleted() {}
 
+  // This method is called when the viewport fit of a WebContents changes.
+  virtual void ViewportFitChanged(blink::mojom::ViewportFit value) {}
+
   // Notification that a plugin has crashed.
   // |plugin_pid| is the process ID identifying the plugin process. Note that
   // this ID is supplied by the renderer process, so should not be trusted.
@@ -404,6 +413,13 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   virtual void DidToggleFullscreenModeForTab(bool entered_fullscreen,
                                              bool will_cause_resize) {}
 
+  // Signals that |rfh| has the current fullscreen element. This is invoked
+  // when:
+  //  1) an element in this frame enters fullscreen or in nested fullscreen, or
+  //  2) after an element in a descendant frame exits fullscreen and makes
+  //     this frame own the current fullscreen element again.
+  virtual void DidAcquireFullscreen(RenderFrameHost* rfh) {}
+
   // Invoked when an interstitial page is attached or detached.
   virtual void DidAttachInterstitialPage() {}
   virtual void DidDetachInterstitialPage() {}
@@ -422,25 +438,49 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // from a render frame, but only when the accessibility mode has the
   // ui::AXMode::kWebContents flag set.
   virtual void AccessibilityEventReceived(
-      const std::vector<AXEventNotificationDetails>& details) {}
+      const AXEventNotificationDetails& details) {}
   virtual void AccessibilityLocationChangesReceived(
       const std::vector<AXLocationChangeNotificationDetails>& details) {}
 
   // Invoked when theme color is changed to |theme_color|.
   virtual void DidChangeThemeColor(SkColor theme_color) {}
 
+  // Invoked when text selection is changed.
+  virtual void DidChangeTextSelection(const base::string16& text,
+                                      const gfx::Range& range) {}
+
   // Invoked when media is playing or paused.  |id| is unique per player and per
   // RenderFrameHost.  There may be multiple players within a RenderFrameHost
   // and subsequently within a WebContents.  MediaStartedPlaying() will always
   // be followed by MediaStoppedPlaying() after player teardown.  Observers must
   // release all stored copies of |id| when MediaStoppedPlaying() is received.
+  // |has_video| and |has_audio| can both be false in cases where the media
+  // is playing muted and should be considered as inaudible for all intent and
+  // purposes.
   struct MediaPlayerInfo {
     MediaPlayerInfo(bool has_video, bool has_audio)
         : has_video(has_video), has_audio(has_audio) {}
     bool has_video;
     bool has_audio;
   };
-  using MediaPlayerId = std::pair<RenderFrameHost*, int>;
+
+  struct CONTENT_EXPORT MediaPlayerId {
+   public:
+    static MediaPlayerId createMediaPlayerIdForTests();
+
+    MediaPlayerId(RenderFrameHost* render_frame_host, int delegate_id);
+
+    bool operator==(const MediaPlayerId& other) const;
+    bool operator!=(const MediaPlayerId& other) const;
+    bool operator<(const MediaPlayerId& other) const;
+
+    RenderFrameHost* render_frame_host = nullptr;
+    int delegate_id = 0;
+
+   private:
+    MediaPlayerId() = default;
+  };
+
   virtual void MediaStartedPlaying(const MediaPlayerInfo& video_type,
                                    const MediaPlayerId& id) {}
   enum class MediaStoppedReason {
diff --git a/chromium/content/public/browser/web_contents_user_data.h b/chromium/content/public/browser/web_contents_user_data.h
index 99e114b961a..d9a776f53b3 100644
--- a/chromium/content/public/browser/web_contents_user_data.h
+++ b/chromium/content/public/browser/web_contents_user_data.h
@@ -52,26 +52,15 @@ class WebContentsUserData : public base::SupportsUserData::Data {
   }
 
  protected:
-  static inline void* UserDataKey() {
-    return &kLocatorKey;
+  static inline const void* UserDataKey() {
+    static const int kId = 0;
+    return &kId;
   }
-
- private:
-  // The user data key.
-  static int kLocatorKey;
 };
 
-// The macro to define the locator key. This key must be defined in the .cc file
-// of the tab helper otherwise different instances for different template types
-// will be collapsed by the Visual Studio linker.
-//
-// The "= 0" is surprising, but is required to effect a definition rather than
-// a declaration. Without it, this would be merely a declaration of a template
-// specialization. (C++98: 14.7.3.15; C++11: 14.7.3.13)
-//
-#define DEFINE_WEB_CONTENTS_USER_DATA_KEY(TYPE) \
-template<>                                      \
-int content::WebContentsUserData<TYPE>::kLocatorKey = 0
+// Macro previously used to define the UserDataKey().
+// TODO(fdoray): Remove this. https://crbug.com/589840
+#define DEFINE_WEB_CONTENTS_USER_DATA_KEY(TYPE)
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/web_ui.h b/chromium/content/public/browser/web_ui.h
index 4d320806901..1c46a1a3ef2 100644
--- a/chromium/content/public/browser/web_ui.h
+++ b/chromium/content/public/browser/web_ui.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_UI_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_UI_H_
 
+#include <memory>
+#include <string>
 #include <vector>
 
 #include "base/callback.h"
@@ -49,7 +51,7 @@ class CONTENT_EXPORT WebUI {
   virtual WebContents* GetWebContents() const = 0;
 
   virtual WebUIController* GetController() const = 0;
-  virtual void SetController(WebUIController* controller) = 0;
+  virtual void SetController(std::unique_ptr<WebUIController> controller) = 0;
 
   // Returns the device scale factor of the monitor that the renderer is on.
   // Whenever possible, WebUI should push resources with this scale factor to
diff --git a/chromium/content/public/browser/web_ui_controller_factory.h b/chromium/content/public/browser/web_ui_controller_factory.h
index ad45ab0920f..7c8127d2f3b 100644
--- a/chromium/content/public/browser/web_ui_controller_factory.h
+++ b/chromium/content/public/browser/web_ui_controller_factory.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_UI_CONTROLLER_FACTORY_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_UI_CONTROLLER_FACTORY_H_
 
+#include <memory>
+
 #include "content/common/content_export.h"
 #include "content/public/browser/web_ui.h"
 
@@ -28,8 +30,9 @@ class CONTENT_EXPORT WebUIControllerFactory {
 
   // Returns a WebUIController instance for the given URL, or nullptr if the URL
   // doesn't correspond to a WebUI.
-  virtual WebUIController* CreateWebUIControllerForURL(
-      WebUI* web_ui, const GURL& url) const = 0;
+  virtual std::unique_ptr<WebUIController> CreateWebUIControllerForURL(
+      WebUI* web_ui,
+      const GURL& url) const = 0;
 
   // Gets the WebUI type for the given URL. This will return kNoWebUI if the
   // corresponding call to CreateWebUIForURL would fail, or something
diff --git a/chromium/content/public/browser/webrtc_event_logger.h b/chromium/content/public/browser/webrtc_event_logger.h
index 84d68719a82..e7f29eae618 100644
--- a/chromium/content/public/browser/webrtc_event_logger.h
+++ b/chromium/content/public/browser/webrtc_event_logger.h
@@ -45,9 +45,8 @@ class CONTENT_EXPORT WebRtcEventLogger {
   // This function must not be called for an off-the-records BrowserContext.
   // Local-logging is not associated with BrowserContexts, and is allowed even
   // if EnableForBrowserContext is not called. That is, even for incognito mode.
-  virtual void EnableForBrowserContext(
-      const BrowserContext* browser_context,
-      base::OnceClosure reply = base::OnceClosure()) = 0;
+  virtual void EnableForBrowserContext(const BrowserContext* browser_context,
+                                       base::OnceClosure reply) = 0;
 
   // Disables WebRTC event logging for a given BrowserContext. New remote-bound
   // WebRTC event logs will no longer be created for this BrowserContext.
@@ -55,9 +54,8 @@ class CONTENT_EXPORT WebRtcEventLogger {
   // therefore be careful note to call any of BrowserContext's virtual methods.
   // TODO(eladalon): After changing to a Profile-centered interface, change this
   // to not even receive a pointer. https://crbug.com/775415
-  virtual void DisableForBrowserContext(
-      const BrowserContext* browser_context,
-      base::OnceClosure reply = base::OnceClosure()) = 0;
+  virtual void DisableForBrowserContext(const BrowserContext* browser_context,
+                                        base::OnceClosure reply) = 0;
 
   // Call this to let the logger know when a PeerConnection was created.
   // |peer_connection_id| should be a non-empty, relatively short (i.e.
@@ -71,8 +69,7 @@ class CONTENT_EXPORT WebRtcEventLogger {
   virtual void PeerConnectionAdded(int render_process_id,
                                    int lid,
                                    const std::string& peer_connection_id,
-                                   base::OnceCallback<void(bool)> reply =
-                                       base::OnceCallback<void(bool)>()) = 0;
+                                   base::OnceCallback<void(bool)> reply) = 0;
 
   // Call this to let the logger know when a PeerConnection was closed.
   // If a reply callback is given, it will be posted back to BrowserThread::UI,
@@ -81,8 +78,7 @@ class CONTENT_EXPORT WebRtcEventLogger {
   // or if it has since already been removed).
   virtual void PeerConnectionRemoved(int render_process_id,
                                      int lid,
-                                     base::OnceCallback<void(bool)> reply =
-                                         base::OnceCallback<void(bool)>()) = 0;
+                                     base::OnceCallback<void(bool)> reply) = 0;
 
   // Call this to let the logger know when a PeerConnection was stopped.
   // Closing of a peer connection is an irreversible action. Its distinction
@@ -90,8 +86,7 @@ class CONTENT_EXPORT WebRtcEventLogger {
   // been garbage collected.
   virtual void PeerConnectionStopped(int render_process_id,
                                      int lid,
-                                     base::OnceCallback<void(bool)> reply =
-                                         base::OnceCallback<void(bool)>()) = 0;
+                                     base::OnceCallback<void(bool)> reply) = 0;
 
   // Enable local logging of WebRTC events.
   // Local logging is distinguished from remote logging, in that local logs are
@@ -109,15 +104,13 @@ class CONTENT_EXPORT WebRtcEventLogger {
   // will get a local log file associated (specifically, we do *not* guarantee
   // it would be either the oldest or the newest).
   virtual void EnableLocalLogging(const base::FilePath& base_path,
-                                  base::OnceCallback<void(bool)> reply =
-                                      base::OnceCallback<void(bool)>()) = 0;
+                                  base::OnceCallback<void(bool)> reply) = 0;
 
   // Disable local logging of WebRTC events.
   // Any active local logs are stopped. Peer connections added after this call
   // will not get a local log associated with them (unless local logging is
   // once again enabled).
-  virtual void DisableLocalLogging(base::OnceCallback<void(bool)> reply =
-                                       base::OnceCallback<void(bool)>()) = 0;
+  virtual void DisableLocalLogging(base::OnceCallback<void(bool)> reply) = 0;
 
   // Called when a new log fragment is sent from the renderer. This will
   // potentially be written to a local WebRTC event log, a remote-bound log
@@ -131,8 +124,7 @@ class CONTENT_EXPORT WebRtcEventLogger {
       int render_process_id,
       int lid,
       const std::string& message,
-      base::OnceCallback<void(std::pair<bool, bool>)> reply =
-          base::OnceCallback<void(std::pair<bool, bool>)>()) = 0;
+      base::OnceCallback<void(std::pair<bool, bool>)> reply) = 0;
 
  protected:
   friend WebRTCInternalsIntegrationBrowserTest;  // (PostNullTaskForTesting)