BASELINE: Update Chromium to 68.0.3440.125

Change-Id: I23f19369e01f688e496f5bf179abb521ad73874f
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

78 files changed, 809 insertions, 470 deletions

diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn
index 9646d6b0555..93b61314c26 100644
--- a/chromium/content/public/browser/BUILD.gn
+++ b/chromium/content/public/browser/BUILD.gn
@@ -4,7 +4,6 @@
 
 import("//build/config/jumbo.gni")
 import("//build/config/ui.gni")
-import("//media/media_options.gni")
 
 # See //content/BUILD.gn for how this works.
 group("browser") {
@@ -38,10 +37,14 @@ jumbo_source_set("browser_sources") {
     "android/synchronous_compositor.h",
     "android/synchronous_compositor_client.h",
     "appcache_service.h",
+    "audio_service_info.cc",
+    "audio_service_info.h",
     "ax_event_notification_details.cc",
     "ax_event_notification_details.h",
     "background_fetch_delegate.cc",
     "background_fetch_delegate.h",
+    "background_fetch_description.cc",
+    "background_fetch_description.h",
     "background_fetch_response.cc",
     "background_fetch_response.h",
     "background_sync_controller.h",
@@ -86,12 +89,15 @@ jumbo_source_set("browser_sources") {
     "child_process_data.h",
     "child_process_launcher_utils.h",
     "child_process_security_policy.h",
+    "child_process_termination_info.h",
     "client_certificate_delegate.h",
     "color_chooser.h",
     "content_browser_client.cc",
     "content_browser_client.h",
     "context_factory.h",
     "cookie_store_factory.h",
+    "desktop_capture.cc",
+    "desktop_capture.h",
     "desktop_media_id.cc",
     "desktop_media_id.h",
     "devtools_agent_host.h",
@@ -120,6 +126,7 @@ jumbo_source_set("browser_sources") {
     "font_list_async.h",
     "frame_service_base.h",
     "global_request_id.h",
+    "gpu_client.h",
     "gpu_data_manager.h",
     "gpu_data_manager_observer.h",
     "gpu_feature_checker.cc",
@@ -271,6 +278,7 @@ jumbo_source_set("browser_sources") {
     "tracing_delegate.h",
     "url_data_source.cc",
     "url_data_source.h",
+    "url_loader_request_interceptor.h",
     "video_capture_device_launcher.h",
     "visibility.h",
     "vpn_service_proxy.h",
@@ -298,10 +306,11 @@ jumbo_source_set("browser_sources") {
     "web_ui_url_loader_factory.h",
     "webrtc_event_logger.cc",
     "webrtc_event_logger.h",
+    "webrtc_log.cc",
+    "webrtc_log.h",
     "websocket_handshake_request_info.h",
     "webvr_service_provider.cc",
     "webvr_service_provider.h",
-    "zygote_host_linux.h",
   ]
   configs += [
     "//build/config:precompiled_headers",
@@ -320,6 +329,8 @@ jumbo_source_set("browser_sources") {
     "//services/resource_coordinator/public/cpp:resource_coordinator_cpp",
     "//services/service_manager/public/cpp",
     "//services/tracing/public/cpp",
+    "//services/ui/public/interfaces",
+    "//third_party/webrtc/modules/desktop_capture",
 
     # We expose skia headers in the public API.
     "//skia",
@@ -338,6 +349,7 @@ jumbo_source_set("browser_sources") {
     "//media/capture",
     "//net",
     "//ppapi/c",
+    "//services/service_manager/embedder:embedder_result_codes",
     "//ui/accessibility",
     "//ui/base",
     "//ui/events",
@@ -372,14 +384,4 @@ jumbo_source_set("browser_sources") {
       "zoom_level_delegate.h",
     ]
   }
-
-  if (enable_webrtc) {
-    sources += [
-      "desktop_capture.cc",
-      "desktop_capture.h",
-      "webrtc_log.cc",
-      "webrtc_log.h",
-    ]
-    public_deps += [ "//third_party/webrtc/modules/desktop_capture" ]
-  }
 }
diff --git a/chromium/content/public/browser/DEPS b/chromium/content/public/browser/DEPS
index 38169801ef2..782fb0e3ad4 100644
--- a/chromium/content/public/browser/DEPS
+++ b/chromium/content/public/browser/DEPS
@@ -9,6 +9,7 @@ include_rules = [
   "+services/network/public/cpp",
   "+services/service_manager/sandbox",
   "+services/resource_coordinator/public",
+  "+services/ui/public/interfaces",
 ]
 
 specific_include_rules = {
diff --git a/chromium/content/public/browser/android/compositor_client.h b/chromium/content/public/browser/android/compositor_client.h
index bb03a251627..382575219e3 100644
--- a/chromium/content/public/browser/android/compositor_client.h
+++ b/chromium/content/public/browser/android/compositor_client.h
@@ -7,6 +7,7 @@
 
 #include "base/macros.h"
 #include "content/common/content_export.h"
+#include "ui/gfx/geometry/size.h"
 
 namespace content {
 
@@ -21,7 +22,7 @@ class CONTENT_EXPORT CompositorClient {
   virtual void DidSwapFrame(int pending_frames) {}
 
   // This is called on all swap buffers, regardless of cause.
-  virtual void DidSwapBuffers() {}
+  virtual void DidSwapBuffers(const gfx::Size& swap_size) {}
 
  protected:
   CompositorClient() {}
diff --git a/chromium/content/public/browser/android/content_view_layer_renderer.h b/chromium/content/public/browser/android/content_view_layer_renderer.h
index 2911bb4f948..09bf2f6f32d 100644
--- a/chromium/content/public/browser/android/content_view_layer_renderer.h
+++ b/chromium/content/public/browser/android/content_view_layer_renderer.h
@@ -5,19 +5,18 @@
 #ifndef CONTENT_PUBLIC_BROWSER_ANDROID_CONTENT_VIEW_LAYER_RENDERER_H_
 #define CONTENT_PUBLIC_BROWSER_ANDROID_CONTENT_VIEW_LAYER_RENDERER_H_
 
-// This interface is used by consumers of the ContentViewRenderView to
-// attach/detach layers.
-
-namespace blink {
-class WebLayer;
+namespace cc {
+class Layer;
 }
 
 namespace content {
 
+// This interface is used by consumers of the ContentViewRenderView to
+// attach/detach layers.
 class ContentViewLayerRenderer {
  public:
-  virtual void AttachLayer(blink::WebLayer* layer) = 0;
-  virtual void DetachLayer(blink::WebLayer* layer) = 0;
+  virtual void AttachLayer(cc::Layer* layer) = 0;
+  virtual void DetachLayer(cc::Layer* layer) = 0;
 
  protected:
   virtual ~ContentViewLayerRenderer() {}
diff --git a/chromium/content/public/browser/audio_service_info.cc b/chromium/content/public/browser/audio_service_info.cc
new file mode 100644
index 00000000000..e8638324648
--- /dev/null
+++ b/chromium/content/public/browser/audio_service_info.cc
@@ -0,0 +1,26 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/audio_service_info.h"
+
+#include "content/browser/browser_main_loop.h"
+#include "content/browser/renderer_host/media/audio_service_listener.h"
+#include "content/browser/renderer_host/media/media_stream_manager.h"
+#include "content/public/browser/browser_thread.h"
+
+namespace content {
+
+base::ProcessId GetProcessIdForAudioService() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  // May be null in unittests.
+  if (!BrowserMainLoop::GetInstance())
+    return base::kNullProcessId;
+
+  MediaStreamManager* manager =
+      BrowserMainLoop::GetInstance()->media_stream_manager();
+  return manager->audio_service_listener()->GetProcessId();
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/audio_service_info.h b/chromium/content/public/browser/audio_service_info.h
new file mode 100644
index 00000000000..4483043f44b
--- /dev/null
+++ b/chromium/content/public/browser/audio_service_info.h
@@ -0,0 +1,20 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_AUDIO_SERVICE_INFO_H_
+#define CONTENT_PUBLIC_BROWSER_AUDIO_SERVICE_INFO_H_
+
+#include "base/process/process_handle.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Returns the process id of the audio service utility process or
+// base::kNullProcessId if audio service is not running in an utility process.
+// Must be called on UI thread.
+CONTENT_EXPORT base::ProcessId GetProcessIdForAudioService();
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_AUDIO_SERVICE_INFO_H_
diff --git a/chromium/content/public/browser/background_fetch_delegate.h b/chromium/content/public/browser/background_fetch_delegate.h
index 6830505d4f0..275814357b6 100644
--- a/chromium/content/public/browser/background_fetch_delegate.h
+++ b/chromium/content/public/browser/background_fetch_delegate.h
@@ -16,7 +16,6 @@
 #include "content/common/content_export.h"
 
 class GURL;
-class SkBitmap;
 
 namespace gfx {
 class Size;
@@ -27,13 +26,18 @@ class HttpRequestHeaders;
 struct NetworkTrafficAnnotationTag;
 }  // namespace net
 
-namespace url {
-class Origin;
-}  // namespace url
-
 namespace content {
 struct BackgroundFetchResponse;
 struct BackgroundFetchResult;
+struct BackgroundFetchDescription;
+
+// Various reasons a Background Fetch can get aborted.
+enum class BackgroundFetchReasonToAbort {
+  NONE,
+  CANCELLED_FROM_UI,
+  ABORTED_BY_DEVELOPER,
+  TOTAL_DOWNLOAD_SIZE_EXCEEDED,
+};
 
 // Interface for launching background fetches. Implementing classes would
 // generally interface with the DownloadService or DownloadManager.
@@ -51,7 +55,9 @@ class CONTENT_EXPORT BackgroundFetchDelegate {
 
     // Called when the entire download job has been cancelled by the delegate,
     // e.g. because the user clicked cancel on a notification.
-    virtual void OnJobCancelled(const std::string& job_unique_id) = 0;
+    virtual void OnJobCancelled(
+        const std::string& job_unique_id,
+        BackgroundFetchReasonToAbort reason_to_abort) = 0;
 
     // Called after the download has started with the initial response
     // (including headers and URL chain). Always called on the UI thread.
@@ -92,13 +98,7 @@ class CONTENT_EXPORT BackgroundFetchDelegate {
   // contain the GUIDs of in progress downloads, while completed downloads are
   // recorded in |completed_parts|.
   virtual void CreateDownloadJob(
-      const std::string& job_unique_id,
-      const std::string& title,
-      const url::Origin& origin,
-      const SkBitmap& icon,
-      int completed_parts,
-      int total_parts,
-      const std::vector<std::string>& current_guids) = 0;
+      std::unique_ptr<BackgroundFetchDescription> fetch_description) = 0;
 
   // Creates a new download identified by |download_guid| in the download job
   // identified by |job_unique_id|.
diff --git a/chromium/content/public/browser/background_fetch_description.cc b/chromium/content/public/browser/background_fetch_description.cc
new file mode 100644
index 00000000000..7857bfd244a
--- /dev/null
+++ b/chromium/content/public/browser/background_fetch_description.cc
@@ -0,0 +1,31 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/background_fetch_description.h"
+
+namespace content {
+
+BackgroundFetchDescription::BackgroundFetchDescription(
+    std::string job_unique_id,
+    std::string title,
+    url::Origin origin,
+    SkBitmap icon,
+    int completed_parts,
+    int total_parts,
+    int completed_parts_size,
+    int total_parts_size,
+    std::vector<std::string> current_guids)
+    : job_unique_id(job_unique_id),
+      title(title),
+      origin(origin),
+      icon(icon),
+      completed_parts(completed_parts),
+      total_parts(total_parts),
+      completed_parts_size(completed_parts_size),
+      total_parts_size(total_parts_size),
+      current_guids(std::move(current_guids)) {}
+
+BackgroundFetchDescription::~BackgroundFetchDescription() = default;
+
+}  // namespace content
diff --git a/chromium/content/public/browser/background_fetch_description.h b/chromium/content/public/browser/background_fetch_description.h
new file mode 100644
index 00000000000..40d56f07ba3
--- /dev/null
+++ b/chromium/content/public/browser/background_fetch_description.h
@@ -0,0 +1,45 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+#ifndef CONTENT_PUBLIC_BROWSER_BACKGROUND_FETCH_DESCRIPTION_H_
+#define CONTENT_PUBLIC_BROWSER_BACKGROUND_FETCH_DESCRIPTION_H_
+
+#include <vector>
+#include "content/common/content_export.h"
+#include "third_party/skia/include/core/SkBitmap.h"
+#include "url/origin.h"
+
+namespace content {
+
+// Contains all information necessary to create
+// a BackgroundFetch download (and in the future, upload) job.
+struct CONTENT_EXPORT BackgroundFetchDescription {
+  BackgroundFetchDescription(std::string job_unique_id,
+                             std::string title,
+                             url::Origin origin,
+                             SkBitmap icon,
+                             int completed_parts,
+                             int total_parts,
+                             int completed_parts_size,
+                             int total_parts_size,
+                             std::vector<std::string> current_guids);
+  ~BackgroundFetchDescription();
+
+  const std::string job_unique_id;
+  std::string title;
+  const url::Origin origin;
+  SkBitmap icon;
+  int completed_parts;
+  int total_parts;
+  int completed_parts_size;
+  int total_parts_size;
+  std::vector<std::string> current_guids;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(BackgroundFetchDescription);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_BACKGROUND_FETCH_DESCRIPTION_H
diff --git a/chromium/content/public/browser/background_tracing_manager.h b/chromium/content/public/browser/background_tracing_manager.h
index c681d655cb9..dca9d8a3e46 100644
--- a/chromium/content/public/browser/background_tracing_manager.h
+++ b/chromium/content/public/browser/background_tracing_manager.h
@@ -26,21 +26,24 @@ class BackgroundTracingManager {
   // BackgroundTracingManager finalizes a trace. The first parameter of this
   // callback is the trace data. The second is metadata that was generated and
   // embedded into the trace. The third is a callback to notify the
-  // BackgroundTracingManager that you've finished processing the trace data.
+  // BackgroundTracingManager that you've finished processing the trace data
+  // and whether we were successful or not.
   //
   // Example:
   //
   // void Upload(const scoped_refptr<base::RefCountedString>& data,
-  //             base::Closure done_callback) {
+  //             FinishedProcessingCallback done_callback) {
   //   base::PostTaskWithTraitsAndReply(
   //       FROM_HERE, {base::MayBlock(), base::TaskPriority::BACKGROUND},
-  //       base::Bind(&DoUploadInBackground, data), done_callback);
+  //       base::BindOnce(&DoUploadInBackground, data),
+  //       std::move(done_callback));
   // }
   //
+  using FinishedProcessingCallback = base::OnceCallback<void(bool success)>;
   using ReceiveCallback =
-      base::Callback<void(const scoped_refptr<base::RefCountedString>&,
-                          std::unique_ptr<const base::DictionaryValue>,
-                          base::Closure)>;
+      base::OnceCallback<void(const scoped_refptr<base::RefCountedString>&,
+                              std::unique_ptr<const base::DictionaryValue>,
+                              FinishedProcessingCallback)>;
 
   // Set the triggering rules for when to start recording.
   //
@@ -63,7 +66,7 @@ class BackgroundTracingManager {
   };
   virtual bool SetActiveScenario(
       std::unique_ptr<BackgroundTracingConfig> config,
-      const ReceiveCallback& receive_callback,
+      ReceiveCallback receive_callback,
       DataFiltering data_filtering) = 0;
 
   // Notifies the caller when the manager is idle (not recording or uploading),
diff --git a/chromium/content/public/browser/browser_child_process_host.h b/chromium/content/public/browser/browser_child_process_host.h
index 16c7089a2d0..3d9a91c4e88 100644
--- a/chromium/content/public/browser/browser_child_process_host.h
+++ b/chromium/content/public/browser/browser_child_process_host.h
@@ -12,6 +12,7 @@
 #include "base/strings/string16.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/child_process_termination_info.h"
 #include "content/public/common/process_type.h"
 #include "ipc/ipc_sender.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
@@ -69,15 +70,11 @@ class CONTENT_EXPORT BrowserChildProcessHost : public IPC::Sender {
   // Returns the ChildProcessHost object used by this object.
   virtual ChildProcessHost* GetHost() const = 0;
 
-  // Returns the termination status of a child.  |exit_code| is the
-  // status returned when the process exited (for posix, as returned
-  // from waitpid(), for Windows, as returned from
-  // GetExitCodeProcess()).  |exit_code| may be nullptr.
+  // Returns the termination info of a child.
   // |known_dead| indicates that the child is already dead. On Linux, this
   // information is necessary to retrieve accurate information. See
-  // ChildProcessLauncher::GetChildTerminationStatus() for more details.
-  virtual base::TerminationStatus GetTerminationStatus(
-      bool known_dead, int* exit_code) = 0;
+  // ChildProcessLauncher::GetChildTerminationInfo() for more details.
+  virtual ChildProcessTerminationInfo GetTerminationInfo(bool known_dead) = 0;
 
   // Take ownership of a "shared" metrics allocator (if one exists).
   virtual std::unique_ptr<base::SharedPersistentMemoryAllocator>
diff --git a/chromium/content/public/browser/browser_child_process_observer.h b/chromium/content/public/browser/browser_child_process_observer.h
index faaa175a53a..ddf9cd2b623 100644
--- a/chromium/content/public/browser/browser_child_process_observer.h
+++ b/chromium/content/public/browser/browser_child_process_observer.h
@@ -10,6 +10,7 @@
 namespace content {
 
 struct ChildProcessData;
+struct ChildProcessTerminationInfo;
 
 // An observer API implemented by classes which are interested in browser child
 // process events. Note that render processes cannot be observed through this
@@ -31,15 +32,20 @@ class CONTENT_EXPORT BrowserChildProcessObserver {
       const ChildProcessData& data) {}
 
   // Called when a child process disappears unexpectedly as a result of a crash.
-  // |exit_code| contains the exit code from the process.
-  virtual void BrowserChildProcessCrashed(const ChildProcessData& data,
-                                          int exit_code) {}
+  virtual void BrowserChildProcessCrashed(
+      const ChildProcessData& data,
+      const ChildProcessTerminationInfo& info) {}
 
   // Called when a child process disappears unexpectedly as a result of being
   // killed.
-  // |exit_code| contains the exit code from the process.
-  virtual void BrowserChildProcessKilled(const ChildProcessData& data,
-                                         int exit_code) {}
+  virtual void BrowserChildProcessKilled(
+      const ChildProcessData& data,
+      const ChildProcessTerminationInfo& info) {}
+
+  // Note for Android. There is no way to reliably distinguish between Crash
+  // and Kill. Arbitrarily choose all abnormal terminations on Android to call
+  // BrowserChildProcessKilled, which means BrowserChildProcessCrashed will
+  // never be called on Android.
 
  protected:
   // The observer can be destroyed on any thread.
diff --git a/chromium/content/public/browser/browser_context.h b/chromium/content/public/browser/browser_context.h
index ddb42286696..b5cad2b7364 100644
--- a/chromium/content/public/browser/browser_context.h
+++ b/chromium/content/public/browser/browser_context.h
@@ -29,7 +29,6 @@ class GURL;
 
 namespace base {
 class FilePath;
-class Time;
 }
 
 namespace service_manager {
@@ -135,21 +134,15 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   using BlobContextGetter =
       base::RepeatingCallback<base::WeakPtr<storage::BlobStorageContext>()>;
 
-  // |callback| returns a nullptr scoped_ptr on failure.
+  // This method should be called on UI thread and calls back on UI thread
+  // as well. Note that retrieving a blob ptr out of BlobHandle can only be
+  // done on IO. |callback| returns a nullptr on failure.
   static void CreateMemoryBackedBlob(BrowserContext* browser_context,
                                      const char* data,
                                      size_t length,
                                      const std::string& content_type,
                                      BlobCallback callback);
 
-  // |callback| returns a nullptr scoped_ptr on failure.
-  static void CreateFileBackedBlob(BrowserContext* browser_context,
-                                   const base::FilePath& path,
-                                   int64_t offset,
-                                   int64_t size,
-                                   const base::Time& expected_modification_time,
-                                   BlobCallback callback);
-
   // Get a BlobStorageContext getter that needs to run on IO thread.
   static BlobContextGetter GetBlobStorageContext(
       BrowserContext* browser_context);
@@ -301,6 +294,9 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // by the Service Manager.
   virtual void RegisterInProcessServices(StaticServiceMap* services) {}
 
+  // Returns a unique string associated with this browser context.
+  virtual const std::string& UniqueId() const;
+
   // Returns a random salt string that is used for creating media device IDs.
   // Returns a random string by default.
   virtual std::string GetMediaDeviceIDSalt();
@@ -317,7 +313,7 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   virtual media::VideoDecodePerfHistory* GetVideoDecodePerfHistory();
 
  private:
-  const std::string media_device_id_salt_;
+  const std::string unique_id_;
   bool was_notify_will_be_destroyed_called_ = false;
 };
 
diff --git a/chromium/content/public/browser/browser_main_parts.cc b/chromium/content/public/browser/browser_main_parts.cc
index 108bf6b4235..130ad375fea 100644
--- a/chromium/content/public/browser/browser_main_parts.cc
+++ b/chromium/content/public/browser/browser_main_parts.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/browser/browser_main_parts.h"
 
-#include "content/public/common/result_codes.h"
+#include "services/service_manager/embedder/result_codes.h"
 
 namespace content {
 
@@ -13,7 +13,7 @@ bool BrowserMainParts::ShouldContentCreateFeatureList() {
 }
 
 int BrowserMainParts::PreEarlyInitialization() {
-  return RESULT_CODE_NORMAL_EXIT;
+  return service_manager::RESULT_CODE_NORMAL_EXIT;
 }
 
 int BrowserMainParts::PreCreateThreads() {
diff --git a/chromium/content/public/browser/browser_main_parts.h b/chromium/content/public/browser/browser_main_parts.h
index 630d0251875..4b8b672fd40 100644
--- a/chromium/content/public/browser/browser_main_parts.h
+++ b/chromium/content/public/browser/browser_main_parts.h
@@ -30,7 +30,7 @@ class ServiceManagerConnection;
 //    things which should be done immediately before the start of the main
 //    message loop should go in |PreMainMessageLoopStart()|.
 //  - RunMainMessageLoopParts:  things to be done before and after invoking the
-//    main message loop run method (e.g. MessageLoopForUI::current()->Run()).
+//    main message loop run method (e.g. MessageLoopCurrentForUI::Get()->Run()).
 //
 // How to add stuff (to existing parts):
 //  - Figure out when your new code should be executed. What must happen
diff --git a/chromium/content/public/browser/browsing_data_filter_builder.h b/chromium/content/public/browser/browsing_data_filter_builder.h
index 1d75cd40e94..e99ffc878e7 100644
--- a/chromium/content/public/browser/browsing_data_filter_builder.h
+++ b/chromium/content/public/browser/browsing_data_filter_builder.h
@@ -17,10 +17,6 @@
 
 class GURL;
 
-namespace net {
-class CanonicalCookie;
-}
-
 namespace url {
 class Origin;
 }
@@ -70,20 +66,17 @@ class CONTENT_EXPORT BrowsingDataFilterBuilder {
   virtual base::RepeatingCallback<bool(const GURL&)>
       BuildGeneralFilter() const = 0;
 
-  // Builds a filter that can be used with the network service, more precisely
-  // with NetworkContext.ClearHttpCache().
-  virtual network::mojom::ClearCacheUrlFilterPtr BuildClearCacheUrlFilter()
+  // Builds a filter that can be used with the network service. This uses a Mojo
+  // struct rather than a predicate function (as used by the rest of the filters
+  // built by this class) because we need to be able to pass the filter to the
+  // network service via IPC.
+  virtual network::mojom::ClearDataFilterPtr BuildNetworkServiceFilter()
       const = 0;
 
-  // Builds a filter that matches cookies whose sources are in the whitelist,
-  // or aren't in the blacklist.
-  virtual base::RepeatingCallback<bool(const net::CanonicalCookie& pattern)>
-      BuildCookieFilter() const = 0;
-
-  // Builds a filter that matches channel IDs whose server identifiers are in
-  // the whitelist, or aren't in the blacklist.
-  virtual base::RepeatingCallback<bool(const std::string& server_id)>
-      BuildChannelIDFilter() const = 0;
+  // Builds a CookieDeletionInfo object that matches cookies whose sources are
+  // in the whitelist, or aren't in the blacklist.
+  virtual network::mojom::CookieDeletionFilterPtr BuildCookieDeletionFilter()
+      const = 0;
 
   // Builds a filter that matches the |site| of a plugin.
   virtual base::RepeatingCallback<bool(const std::string& site)>
diff --git a/chromium/content/public/browser/browsing_data_remover.h b/chromium/content/public/browser/browsing_data_remover.h
index f672bcc1a22..ba4694da241 100644
--- a/chromium/content/public/browser/browsing_data_remover.h
+++ b/chromium/content/public/browser/browsing_data_remover.h
@@ -70,6 +70,8 @@ class BrowsingDataRemover {
     DATA_TYPE_WEB_SQL = 1 << 4,
     DATA_TYPE_SERVICE_WORKERS = 1 << 5,
     DATA_TYPE_CACHE_STORAGE = 1 << 6,
+    // This is also persisted, keep with storage datatypes.
+    DATA_TYPE_BACKGROUND_FETCH = 1 << 14,
 
     // Used to request the deletion of embedder-specific storage datatypes.
     DATA_TYPE_EMBEDDER_DOM_STORAGE = 1 << 7,
@@ -77,13 +79,11 @@ class BrowsingDataRemover {
     // DOM-accessible storage (https://www.w3.org/TR/clear-site-data/#storage).
     // Has the same effect as selecting all storage datatypes listed above
     // and ones defined by the embedder.
-    DATA_TYPE_DOM_STORAGE = DATA_TYPE_APP_CACHE | DATA_TYPE_FILE_SYSTEMS |
-                            DATA_TYPE_INDEXED_DB |
-                            DATA_TYPE_LOCAL_STORAGE |
-                            DATA_TYPE_WEB_SQL |
-                            DATA_TYPE_SERVICE_WORKERS |
-                            DATA_TYPE_CACHE_STORAGE |
-                            DATA_TYPE_EMBEDDER_DOM_STORAGE,
+    DATA_TYPE_DOM_STORAGE =
+        DATA_TYPE_APP_CACHE | DATA_TYPE_FILE_SYSTEMS | DATA_TYPE_INDEXED_DB |
+        DATA_TYPE_LOCAL_STORAGE | DATA_TYPE_WEB_SQL |
+        DATA_TYPE_SERVICE_WORKERS | DATA_TYPE_CACHE_STORAGE |
+        DATA_TYPE_EMBEDDER_DOM_STORAGE | DATA_TYPE_BACKGROUND_FETCH,
 
     // Other datatypes.
     DATA_TYPE_COOKIES = 1 << 8,
@@ -100,7 +100,7 @@ class BrowsingDataRemover {
     // deleting COOKIES and CHANNEL IDs, BrowsingDataRemover should skip
     // storage backends whose deletion would cause closing network connections.
     // TODO(crbug.com/798760): Remove when fixed.
-    DATA_TYPE_AVOID_CLOSING_CONNECTIONS = 1 << 14,
+    DATA_TYPE_AVOID_CLOSING_CONNECTIONS = 1 << 15,
 
     // Embedders can add more datatypes beyond this point.
     DATA_TYPE_CONTENT_END = DATA_TYPE_AVOID_CLOSING_CONNECTIONS,
diff --git a/chromium/content/public/browser/child_process_termination_info.h b/chromium/content/public/browser/child_process_termination_info.h
new file mode 100644
index 00000000000..37a325679b1
--- /dev/null
+++ b/chromium/content/public/browser/child_process_termination_info.h
@@ -0,0 +1,39 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_CHILD_PROCESS_TERMINATION_INFO_H_
+#define CONTENT_PUBLIC_BROWSER_CHILD_PROCESS_TERMINATION_INFO_H_
+
+#include "base/process/kill.h"
+#include "base/time/time.h"
+#include "build/build_config.h"
+#include "content/public/common/result_codes.h"
+
+namespace content {
+
+struct ChildProcessTerminationInfo {
+  base::TerminationStatus status = base::TERMINATION_STATUS_NORMAL_TERMINATION;
+
+  // If |status| is TERMINATION_STATUS_LAUNCH_FAILED then |exit_code| will
+  // contain a platform specific launch failure error code. Otherwise, it will
+  // contain the exit code for the process (e.g. status from waitpid if on
+  // posix, from GetExitCodeProcess on Windows).
+  int exit_code = service_manager::RESULT_CODE_NORMAL_EXIT;
+
+  // Time delta between 1) the process start and 2) the time when
+  // ChildProcessTerminationInfo is computed.
+  base::TimeDelta uptime = base::TimeDelta::Max();
+
+#if defined(OS_ANDROID)
+  // True if child service has strong or moderate binding at time of death.
+  bool has_oom_protection_bindings = false;
+
+  // True if child service was explicitly killed by browser.
+  bool was_killed_intentionally_by_browser = false;
+#endif
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_CHILD_PROCESS_TERMINATION_INFO_H_
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index f6ae6d1d445..a8927d0ba8d 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/navigation_ui_data.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/page_navigator.h"
+#include "content/public/browser/url_loader_request_interceptor.h"
 #include "content/public/browser/vpn_service_proxy.h"
 #include "content/public/common/url_loader_throttle.h"
 #include "device/geolocation/public/cpp/location_provider.h"
@@ -166,11 +167,19 @@ bool ContentBrowserClient::ShouldSwapBrowsingInstancesForNavigation(
   return false;
 }
 
+bool ContentBrowserClient::ShouldIsolateErrorPage(bool in_main_frame) {
+  return false;
+}
+
 std::unique_ptr<media::AudioManager> ContentBrowserClient::CreateAudioManager(
     media::AudioLogFactory* audio_log_factory) {
   return nullptr;
 }
 
+bool ContentBrowserClient::OverridesAudioManager() {
+  return false;
+}
+
 std::unique_ptr<media::CdmFactory> ContentBrowserClient::CreateCdmFactory() {
   return nullptr;
 }
@@ -591,12 +600,12 @@ ContentBrowserClient::CreateURLLoaderThrottles(
 }
 
 void ContentBrowserClient::RegisterNonNetworkNavigationURLLoaderFactories(
-    RenderFrameHost* frame_host,
+    int frame_tree_node_id,
     NonNetworkURLLoaderFactoryMap* factories) {}
 
 void ContentBrowserClient::RegisterNonNetworkSubresourceURLLoaderFactories(
-    RenderFrameHost* frame_host,
-    const GURL& frame_url,
+    int render_process_id,
+    int render_frame_id,
     NonNetworkURLLoaderFactoryMap* factories) {}
 
 bool ContentBrowserClient::WillCreateURLLoaderFactory(
@@ -617,6 +626,7 @@ network::mojom::NetworkContextPtr ContentBrowserClient::CreateNetworkContext(
   network::mojom::NetworkContextParamsPtr context_params =
       network::mojom::NetworkContextParams::New();
   context_params->user_agent = GetContentClient()->GetUserAgent();
+  context_params->accept_language = "en-us,en";
   context_params->enable_data_url_support = true;
   context_params->enable_file_url_support = true;
   GetNetworkService()->CreateNetworkContext(MakeRequest(&network_context),
@@ -695,11 +705,10 @@ ContentBrowserClient::CreateClientCertStore(ResourceContext* resource_context) {
 scoped_refptr<LoginDelegate> ContentBrowserClient::CreateLoginDelegate(
     net::AuthChallengeInfo* auth_info,
     content::ResourceRequestInfo::WebContentsGetter web_contents_getter,
-    bool is_main_frame,
+    bool is_request_for_main_frame,
     const GURL& url,
     bool first_auth_attempt,
-    const base::Callback<void(const base::Optional<net::AuthCredentials>&)>&
-        auth_required_callback) {
+    LoginAuthRequiredCallback auth_required_callback) {
   return nullptr;
 }
 
@@ -720,4 +729,11 @@ ContentBrowserClient::CreateWindowForPictureInPicture(
   return nullptr;
 }
 
+std::vector<std::unique_ptr<URLLoaderRequestInterceptor>>
+ContentBrowserClient::WillCreateURLLoaderRequestInterceptors(
+    NavigationUIData* navigation_ui_data,
+    int frame_tree_node_id) {
+  return std::vector<std::unique_ptr<URLLoaderRequestInterceptor>>();
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index 63cb3851db0..e9c6b810e05 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -46,15 +46,17 @@
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
 
-#if defined(OS_POSIX) && !defined(OS_MACOSX)
+#if (defined(OS_POSIX) && !defined(OS_MACOSX)) || defined(OS_FUCHSIA)
 #include "base/posix/global_descriptors.h"
 #endif
 
-#if defined(OS_POSIX)
+#if defined(OS_POSIX) || defined(OS_FUCHSIA)
 #include "content/public/browser/posix_file_descriptor_info.h"
 #endif
 
 class GURL;
+using LoginAuthRequiredCallback =
+    base::OnceCallback<void(const base::Optional<net::AuthCredentials>&)>;
 
 namespace base {
 class CommandLine;
@@ -151,10 +153,12 @@ class RenderFrameHost;
 class RenderProcessHost;
 class RenderViewHost;
 class ResourceContext;
+class ServiceManagerConnection;
 class SiteInstance;
 class SpeechRecognitionManagerDelegate;
 class StoragePartition;
 class TracingDelegate;
+class URLLoaderRequestInterceptor;
 class URLLoaderThrottle;
 class VpnServiceProxy;
 class WebContents;
@@ -366,6 +370,9 @@ class CONTENT_EXPORT ContentBrowserClient {
       const GURL& current_url,
       const GURL& new_url);
 
+  // Returns true if error page should be isolated in its own process.
+  virtual bool ShouldIsolateErrorPage(bool in_main_frame);
+
   // Returns true if the passed in URL should be assigned as the site of the
   // current SiteInstance, if it does not yet have a site.
   virtual bool ShouldAssignSiteForURL(const GURL& url);
@@ -816,8 +823,11 @@ class CONTENT_EXPORT ContentBrowserClient {
       std::map<std::string, service_manager::EmbeddedServiceInfo>;
 
   // Registers services to be loaded in the browser process by the Service
-  // Manager.
-  virtual void RegisterInProcessServices(StaticServiceMap* services) {}
+  // Manager. |connection| is the ServiceManagerConnection service are
+  // registered with.
+  virtual void RegisterInProcessServices(StaticServiceMap* services,
+                                         ServiceManagerConnection* connection) {
+  }
 
   virtual void OverrideOnBindInterface(
       const service_manager::BindSourceInfo& remote_info,
@@ -924,18 +934,23 @@ class CONTENT_EXPORT ContentBrowserClient {
   // will be used.
   virtual std::unique_ptr<media::AudioManager> CreateAudioManager(
       media::AudioLogFactory* audio_log_factory);
+
+  // Returns true if (and only if) CreateAudioManager() is implemented and
+  // returns a non-null value.
+  virtual bool OverridesAudioManager();
+
   // Creates and returns a factory used for creating CDM instances for playing
   // protected content.
   virtual std::unique_ptr<media::CdmFactory> CreateCdmFactory();
 
   // Populates |mappings| with all files that need to be mapped before launching
   // a child process.
-#if defined(OS_POSIX) && !defined(OS_MACOSX)
+#if (defined(OS_POSIX) && !defined(OS_MACOSX)) || defined(OS_FUCHSIA)
   virtual void GetAdditionalMappedFilesForChildProcess(
       const base::CommandLine& command_line,
       int child_process_id,
       content::PosixFileDescriptorInfo* mappings) {}
-#endif  // defined(OS_POSIX) && !defined(OS_MACOSX)
+#endif  // defined(OS_POSIX) && !defined(OS_MACOSX) || defined(OS_FUCHSIA)
 
 #if defined(OS_WIN)
   // This is called on the PROCESS_LAUNCHER thread before the renderer process
@@ -984,20 +999,23 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Allows the embedder to register per-scheme URLLoaderFactory implementations
   // to handle navigation URL requests for schemes not handled by the Network
   // Service. Only called when the Network Service is enabled.
+  // Note that a RenderFrameHost or RenderProcessHost aren't passed in because
+  // these can change during a navigation (e.g. depending on redirects).
   using NonNetworkURLLoaderFactoryMap =
       std::map<std::string, std::unique_ptr<network::mojom::URLLoaderFactory>>;
   virtual void RegisterNonNetworkNavigationURLLoaderFactories(
-      RenderFrameHost* frame_host,
+      int frame_tree_node_id,
       NonNetworkURLLoaderFactoryMap* factories);
 
   // Allows the embedder to register per-scheme URLLoaderFactory implementations
   // to handle subresource URL requests for schemes not handled by the Network
-  // Service. The factories added to this map will only be used to service
-  // subresource requests from |frame_host| as long as it's navigated to
-  // |frame_url|. Only called when the Network Service is enabled.
+  // Service. This function can also be used to make a factory for other
+  // non-subresource requests, such as for the service worker script when
+  // starting a service worker. In that case, the frame id will be
+  // MSG_ROUTING_NONE.
   virtual void RegisterNonNetworkSubresourceURLLoaderFactories(
-      RenderFrameHost* frame_host,
-      const GURL& frame_url,
+      int render_process_id,
+      int render_frame_id,
       NonNetworkURLLoaderFactoryMap* factories);
 
   // Allows the embedder to intercept URLLoaderFactory interfaces used for
@@ -1015,6 +1033,15 @@ class CONTENT_EXPORT ContentBrowserClient {
       bool is_navigation,
       network::mojom::URLLoaderFactoryRequest* factory_request);
 
+  // Allows the embedder to returns a list of request interceptors that can
+  // intercept a navigation request.
+  //
+  // Always called on the IO thread and only when the Network Service is
+  // enabled.
+  virtual std::vector<std::unique_ptr<URLLoaderRequestInterceptor>>
+  WillCreateURLLoaderRequestInterceptors(NavigationUIData* navigation_ui_data,
+                                         int frame_tree_node_id);
+
   // Creates a NetworkContext for a BrowserContext's StoragePartition. If the
   // network service is enabled, it must return a NetworkContext using the
   // network service. If the network service is disabled, the embedder may
@@ -1144,11 +1171,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual scoped_refptr<LoginDelegate> CreateLoginDelegate(
       net::AuthChallengeInfo* auth_info,
       content::ResourceRequestInfo::WebContentsGetter web_contents_getter,
-      bool is_main_frame,
+      bool is_request_for_main_frame,
       const GURL& url,
       bool first_auth_attempt,
-      const base::Callback<void(const base::Optional<net::AuthCredentials>&)>&
-          auth_required_callback);
+      LoginAuthRequiredCallback auth_required_callback);
 
   // Launches the url for the given tab. Returns true if an attempt to handle
   // the url was made, e.g. by launching an app. Note that this does not
diff --git a/chromium/content/public/browser/desktop_capture.cc b/chromium/content/public/browser/desktop_capture.cc
index 016a774820e..2d41880a3bb 100644
--- a/chromium/content/public/browser/desktop_capture.cc
+++ b/chromium/content/public/browser/desktop_capture.cc
@@ -6,6 +6,7 @@
 
 #include "base/feature_list.h"
 #include "build/build_config.h"
+#include "content/public/common/content_features.h"
 
 namespace content {
 namespace desktop_capture {
@@ -24,7 +25,11 @@ webrtc::DesktopCaptureOptions CreateDesktopCaptureOptions() {
   } else {
     options.set_allow_use_magnification_api(true);
   }
-#endif  // defined(OS_WIN)
+#elif defined(OS_MACOSX)
+  if (base::FeatureList::IsEnabled(features::kIOSurfaceCapturer)) {
+    options.set_allow_iosurface(true);
+  }
+#endif
   return options;
 }
 
diff --git a/chromium/content/public/browser/devtools_agent_host.h b/chromium/content/public/browser/devtools_agent_host.h
index a6e78f907cd..0be97b39183 100644
--- a/chromium/content/public/browser/devtools_agent_host.h
+++ b/chromium/content/public/browser/devtools_agent_host.h
@@ -121,10 +121,6 @@ class CONTENT_EXPORT DevToolsAgentHost
   // Returns |true| on success.
   virtual bool AttachRestrictedClient(DevToolsAgentHostClient* client) = 0;
 
-  // Attaches |client| to this agent host to start debugging. Disconnects
-  // any existing clients.
-  virtual void ForceAttachClient(DevToolsAgentHostClient* client) = 0;
-
   // Already attached client detaches from this agent host to stop debugging it.
   // Returns true iff detach succeeded.
   virtual bool DetachClient(DevToolsAgentHostClient* client) = 0;
diff --git a/chromium/content/public/browser/download_manager.h b/chromium/content/public/browser/download_manager.h
index e9480a681d8..0708c4157d0 100644
--- a/chromium/content/public/browser/download_manager.h
+++ b/chromium/content/public/browser/download_manager.h
@@ -43,18 +43,16 @@
 #include "components/download/public/common/input_stream.h"
 #include "content/common/content_export.h"
 #include "net/base/net_errors.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "storage/browser/blob/blob_data_handle.h"
 
 class GURL;
 
 namespace download {
 struct DownloadCreateInfo;
+class DownloadURLLoaderFactoryGetter;
 }  // namespace download
 
-namespace network {
-class SharedURLLoaderFactory;
-}  // namespace network
-
 namespace content {
 
 class BrowserContext;
@@ -121,12 +119,13 @@ class CONTENT_EXPORT DownloadManager : public base::SupportsUserData::Data {
   // Called by a download source (Currently DownloadResourceHandler)
   // to initiate the non-source portions of a download.
   // If the DownloadCreateInfo specifies an id, that id will be used.
-  // If |shared_url_loader_factory| is provided, it can be used to issue
+  // If |url_loader_factory_getter| is provided, it can be used to issue
   // parallel download requests.
   virtual void StartDownload(
       std::unique_ptr<download::DownloadCreateInfo> info,
       std::unique_ptr<download::InputStream> stream,
-      scoped_refptr<network::SharedURLLoaderFactory> shared_url_loader_factory,
+      scoped_refptr<download::DownloadURLLoaderFactoryGetter>
+          url_loader_factory_getter,
       const download::DownloadUrlParameters::OnStartedCallback& on_started) = 0;
 
   // Remove downloads whose URLs match the |url_filter| and are within
@@ -151,7 +150,9 @@ class CONTENT_EXPORT DownloadManager : public base::SupportsUserData::Data {
   // fail.
   virtual void DownloadUrl(
       std::unique_ptr<download::DownloadUrlParameters> parameters,
-      std::unique_ptr<storage::BlobDataHandle> blob_data_handle) = 0;
+      std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
+      scoped_refptr<network::SharedURLLoaderFactory>
+          blob_url_loader_factory) = 0;
 
   // Allow objects to observe the download creation process.
   virtual void AddObserver(Observer* observer) = 0;
diff --git a/chromium/content/public/browser/download_manager_delegate.cc b/chromium/content/public/browser/download_manager_delegate.cc
index 8eac05f2552..b5963aa8b77 100644
--- a/chromium/content/public/browser/download_manager_delegate.cc
+++ b/chromium/content/public/browser/download_manager_delegate.cc
@@ -53,10 +53,6 @@ bool DownloadManagerDelegate::GenerateFileHash() {
   return false;
 }
 
-download::InProgressCache* DownloadManagerDelegate::GetInProgressCache() {
-  return nullptr;
-}
-
 std::string
 DownloadManagerDelegate::ApplicationClientIdForFileScanning() const {
   return std::string();
diff --git a/chromium/content/public/browser/download_manager_delegate.h b/chromium/content/public/browser/download_manager_delegate.h
index 579ea358435..ac3055c280e 100644
--- a/chromium/content/public/browser/download_manager_delegate.h
+++ b/chromium/content/public/browser/download_manager_delegate.h
@@ -17,9 +17,6 @@
 #include "content/public/browser/resource_request_info.h"
 #include "content/public/browser/save_page_type.h"
 
-namespace download {
-class InProgressCache;
-}  // namespace download
 
 namespace content {
 
@@ -138,9 +135,6 @@ class CONTENT_EXPORT DownloadManagerDelegate {
                           base::FilePath* download_save_dir,
                           bool* skip_dir_check) {}
 
-  // Returns the metadata cache for in-progress downloads.
-  virtual download::InProgressCache* GetInProgressCache();
-
   // Asks the user for the path to save a page. The delegate calls the callback
   // to give the answer.
   virtual void ChooseSavePath(
diff --git a/chromium/content/public/browser/file_url_loader.h b/chromium/content/public/browser/file_url_loader.h
index c8a7ed86a51..b6f0f24ec72 100644
--- a/chromium/content/public/browser/file_url_loader.h
+++ b/chromium/content/public/browser/file_url_loader.h
@@ -22,7 +22,6 @@ class CONTENT_EXPORT FileURLLoaderObserver
   ~FileURLLoaderObserver() override {}
 
   virtual void OnStart() {}
-  virtual void OnOpenComplete(int result) {}
   virtual void OnSeekComplete(int64_t result) {}
 
  private:
diff --git a/chromium/content/public/browser/gpu_client.h b/chromium/content/public/browser/gpu_client.h
new file mode 100644
index 00000000000..77a7e386c5d
--- /dev/null
+++ b/chromium/content/public/browser/gpu_client.h
@@ -0,0 +1,31 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_GPU_CLIENT_H_
+#define CONTENT_PUBLIC_BROWSER_GPU_CLIENT_H_
+
+#include <memory>
+
+#include "base/callback_forward.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/browser_thread.h"
+#include "services/ui/public/interfaces/gpu.mojom.h"
+
+namespace content {
+
+// GpuClient provides an implementation of ui::mojom::Gpu.
+class CONTENT_EXPORT GpuClient {
+ public:
+  virtual ~GpuClient() {}
+
+  using ConnectionErrorHandlerClosure =
+      base::OnceCallback<void(GpuClient* client)>;
+  static std::unique_ptr<GpuClient, BrowserThread::DeleteOnIOThread> Create(
+      ui::mojom::GpuRequest request,
+      ConnectionErrorHandlerClosure connection_error_handler);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_GPU_CLIENT_H_
diff --git a/chromium/content/public/browser/gpu_data_manager.h b/chromium/content/public/browser/gpu_data_manager.h
index ebe6ba517c6..481bf03ef3d 100644
--- a/chromium/content/public/browser/gpu_data_manager.h
+++ b/chromium/content/public/browser/gpu_data_manager.h
@@ -61,10 +61,6 @@ class GpuDataManager {
   // Whether a GPU is in use (as opposed to a software renderer).
   virtual bool HardwareAccelerationEnabled() const = 0;
 
-  // Extensions that are currently disabled.
-  virtual void GetDisabledExtensions(
-      std::string* disabled_extensions) const = 0;
-
  protected:
   virtual ~GpuDataManager() {}
 };
diff --git a/chromium/content/public/browser/gpu_utils.cc b/chromium/content/public/browser/gpu_utils.cc
index b2fd38514cb..52db4930d03 100644
--- a/chromium/content/public/browser/gpu_utils.cc
+++ b/chromium/content/public/browser/gpu_utils.cc
@@ -4,20 +4,21 @@
 
 #include "content/public/browser/gpu_utils.h"
 
+#include <string>
+
 #include "base/command_line.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
+#include "build/build_config.h"
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "gpu/command_buffer/service/gpu_switches.h"
 #include "gpu/command_buffer/service/service_utils.h"
-#include "gpu/config/gpu_switches.h"
 #include "media/media_buildflags.h"
-#include "ui/gl/gl_switches.h"
 
 namespace {
 
+#if defined(OS_WIN)
 bool GetUintFromSwitch(const base::CommandLine* command_line,
                        const base::StringPiece& switch_string,
                        uint32_t* value) {
@@ -26,6 +27,7 @@ bool GetUintFromSwitch(const base::CommandLine* command_line,
   std::string switch_value(command_line->GetSwitchValueASCII(switch_string));
   return base::StringToUint(switch_value, value);
 }
+#endif  // defined(OS_WIN)
 
 void RunTaskOnTaskRunner(
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
@@ -49,7 +51,8 @@ const gpu::GpuPreferences GetGpuPreferencesFromCommandLine() {
   DCHECK(base::CommandLine::InitializedForCurrentProcess());
   const base::CommandLine* command_line =
       base::CommandLine::ForCurrentProcess();
-  gpu::GpuPreferences gpu_preferences;
+  gpu::GpuPreferences gpu_preferences =
+      gpu::gles2::ParseGpuPreferences(command_line);
   gpu_preferences.single_process =
       command_line->HasSwitch(switches::kSingleProcess);
   gpu_preferences.in_process_gpu =
@@ -78,50 +81,6 @@ const gpu::GpuPreferences GetGpuPreferencesFromCommandLine() {
       command_line->HasSwitch(switches::kDisableSoftwareRasterizer);
   gpu_preferences.log_gpu_control_list_decisions =
       command_line->HasSwitch(switches::kLogGpuControlListDecisions);
-  gpu_preferences.compile_shader_always_succeeds =
-      command_line->HasSwitch(switches::kCompileShaderAlwaysSucceeds);
-  gpu_preferences.disable_gl_error_limit =
-      command_line->HasSwitch(switches::kDisableGLErrorLimit);
-  gpu_preferences.disable_glsl_translator =
-      command_line->HasSwitch(switches::kDisableGLSLTranslator);
-  gpu_preferences.disable_shader_name_hashing =
-      command_line->HasSwitch(switches::kDisableShaderNameHashing);
-  gpu_preferences.enable_gpu_command_logging =
-      command_line->HasSwitch(switches::kEnableGPUCommandLogging);
-  gpu_preferences.enable_gpu_debugging =
-      command_line->HasSwitch(switches::kEnableGPUDebugging);
-  gpu_preferences.enable_gpu_service_logging_gpu =
-      command_line->HasSwitch(switches::kEnableGPUServiceLoggingGPU);
-  gpu_preferences.enable_gpu_driver_debug_logging =
-      command_line->HasSwitch(switches::kEnableGPUDriverDebugLogging);
-  gpu_preferences.disable_gpu_program_cache =
-      command_line->HasSwitch(switches::kDisableGpuProgramCache);
-  gpu_preferences.enforce_gl_minimums =
-      command_line->HasSwitch(switches::kEnforceGLMinimums);
-  if (GetUintFromSwitch(command_line, switches::kForceGpuMemAvailableMb,
-                        &gpu_preferences.force_gpu_mem_available)) {
-    gpu_preferences.force_gpu_mem_available *= 1024 * 1024;
-  }
-  if (GetUintFromSwitch(command_line, switches::kGpuProgramCacheSizeKb,
-                        &gpu_preferences.gpu_program_cache_size)) {
-    gpu_preferences.gpu_program_cache_size *= 1024;
-  }
-  gpu_preferences.disable_gpu_shader_disk_cache =
-      command_line->HasSwitch(switches::kDisableGpuShaderDiskCache);
-  gpu_preferences.enable_threaded_texture_mailboxes =
-      command_line->HasSwitch(switches::kEnableThreadedTextureMailboxes);
-  gpu_preferences.gl_shader_interm_output =
-      command_line->HasSwitch(switches::kGLShaderIntermOutput);
-  gpu_preferences.emulate_shader_precision =
-      command_line->HasSwitch(switches::kEmulateShaderPrecision);
-  gpu_preferences.enable_raster_decoder =
-      command_line->HasSwitch(switches::kEnableRasterDecoder);
-  gpu_preferences.enable_gpu_service_logging =
-      command_line->HasSwitch(switches::kEnableGPUServiceLogging);
-  gpu_preferences.enable_gpu_service_tracing =
-      command_line->HasSwitch(switches::kEnableGPUServiceTracing);
-  gpu_preferences.use_passthrough_cmd_decoder =
-      gpu::gles2::UsePassthroughCommandDecoder(command_line);
   gpu_preferences.gpu_startup_dialog =
       command_line->HasSwitch(switches::kGpuStartupDialog);
   gpu_preferences.disable_gpu_watchdog =
@@ -129,10 +88,6 @@ const gpu::GpuPreferences GetGpuPreferencesFromCommandLine() {
       (gpu_preferences.single_process || gpu_preferences.in_process_gpu);
   gpu_preferences.gpu_sandbox_start_early =
       command_line->HasSwitch(switches::kGpuSandboxStartEarly);
-  gpu_preferences.disable_gpu_driver_bug_workarounds =
-      command_line->HasSwitch(switches::kDisableGpuDriverBugWorkarounds);
-  gpu_preferences.ignore_gpu_blacklist =
-      command_line->HasSwitch(switches::kIgnoreGpuBlacklist);
   // Some of these preferences are set or adjusted in
   // GpuDataManagerImplPrivate::AppendGpuCommandLine.
   return gpu_preferences;
diff --git a/chromium/content/public/browser/keyboard_event_processing_result.h b/chromium/content/public/browser/keyboard_event_processing_result.h
index 4030a527e7c..ba43542c7ab 100644
--- a/chromium/content/public/browser/keyboard_event_processing_result.h
+++ b/chromium/content/public/browser/keyboard_event_processing_result.h
@@ -11,6 +11,9 @@ enum class KeyboardEventProcessingResult {
   // The event was handled.
   HANDLED,
 
+  // The event was handled, and we want to be notified of the keyup event too.
+  HANDLED_WANTS_KEY_UP,
+
 #if defined(USE_AURA)
   // The event was handled, but don't update the underlying event. A value
   // HANDLED results in calling ui::Event::SetHandled(), where as this does not.
diff --git a/chromium/content/public/browser/manifest_icon_selector.h b/chromium/content/public/browser/manifest_icon_selector.h
index f95ea6aa678..e535ec07f18 100644
--- a/chromium/content/public/browser/manifest_icon_selector.h
+++ b/chromium/content/public/browser/manifest_icon_selector.h
@@ -6,7 +6,8 @@
 #define CONTENT_PUBLIC_BROWSER_MANIFEST_ICON_SELECTOR_H_
 
 #include "base/macros.h"
-#include "content/public/common/manifest.h"
+#include "content/common/content_export.h"
+#include "third_party/blink/public/common/manifest/manifest.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -26,10 +27,10 @@ class CONTENT_EXPORT ManifestIconSelector {
   //
   // Returns the icon url if a suitable icon is found. An empty URL otherwise.
   static GURL FindBestMatchingIcon(
-      const std::vector<content::Manifest::Icon>& icons,
+      const std::vector<blink::Manifest::Icon>& icons,
       int ideal_icon_size_in_px,
       int minimum_icon_size_in_px,
-      content::Manifest::Icon::IconPurpose purpose);
+      blink::Manifest::Icon::IconPurpose purpose);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(ManifestIconSelector);
diff --git a/chromium/content/public/browser/native_web_keyboard_event.h b/chromium/content/public/browser/native_web_keyboard_event.h
index 32b4a0d3e69..60fccfbc6cb 100644
--- a/chromium/content/public/browser/native_web_keyboard_event.h
+++ b/chromium/content/public/browser/native_web_keyboard_event.h
@@ -29,9 +29,6 @@ struct CONTENT_EXPORT NativeWebKeyboardEvent : public blink::WebKeyboardEvent {
   NativeWebKeyboardEvent(blink::WebInputEvent::Type type,
                          int modifiers,
                          base::TimeTicks timestamp);
-  NativeWebKeyboardEvent(blink::WebInputEvent::Type type,
-                         int modifiers,
-                         double timestampSeconds);
 
   // Creates a native web keyboard event from a WebKeyboardEvent. The |os_event|
   // member may be a synthetic event, and possibly incomplete.
@@ -46,7 +43,7 @@ struct CONTENT_EXPORT NativeWebKeyboardEvent : public blink::WebKeyboardEvent {
       const base::android::JavaRef<jobject>& android_key_event,
       blink::WebInputEvent::Type type,
       int modifiers,
-      double time_secs,
+      base::TimeTicks timestamp,
       int keycode,
       int scancode,
       int unicode_character,
diff --git a/chromium/content/public/browser/navigation_controller.h b/chromium/content/public/browser/navigation_controller.h
index 3bd12f4efc2..3e4fe938dd9 100644
--- a/chromium/content/public/browser/navigation_controller.h
+++ b/chromium/content/public/browser/navigation_controller.h
@@ -24,6 +24,7 @@
 #include "content/public/browser/site_instance.h"
 #include "content/public/common/referrer.h"
 #include "services/network/public/cpp/resource_request_body.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
 
@@ -101,7 +102,8 @@ class NavigationController {
       ui::PageTransition transition,
       bool is_renderer_initiated,
       const std::string& extra_headers,
-      BrowserContext* browser_context);
+      BrowserContext* browser_context,
+      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory);
 
   // Extra optional parameters for LoadURLWithParams.
   struct CONTENT_EXPORT LoadURLParams {
@@ -199,10 +201,8 @@ class NavigationController {
     // Indicates whether or not this navigation was initiated via context menu.
     bool started_from_context_menu;
 
-    // If this event was triggered by an anchor element with a download
-    // attribute, |suggested_filename| will contain the (possibly empty) value
-    // of that attribute.
-    base::Optional<std::string> suggested_filename;
+    // Optional URLLoaderFactory to facilitate navigation to a blob URL.
+    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory;
 
     // This value should only be set for main frame navigations. Subframe
     // navigations will always get their NavigationUIData from
diff --git a/chromium/content/public/browser/navigation_handle.cc b/chromium/content/public/browser/navigation_handle.cc
index a109ce3e70f..f0770fddd3f 100644
--- a/chromium/content/public/browser/navigation_handle.cc
+++ b/chromium/content/public/browser/navigation_handle.cc
@@ -50,7 +50,6 @@ NavigationHandle::CreateNavigationHandleForTesting(
           false,                  // started_from_context_menu
           CSPDisposition::CHECK,  // should_check_main_world_csp
           is_form_submission,     // is_form_submission
-          base::nullopt,          // suggested_filename
           nullptr,                // navigation_ui_data
           method, net::HttpRequestHeaders(), resource_request_body, Referrer(),
           false,  // has_user_gesture
diff --git a/chromium/content/public/browser/navigation_handle.h b/chromium/content/public/browser/navigation_handle.h
index 28e3bf684ee..0ee6b89e56a 100644
--- a/chromium/content/public/browser/navigation_handle.h
+++ b/chromium/content/public/browser/navigation_handle.h
@@ -161,13 +161,10 @@ class CONTENT_EXPORT NavigationHandle {
   // be net::OK.
   virtual net::Error GetNetErrorCode() = 0;
 
-  // Returns the RenderFrameHost this navigation is taking place in. This can
-  // only be accessed after a response has been delivered for processing.
-  //
-  // If PlzNavigate is active, the RenderFrameHost returned will be the final
-  // host for the navigation. If PlzNavigate is inactive, the navigation may
-  // transfer to a new host up until the point that DidFinishNavigation is
-  // called.
+  // Returns the RenderFrameHost this navigation is committing in.  The
+  // RenderFrameHost returned will be the final host for the navigation.  This
+  // can only be accessed after a response has been delivered for processing,
+  // or after the navigation fails with an error page.
   virtual RenderFrameHost* GetRenderFrameHost() = 0;
 
   // Whether the navigation happened without changing document. Examples of
@@ -262,10 +259,6 @@ class CONTENT_EXPORT NavigationHandle {
   // Returns true if this navigation was initiated by a form submission.
   virtual bool IsFormSubmission() = 0;
 
-  // If this navigation was triggered by an anchor with a download attribute,
-  // this returns the (possibly empty) value of that attribute.
-  virtual const base::Optional<std::string>& GetSuggestedFilename() = 0;
-
   // Testing methods ----------------------------------------------------------
   //
   // The following methods should be used exclusively for writing unit tests.
@@ -303,6 +296,7 @@ class CONTENT_EXPORT NavigationHandle {
 
   // Simulates the network request failing.
   virtual NavigationThrottle::ThrottleCheckResult CallWillFailRequestForTesting(
+      RenderFrameHost* render_frame_host,
       base::Optional<net::SSLInfo> ssl_info) = 0;
 
   // Simulates the reception of the network response.
diff --git a/chromium/content/public/browser/network_service_instance.h b/chromium/content/public/browser/network_service_instance.h
index 947fe3f570a..47e20afb942 100644
--- a/chromium/content/public/browser/network_service_instance.h
+++ b/chromium/content/public/browser/network_service_instance.h
@@ -31,8 +31,7 @@ CONTENT_EXPORT network::mojom::NetworkService* GetNetworkService();
 CONTENT_EXPORT network::NetworkService* GetNetworkServiceImpl();
 
 // Call |FlushForTesting()| on cached |NetworkServicePtr|. For testing only.
-// Must only be called on the UI thread. Must not be called if the network
-// service is disabled.
+// Must only be called on the UI thread.
 CONTENT_EXPORT void FlushNetworkServiceInstanceForTesting();
 
 }  // namespace content
diff --git a/chromium/content/public/browser/notification_database_data.h b/chromium/content/public/browser/notification_database_data.h
index f91abcec530..8d1298f0eb1 100644
--- a/chromium/content/public/browser/notification_database_data.h
+++ b/chromium/content/public/browser/notification_database_data.h
@@ -8,6 +8,7 @@
 #include <stdint.h>
 #include <string>
 
+#include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "content/public/common/platform_notification_data.h"
 #include "url/gurl.h"
@@ -17,6 +18,8 @@ namespace content {
 // Stores information about a Web Notification as available in the notification
 // database. Beyond the notification's own data, its id and attribution need
 // to be available for users of the database as well.
+// Note: There are extra properties being stored for UKM logging purposes.
+// TODO(https://crbug.com/842622): Add the UKM that will use these properties.
 struct CONTENT_EXPORT NotificationDatabaseData {
   NotificationDatabaseData();
   NotificationDatabaseData(const NotificationDatabaseData& other);
@@ -24,6 +27,19 @@ struct CONTENT_EXPORT NotificationDatabaseData {
 
   NotificationDatabaseData& operator=(const NotificationDatabaseData& other);
 
+  // Corresponds to why a notification was closed.
+  enum class ClosedReason {
+    // The user explicitly closed the notification.
+    USER,
+
+    // The notification was closed by the developer.
+    DEVELOPER,
+
+    // The notification was found to be closed in the notification database,
+    // but why it was closed was not found.
+    UNKNOWN
+  };
+
   // Id of the notification as assigned by the NotificationIdGenerator.
   std::string notification_id;
 
@@ -35,6 +51,35 @@ struct CONTENT_EXPORT NotificationDatabaseData {
 
   // Platform data of the notification that's being stored.
   PlatformNotificationData notification_data;
+
+  // Boolean for if this current notification is replacing an existing
+  // notification.
+  bool replaced_existing_notification = false;
+
+  // Number of clicks on the notification itself, i.e. clicks on the
+  // notification that take the user to the website. This excludes action
+  // button clicks.
+  int num_clicks = 0;
+
+  // Number of action button clicks.
+  int num_action_button_clicks = 0;
+
+  // Time the notification was first requested to be shown.
+  base::Time creation_time_millis;
+
+  // Amount of time, in ms, between when the notification is shown and the
+  // first click.
+  base::TimeDelta time_until_first_click_millis;
+
+  // Amount of time, in ms, between when the notification is shown and the
+  // last click.
+  base::TimeDelta time_until_last_click_millis;
+
+  // Amount of time, in ms, between when the notification is shown and closed.
+  base::TimeDelta time_until_close_millis;
+
+  // Why the notification was closed.
+  ClosedReason closed_reason = ClosedReason::UNKNOWN;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/notification_event_dispatcher.h b/chromium/content/public/browser/notification_event_dispatcher.h
index 66b91718bfb..2d0b88d1902 100644
--- a/chromium/content/public/browser/notification_event_dispatcher.h
+++ b/chromium/content/public/browser/notification_event_dispatcher.h
@@ -61,7 +61,8 @@ class CONTENT_EXPORT NotificationEventDispatcher {
   virtual void DispatchNonPersistentClickEvent(
       const std::string& notification_id) = 0;
   virtual void DispatchNonPersistentCloseEvent(
-      const std::string& notification_id) = 0;
+      const std::string& notification_id,
+      base::OnceClosure completed_closure) = 0;
 
  protected:
   virtual ~NotificationEventDispatcher() {}
diff --git a/chromium/content/public/browser/notification_types.h b/chromium/content/public/browser/notification_types.h
index 75826c37889..c79b6c34123 100644
--- a/chromium/content/public/browser/notification_types.h
+++ b/chromium/content/public/browser/notification_types.h
@@ -107,8 +107,8 @@ enum NotificationType {
 
   // Indicates that a render process was closed (meaning it exited, but the
   // RenderProcessHost might be reused).  The source will be the corresponding
-  // RenderProcessHost.  The details will be a RendererClosedDetails struct.
-  // This may get sent along with RENDERER_PROCESS_TERMINATED.
+  // RenderProcessHost.  The details will be a ChildProcessTerminationInfo
+  // struct. This may get sent along with RENDERER_PROCESS_TERMINATED.
   // DEPRECATED: Use RenderProcessHostObserver::RenderProcessExited()
   NOTIFICATION_RENDERER_PROCESS_CLOSED,
 
@@ -119,15 +119,20 @@ enum NotificationType {
 
   // This is sent when a RenderWidgetHost is being destroyed. The source is
   // the RenderWidgetHost, the details are not used.
+  // DEPRECATED: Use RenderWidgetHostObserver::RenderWidgetHostDestroyed()
   NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED,
 
-  // Sent after the backing store has been updated but before the widget has
-  // painted. The source is the RenderWidgetHost, the details are not used.
-  NOTIFICATION_RENDER_WIDGET_HOST_DID_COMPLETE_RESIZE_OR_REPAINT,
+  // Sent after the renderer has updated visual properties on the main thread
+  // and committed the change on the compositor thread. The source is the
+  // RenderWidgetHost, the details are not used.
+  NOTIFICATION_RENDER_WIDGET_HOST_DID_UPDATE_VISUAL_PROPERTIES,
 
   // Indicates a RenderWidgetHost has been hidden or restored. The source is
   // the RWH whose visibility changed, the details is a bool set to true if
   // the new state is "visible."
+  //
+  // DEPRECATED:
+  // Use RenderWidgetHostObserver::RenderWidgetHostVisibilityChanged()
   NOTIFICATION_RENDER_WIDGET_VISIBILITY_CHANGED,
 
   // The focused element inside a page has changed.  The source is the
diff --git a/chromium/content/public/browser/overlay_window.h b/chromium/content/public/browser/overlay_window.h
index d8cf4cfec00..553fc063922 100644
--- a/chromium/content/public/browser/overlay_window.h
+++ b/chromium/content/public/browser/overlay_window.h
@@ -36,8 +36,9 @@ class OverlayWindow {
       PictureInPictureWindowController* controller);
 
   virtual bool IsActive() const = 0;
-  virtual void Show() = 0;
   virtual void Close() = 0;
+  virtual void Show() = 0;
+  virtual void Hide() = 0;
   virtual bool IsVisible() const = 0;
   virtual bool IsAlwaysOnTop() const = 0;
   virtual ui::Layer* GetLayer() = 0;
@@ -45,6 +46,16 @@ class OverlayWindow {
   virtual gfx::Rect GetBounds() const = 0;
   virtual void UpdateVideoSize(const gfx::Size& natural_size) = 0;
 
+  // Retrieve the ui::Layers corresponding to the video and controls.
+  virtual ui::Layer* GetVideoLayer() = 0;
+  virtual ui::Layer* GetControlsBackgroundLayer() = 0;
+  virtual ui::Layer* GetCloseControlsLayer() = 0;
+  virtual ui::Layer* GetPlayPauseControlsLayer() = 0;
+
+  // Retrieves the bounds of the media controls.
+  virtual gfx::Rect GetCloseControlsBounds() = 0;
+  virtual gfx::Rect GetPlayPauseControlsBounds() = 0;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(OverlayWindow);
 };
diff --git a/chromium/content/public/browser/overscroll_configuration.h b/chromium/content/public/browser/overscroll_configuration.h
index 1cfca76392c..9df88576bf2 100644
--- a/chromium/content/public/browser/overscroll_configuration.h
+++ b/chromium/content/public/browser/overscroll_configuration.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_OVERSCROLL_CONFIGURATION_H_
 
 #include "base/macros.h"
+#include "base/time/time.h"
 #include "content/common/content_export.h"
 
 namespace content {
@@ -62,6 +63,8 @@ class CONTENT_EXPORT OverscrollConfig {
 
   static bool TouchpadOverscrollHistoryNavigationEnabled();
 
+  static base::TimeDelta MaxInertialEventsBeforeOverscrollCancellation();
+
  private:
   friend class ScopedHistoryNavigationMode;
   friend class ScopedPullToRefreshMode;
diff --git a/chromium/content/public/browser/page_navigator.h b/chromium/content/public/browser/page_navigator.h
index a7572a8b7b8..801566bf79f 100644
--- a/chromium/content/public/browser/page_navigator.h
+++ b/chromium/content/public/browser/page_navigator.h
@@ -21,6 +21,7 @@
 #include "content/public/common/referrer.h"
 #include "ipc/ipc_message.h"
 #include "services/network/public/cpp/resource_request_body.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "third_party/blink/public/web/web_triggering_event_info.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
@@ -108,10 +109,8 @@ struct CONTENT_EXPORT OpenURLParams {
   // Indicates whether this navigation was started via context menu.
   bool started_from_context_menu;
 
-  // If this event was triggered by an anchor element with a download
-  // attribute, |suggested_filename| will contain the (possibly empty) value of
-  // that attribute.
-  base::Optional<std::string> suggested_filename;
+  // Optional URLLoaderFactory to facilitate navigation to a blob URL.
+  scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory;
 
   // Indicates that the navigation should happen in an app window if
   // possible, i.e. if an app for the URL is installed.
diff --git a/chromium/content/public/browser/payment_app_provider.h b/chromium/content/public/browser/payment_app_provider.h
index 8e13ae5638e..bde13864ff4 100644
--- a/chromium/content/public/browser/payment_app_provider.h
+++ b/chromium/content/public/browser/payment_app_provider.h
@@ -75,6 +75,17 @@ class CONTENT_EXPORT PaymentAppProvider {
   virtual void SetOpenedWindow(WebContents* web_contents) = 0;
   virtual void CloseOpenedWindow(BrowserContext* browser_context) = 0;
 
+  // Notify the opened payment handler window is closing or closed by user so as
+  // to abort payment request.
+  virtual void OnClosingOpenedWindow(BrowserContext* browser_context) = 0;
+
+  // Check whether given |sw_js_url| from |manifest_url| is allowed to register
+  // with |sw_scope|.
+  virtual bool IsValidInstallablePaymentApp(const GURL& manifest_url,
+                                            const GURL& sw_js_url,
+                                            const GURL& sw_scope,
+                                            std::string* error_message) = 0;
+
  protected:
   virtual ~PaymentAppProvider() {}
 };
diff --git a/chromium/content/public/browser/picture_in_picture_window_controller.h b/chromium/content/public/browser/picture_in_picture_window_controller.h
index e5c6b2a8447..a6292fa8e29 100644
--- a/chromium/content/public/browser/picture_in_picture_window_controller.h
+++ b/chromium/content/public/browser/picture_in_picture_window_controller.h
@@ -33,14 +33,22 @@ class PictureInPictureWindowController {
 
   virtual ~PictureInPictureWindowController() = default;
 
-  virtual void Show() = 0;
+  // Shows the Picture-in-Picture window.
+  // Returns the size of the window in pixels.
+  virtual gfx::Size Show() = 0;
+
   virtual void Close() = 0;
   virtual void EmbedSurface(const viz::SurfaceId& surface_id,
                             const gfx::Size& natural_size) = 0;
   virtual OverlayWindow* GetWindowForTesting() = 0;
+  virtual void UpdateLayerBounds() = 0;
+  virtual bool IsPlayerActive() = 0;
+  virtual WebContents* GetInitiatorWebContents() = 0;
 
   // Commands.
-  virtual void TogglePlayPause() = 0;
+  // Returns true if the player is active (i.e. currently playing) after this
+  // call.
+  virtual bool TogglePlayPause() = 0;
 
  protected:
   // Use PictureInPictureWindowController::GetOrCreateForWebContents() to
diff --git a/chromium/content/public/browser/presentation_service_delegate.h b/chromium/content/public/browser/presentation_service_delegate.h
index 63ff87336bf..4c1b22497e1 100644
--- a/chromium/content/public/browser/presentation_service_delegate.h
+++ b/chromium/content/public/browser/presentation_service_delegate.h
@@ -14,7 +14,6 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/media_controller.h"
 #include "content/public/common/presentation_connection_message.h"
-#include "content/public/common/presentation_info.h"
 #include "third_party/blink/public/platform/modules/presentation/presentation.mojom.h"
 
 namespace content {
@@ -23,23 +22,25 @@ struct PresentationRequest;
 class PresentationScreenAvailabilityListener;
 
 using PresentationConnectionCallback =
-    base::OnceCallback<void(const PresentationInfo&)>;
+    base::OnceCallback<void(const blink::mojom::PresentationInfo&)>;
 using PresentationConnectionErrorCallback =
-    base::OnceCallback<void(const PresentationError&)>;
+    base::OnceCallback<void(const blink::mojom::PresentationError&)>;
 using DefaultPresentationConnectionCallback =
-    base::RepeatingCallback<void(const PresentationInfo&)>;
+    base::RepeatingCallback<void(const blink::mojom::PresentationInfo&)>;
 
 struct PresentationConnectionStateChangeInfo {
   explicit PresentationConnectionStateChangeInfo(
-      PresentationConnectionState state)
+      blink::mojom::PresentationConnectionState state)
       : state(state),
-        close_reason(PRESENTATION_CONNECTION_CLOSE_REASON_CONNECTION_ERROR) {}
+        close_reason(
+            blink::mojom::PresentationConnectionCloseReason::CONNECTION_ERROR) {
+  }
   ~PresentationConnectionStateChangeInfo() = default;
 
-  PresentationConnectionState state;
+  blink::mojom::PresentationConnectionState state;
 
   // |close_reason| and |messsage| are only used for state change to CLOSED.
-  PresentationConnectionCloseReason close_reason;
+  blink::mojom::PresentationConnectionCloseReason close_reason;
   std::string message;
 };
 
@@ -51,7 +52,7 @@ using PresentationConnectionRequest =
     blink::mojom::PresentationConnectionRequest;
 
 using ReceiverConnectionAvailableCallback =
-    base::RepeatingCallback<void(const content::PresentationInfo&,
+    base::RepeatingCallback<void(blink::mojom::PresentationInfoPtr,
                                  PresentationConnectionPtr,
                                  PresentationConnectionRequest)>;
 
@@ -121,7 +122,7 @@ class CONTENT_EXPORT ControllerPresentationServiceDelegate
 
   // Sets the default presentation URLs represented by |request|. When the
   // default presentation is started on this frame, |callback| will be invoked
-  // with the corresponding PresentationInfo object.
+  // with the corresponding blink::mojom::PresentationInfo object.
   // If |request.presentation_urls| is empty, the default presentation URLs will
   // be cleared and the previously registered callback (if any) will be removed.
   virtual void SetDefaultPresentationUrls(
@@ -187,7 +188,7 @@ class CONTENT_EXPORT ControllerPresentationServiceDelegate
   virtual void ListenForConnectionStateChange(
       int render_process_id,
       int render_frame_id,
-      const PresentationInfo& connection,
+      const blink::mojom::PresentationInfo& connection,
       const PresentationConnectionStateChangedCallback& state_changed_cb) = 0;
 
   // Connect |controller_connection| owned by the controlling frame to the
@@ -200,7 +201,7 @@ class CONTENT_EXPORT ControllerPresentationServiceDelegate
   virtual void ConnectToPresentation(
       int render_process_id,
       int render_frame_id,
-      const PresentationInfo& presentation_info,
+      const blink::mojom::PresentationInfo& presentation_info,
       PresentationConnectionPtr controller_connection_ptr,
       PresentationConnectionRequest receiver_connection_request) = 0;
 };
diff --git a/chromium/content/public/browser/provision_fetcher_factory.h b/chromium/content/public/browser/provision_fetcher_factory.h
index cd9eca15668..32313e4c222 100644
--- a/chromium/content/public/browser/provision_fetcher_factory.h
+++ b/chromium/content/public/browser/provision_fetcher_factory.h
@@ -13,8 +13,8 @@ namespace media {
 class ProvisionFetcher;
 }
 
-namespace net {
-class URLRequestContextGetter;
+namespace network {
+class SharedURLLoaderFactory;
 }
 
 namespace content {
@@ -23,7 +23,7 @@ namespace content {
 
 CONTENT_EXPORT
 std::unique_ptr<media::ProvisionFetcher> CreateProvisionFetcher(
-    net::URLRequestContextGetter* context_getter);
+    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory);
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/provision_fetcher_impl.cc b/chromium/content/public/browser/provision_fetcher_impl.cc
index 77dab1fa220..0f5775edb2a 100644
--- a/chromium/content/public/browser/provision_fetcher_impl.cc
+++ b/chromium/content/public/browser/provision_fetcher_impl.cc
@@ -6,18 +6,19 @@
 
 #include "content/public/browser/provision_fetcher_factory.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
-#include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
 
 namespace content {
 
 // static
 void ProvisionFetcherImpl::Create(
-    net::URLRequestContextGetter* context_getter,
+    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
     media::mojom::ProvisionFetcherRequest request) {
-  DCHECK(context_getter);
-  mojo::MakeStrongBinding(std::make_unique<ProvisionFetcherImpl>(
-                              CreateProvisionFetcher(context_getter)),
-                          std::move(request));
+  DCHECK(url_loader_factory);
+  mojo::MakeStrongBinding(
+      std::make_unique<ProvisionFetcherImpl>(
+          CreateProvisionFetcher(std::move(url_loader_factory))),
+      std::move(request));
 }
 
 ProvisionFetcherImpl::ProvisionFetcherImpl(
diff --git a/chromium/content/public/browser/provision_fetcher_impl.h b/chromium/content/public/browser/provision_fetcher_impl.h
index 5e58a293052..6b3106f901c 100644
--- a/chromium/content/public/browser/provision_fetcher_impl.h
+++ b/chromium/content/public/browser/provision_fetcher_impl.h
@@ -14,9 +14,9 @@
 #include "media/base/provision_fetcher.h"
 #include "media/mojo/interfaces/provision_fetcher.mojom.h"
 
-namespace net {
-class URLRequestContextGetter;
-}
+namespace network {
+class SharedURLLoaderFactory;
+}  // namespace network
 
 namespace content {
 
@@ -25,8 +25,9 @@ namespace content {
 class CONTENT_EXPORT ProvisionFetcherImpl
     : public media::mojom::ProvisionFetcher {
  public:
-  static void Create(net::URLRequestContextGetter* context_getter,
-                     media::mojom::ProvisionFetcherRequest request);
+  static void Create(
+      scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
+      media::mojom::ProvisionFetcherRequest request);
 
   explicit ProvisionFetcherImpl(
       std::unique_ptr<media::ProvisionFetcher> provision_fetcher);
diff --git a/chromium/content/public/browser/render_frame_host.h b/chromium/content/public/browser/render_frame_host.h
index 4a3ea81bca5..f5dced5b834 100644
--- a/chromium/content/public/browser/render_frame_host.h
+++ b/chromium/content/public/browser/render_frame_host.h
@@ -273,15 +273,6 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // RenderFrame. See BindingsPolicy for details.
   virtual int GetEnabledBindings() const = 0;
 
-  // Causes all new requests for the root RenderFrameHost and its children to
-  // be blocked (not being started) until ResumeBlockedRequestsForFrame is
-  // called.
-  virtual void BlockRequestsForFrame() = 0;
-
-  // Resumes any blocked request for the specified root RenderFrameHost and
-  // child frame hosts.
-  virtual void ResumeBlockedRequestsForFrame() = 0;
-
 #if defined(OS_ANDROID)
   // Returns an InterfaceProvider for Java-implemented interfaces that are
   // scoped to this RenderFrameHost. This provides access to interfaces
diff --git a/chromium/content/public/browser/render_frame_metadata_provider.h b/chromium/content/public/browser/render_frame_metadata_provider.h
index b64eeddbdc1..6ee7068fcdd 100644
--- a/chromium/content/public/browser/render_frame_metadata_provider.h
+++ b/chromium/content/public/browser/render_frame_metadata_provider.h
@@ -31,6 +31,13 @@ class CONTENT_EXPORT RenderFrameMetadataProvider {
 
     virtual void OnRenderFrameMetadataChanged() = 0;
     virtual void OnRenderFrameSubmission() = 0;
+
+    // Called to indicate that the viz::LocalSurfaceId within the
+    // RenderFrameMetadata has changed. Note that this is called as
+    // soon as |metadata| arrives and does not wait for the frame token
+    // to pass in Viz.
+    virtual void OnLocalSurfaceIdChanged(
+        const cc::RenderFrameMetadata& metadata) = 0;
   };
 
   RenderFrameMetadataProvider() = default;
diff --git a/chromium/content/public/browser/render_process_host.h b/chromium/content/public/browser/render_process_host.h
index 30213bbbf09..df65dddfb96 100644
--- a/chromium/content/public/browser/render_process_host.h
+++ b/chromium/content/public/browser/render_process_host.h
@@ -9,10 +9,12 @@
 #include <stdint.h>
 
 #include <list>
+#include <memory>
+#include <string>
 
 #include "base/containers/id_map.h"
 #include "base/process/kill.h"
-#include "base/process/process_handle.h"
+#include "base/process/process.h"
 #include "base/supports_user_data.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
@@ -20,6 +22,7 @@
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_sender.h"
 #include "media/media_buildflags.h"
+#include "third_party/blink/public/platform/modules/cache_storage/cache_storage.mojom.h"
 #include "ui/gfx/native_widget_types.h"
 
 #if defined(OS_ANDROID)
@@ -41,10 +44,6 @@ namespace resource_coordinator {
 class ProcessResourceCoordinator;
 }
 
-namespace viz {
-class SharedBitmapAllocationNotifierImpl;
-}
-
 namespace content {
 class BrowserContext;
 class BrowserMessageFilter;
@@ -52,7 +51,6 @@ class RenderProcessHostObserver;
 class RenderWidgetHost;
 class RendererAudioOutputStreamFactoryContext;
 class StoragePartition;
-struct GlobalRequestID;
 
 #if defined(OS_ANDROID)
 enum class ChildProcessImportance;
@@ -93,17 +91,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
     virtual ~PriorityClient() {}
   };
 
-  // Details for RENDERER_PROCESS_CLOSED notifications.
-  struct RendererClosedDetails {
-    RendererClosedDetails(base::TerminationStatus status,
-                          int exit_code) {
-      this->status = status;
-      this->exit_code = exit_code;
-    }
-    base::TerminationStatus status;
-    int exit_code;
-  };
-
   // Crash reporting mode for ShutdownForBadMessage.
   enum class CrashReportMode {
     NO_CRASH_DUMP,
@@ -159,7 +146,7 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   virtual int VisibleClientCount() const = 0;
 
   // Get computed frame depth from PriorityClients.
-  virtual unsigned int GetFrameDepthForTesting() const = 0;
+  virtual unsigned int GetFrameDepth() const = 0;
 
   virtual RendererAudioOutputStreamFactoryContext*
   GetRendererAudioOutputStreamFactoryContext() = 0;
@@ -206,7 +193,7 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // Init starts the process asynchronously.  It's guaranteed to be valid after
   // the first IPC arrives or RenderProcessReady was called on a
   // RenderProcessHostObserver for this. At that point, IsReady() returns true.
-  virtual base::ProcessHandle GetHandle() const = 0;
+  virtual const base::Process& GetProcess() const = 0;
 
   // Returns whether the process is ready. The process is ready once both
   // conditions (which can happen in arbitrary order) are true:
@@ -234,8 +221,14 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // This will never return ChildProcessHost::kInvalidUniqueID.
   virtual int GetID() const = 0;
 
-  // Returns true iff channel_ has been set to non-nullptr. Use this for
-  // checking if there is connection or not. Virtual for mocking out for tests.
+  // Returns true iff the Init() was called and the process hasn't died yet.
+  //
+  // Note that even if HasConnection() returns true, then (for a short duration
+  // after calling Init()) the process might not be fully spawned *yet* - e.g.
+  // IsReady() might return false and GetProcess() might still return an invalid
+  // process with a null handle.
+  //
+  // TODO(lukasza): Rename to IsInitializedAndNotDead().
   virtual bool HasConnection() const = 0;
 
   // Returns the renderer channel.
@@ -282,7 +275,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // |empty_allowed| must be set to false for navigations for security reasons.
   virtual void FilterURL(bool empty_allowed, GURL* url) = 0;
 
-#if BUILDFLAG(ENABLE_WEBRTC)
   virtual void EnableAudioDebugRecordings(const base::FilePath& file) = 0;
   virtual void DisableAudioDebugRecordings() = 0;
 
@@ -317,11 +309,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // Start/stop event log output from WebRTC on this RPH for the peer connection
   // identified locally within the RPH using the ID |lid|.
   virtual void SetWebRtcEventLogOutput(int lid, bool enabled) = 0;
-#endif
-
-  // Tells the ResourceDispatcherHost to resume a deferred navigation without
-  // transferring it to a new renderer process.
-  virtual void ResumeDeferredNavigation(const GlobalRequestID& request_id) = 0;
 
   // Binds interfaces exposed to the browser process from the renderer.
   virtual void BindInterface(const std::string& interface_name,
@@ -351,6 +338,7 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
     kServiceWorker = 0,
     kSharedWorker = 1,
     kFetch = 2,
+    kUnload = 3,
   };
   // "Keep alive ref count" represents the number of the customers of this
   // render process who wish the renderer process to be alive. While the ref
@@ -373,6 +361,10 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   //    When a fetch request with keepalive flag
   //    (https://fetch.spec.whatwg.org/#request-keepalive-flag) specified is
   //    pending, it wishes the renderer process to be kept alive.
+  //  - Unload handlers:
+  //    Keeps the process alive briefly to give subframe unload handlers a
+  //    chance to execute after their parent frame navigates or is detached.
+  //    See https://crbug.com/852204.
   virtual void IncrementKeepAliveRefCount(KeepAliveClientType) = 0;
   virtual void DecrementKeepAliveRefCount(KeepAliveClientType) = 0;
 
@@ -428,6 +420,12 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // crbug.com/738634.
   virtual bool HostHasNotBeenUsed() = 0;
 
+  // Binds |request| to the CacheStorageDispatcherHost instance. The binding is
+  // sent to the IO thread. This is for internal use only, and is only exposed
+  // here to support MockRenderProcessHost usage in tests.
+  virtual void BindCacheStorage(blink::mojom::CacheStorageRequest request,
+                                const url::Origin& origin) = 0;
+
   // Returns the current number of active views in this process.  Excludes
   // any RenderViewHosts that are swapped out.
   size_t GetActiveViewCount();
@@ -439,12 +437,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // be posted back on the UI thread).
   void PostTaskWhenProcessIsReady(base::OnceClosure task);
 
-  // Returns the SharedBitmapAllocationNotifier associated with this process.
-  // SharedBitmapAllocationNotifier manages viz::SharedBitmaps created by this
-  // process and can notify observers when a new SharedBitmap is allocated.
-  virtual viz::SharedBitmapAllocationNotifierImpl*
-  GetSharedBitmapAllocationNotifier() = 0;
-
   // Static management functions -----------------------------------------------
 
   // Possibly start an unbound, spare RenderProcessHost. A subsequent creation
diff --git a/chromium/content/public/browser/render_process_host_observer.h b/chromium/content/public/browser/render_process_host_observer.h
index 3aeec100526..2cfd0cc25bd 100644
--- a/chromium/content/public/browser/render_process_host_observer.h
+++ b/chromium/content/public/browser/render_process_host_observer.h
@@ -12,6 +12,7 @@
 namespace content {
 
 class RenderProcessHost;
+struct ChildProcessTerminationInfo;
 
 // An observer API implemented by classes which are interested
 // in RenderProcessHost lifecycle events.
@@ -46,13 +47,8 @@ class CONTENT_EXPORT RenderProcessHostObserver {
   // active renderer process for the top-level frame; for code that needs to be
   // a WebContentsObserver anyway, consider whether that API might be a better
   // choice.
-  //
-  // If |status| is TERMINATION_STATUS_LAUNCH_FAILED then |exit_code| will
-  // contain a platform specific launch failure error code. Otherwise, it will
-  // contain the exit code for the process.
   virtual void RenderProcessExited(RenderProcessHost* host,
-                                   base::TerminationStatus status,
-                                   int exit_code) {}
+                                   const ChildProcessTerminationInfo& info) {}
 
   // This method is invoked when the observed RenderProcessHost itself is
   // destroyed. This is guaranteed to be the last call made to the observer, so
diff --git a/chromium/content/public/browser/render_widget_host.h b/chromium/content/public/browser/render_widget_host.h
index d0ea640fac2..f547b65c75b 100644
--- a/chromium/content/public/browser/render_widget_host.h
+++ b/chromium/content/public/browser/render_widget_host.h
@@ -39,6 +39,7 @@ namespace content {
 struct CursorInfo;
 class RenderProcessHost;
 class RenderWidgetHostIterator;
+class RenderWidgetHostObserver;
 class RenderWidgetHostView;
 struct ScreenInfo;
 
@@ -76,8 +77,8 @@ struct ScreenInfo;
 // the render process dies, the RenderWidgetHostView goes away and all
 // references to it must become nullptr.
 //
-// RenderViewHost (a RenderWidgetHost subclass) is the conduit used to
-// communicate with the RenderView and is owned by the WebContents. If the
+// RenderViewHost (an owner delegate for RenderWidgetHost) is the conduit used
+// to communicate with the RenderView and is owned by the WebContents. If the
 // render process crashes, the RenderViewHost remains and restarts the render
 // process if needed to continue navigation.
 //
@@ -92,9 +93,9 @@ struct ScreenInfo;
 // For select popups, the situation is a little different. The RenderWidgetHost
 // associated with the select popup owns the view and itself (is responsible
 // for destroying itself when the view is closed). The WebContents's only
-// responsibility is to select popups is to create them when it is told to. When
-// the View is destroyed via an IPC message (for when WebCore destroys the
-// popup, e.g. if the user selects one of the options), or because
+// responsibility with select popups is to create them when it is told to. When
+// the View is destroyed via an IPC message (triggered when WebCore destroys
+// the popup, e.g. if the user selects one of the options), or because
 // WM_CANCELMODE is received by the view, the View schedules the destruction of
 // the render process. However in this case since there's no WebContents
 // container, when the render process is destroyed, the RenderWidgetHost just
@@ -207,8 +208,9 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
 
   virtual void SetIgnoreInputEvents(bool ignore_input_events) = 0;
 
-  // Called to notify the RenderWidget that it has been resized.
-  virtual void WasResized() = 0;
+  // Called to propagate updated visual properties to the renderer. Returns
+  // whether the renderer has been informed of updated properties.
+  virtual bool SynchronizeVisualProperties() = 0;
 
   // Access to the implementation's IPC::Listener::OnMessageReceived. Intended
   // only for test code.
@@ -241,6 +243,12 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   virtual void AddInputEventObserver(InputEventObserver* observer) = 0;
   virtual void RemoveInputEventObserver(InputEventObserver* observer) = 0;
 
+  // Add and remove observers for widget host events. The order in which
+  // notifications are sent to observers is undefined. Observers must be sure to
+  // remove the observer before they go away.
+  virtual void AddObserver(RenderWidgetHostObserver* observer) = 0;
+  virtual void RemoveObserver(RenderWidgetHostObserver* observer) = 0;
+
   // Get the screen info corresponding to this render widget.
   virtual void GetScreenInfo(ScreenInfo* result) = 0;
 
diff --git a/chromium/content/public/browser/render_widget_host_observer.h b/chromium/content/public/browser/render_widget_host_observer.h
new file mode 100644
index 00000000000..88778577aa9
--- /dev/null
+++ b/chromium/content/public/browser/render_widget_host_observer.h
@@ -0,0 +1,33 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_OBSERVER_H_
+#define CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_OBSERVER_H_
+
+#include "content/common/content_export.h"
+
+namespace content {
+
+class RenderWidgetHost;
+
+// An observer API implemented by classes which are interested
+// in RenderWidgetHost events.
+class CONTENT_EXPORT RenderWidgetHostObserver {
+ public:
+  // This method is invoked when the visibility of the RenderWidgetHost changes.
+  virtual void RenderWidgetHostVisibilityChanged(RenderWidgetHost* widget_host,
+                                                 bool became_visible) {}
+
+  // This method is invoked when the observed RenderWidgetHost is destroyed.
+  // This is guaranteed to be the last call made to the observer, so if the
+  // observer is tied to the observed RenderWidgetHost, it is safe to delete it.
+  virtual void RenderWidgetHostDestroyed(RenderWidgetHost* widget_host) {}
+
+ protected:
+  virtual ~RenderWidgetHostObserver() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_OBSERVER_H_
diff --git a/chromium/content/public/browser/render_widget_host_view.h b/chromium/content/public/browser/render_widget_host_view.h
index 1ced1c489b4..0f2bbdcf4b2 100644
--- a/chromium/content/public/browser/render_widget_host_view.h
+++ b/chromium/content/public/browser/render_widget_host_view.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_VIEW_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_VIEW_H_
 
+#include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
 #include "base/optional.h"
 #include "base/strings/string16.h"
@@ -22,20 +23,13 @@ class Rect;
 class Size;
 }
 
-namespace mojo {
-template <class T>
-class InterfacePtr;
-}
-
 namespace ui {
+enum class DomCode;
 class TextInputClient;
 }
 
 namespace viz {
-namespace mojom {
-class FrameSinkVideoCapturer;
-using FrameSinkVideoCapturerPtr = mojo::InterfacePtr<FrameSinkVideoCapturer>;
-}  // namespace mojom
+class ClientFrameSinkVideoCapturer;
 }  // namespace viz
 
 namespace content {
@@ -157,11 +151,11 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // has to be either SK_ColorTRANSPARENT or opaque. If set to
   // SK_ColorTRANSPARENT, the renderer's background color will be overridden to
   // be fully transparent.
+  // SetBackgroundColor is called to set the default color of the view,
+  // which is shown if the background color of the renderer is not available.
   virtual void SetBackgroundColor(SkColor color) = 0;
-  virtual SkColor background_color() const = 0;
-  // Convenience method to fill the background layer with the default color by
-  // calling |SetBackgroundColor|.
-  virtual void SetBackgroundColorToDefault() = 0;
+  // GetBackgroundColor returns the current background color of the view.
+  virtual base::Optional<SkColor> GetBackgroundColor() const = 0;
 
   // Return value indicates whether the mouse is locked successfully or not.
   virtual bool LockMouse() = 0;
@@ -170,11 +164,17 @@ class CONTENT_EXPORT RenderWidgetHostView {
   virtual bool IsMouseLocked() = 0;
 
   // Start/Stop intercepting future system keyboard events.
-  virtual bool LockKeyboard(base::Optional<base::flat_set<int>> keys) = 0;
+  virtual bool LockKeyboard(
+      base::Optional<base::flat_set<ui::DomCode>> dom_codes) = 0;
   virtual void UnlockKeyboard() = 0;
   // Returns true if keyboard lock is active.
   virtual bool IsKeyboardLocked() = 0;
 
+  // Return a mapping dictionary from keyboard code to key values for the
+  // highest-priority ASCII-capable layout in the list of currently installed
+  // keyboard layouts.
+  virtual base::flat_map<std::string, std::string> GetKeyboardLayoutMap() = 0;
+
   // Retrives the size of the viewport for the visible region. May be smaller
   // than the view size if a portion of the view is obstructed (e.g. by a
   // virtual keyboard).
@@ -184,8 +184,7 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // visible viewport.
   virtual void SetInsets(const gfx::Insets& insets) = 0;
 
-  // Returns true if the current display surface is available, a prerequisite
-  // for CopyFromSurface() to succeed.
+  // Returns true if the current display surface is available.
   virtual bool IsSurfaceAvailableForCopy() const = 0;
 
   // Copies the given subset of the view's surface, optionally scales it, and
@@ -214,11 +213,16 @@ class CONTENT_EXPORT RenderWidgetHostView {
       const gfx::Size& output_size,
       base::OnceCallback<void(const SkBitmap&)> callback) = 0;
 
+  // Ensures that all surfaces are synchronized for the next call to
+  // CopyFromSurface. This is used by LayoutTests.
+  virtual void EnsureSurfaceSynchronizedForLayoutTest() = 0;
+
   // Creates a video capturer, which will allow the caller to receive a stream
   // of media::VideoFrames captured from this view. The capturer is configured
   // to target this view, so there is no need to call ChangeTarget() before
   // Start(). See viz.mojom.FrameSinkVideoCapturer for documentation.
-  virtual viz::mojom::FrameSinkVideoCapturerPtr CreateVideoCapturer() = 0;
+  virtual std::unique_ptr<viz::ClientFrameSinkVideoCapturer>
+  CreateVideoCapturer() = 0;
 
   // Notification that a node was touched.
   // The |editable| parameter indicates if the node is editable, for e.g.
diff --git a/chromium/content/public/browser/resource_dispatcher_host_delegate.cc b/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
index 838ec2e1295..ac7f3cb63d2 100644
--- a/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
+++ b/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
@@ -12,14 +12,6 @@ namespace content {
 
 ResourceDispatcherHostDelegate::~ResourceDispatcherHostDelegate() {}
 
-bool ResourceDispatcherHostDelegate::ShouldBeginRequest(
-    const std::string& method,
-    const GURL& url,
-    ResourceType resource_type,
-    ResourceContext* resource_context) {
-  return true;
-}
-
 void ResourceDispatcherHostDelegate::RequestBeginning(
     net::URLRequest* request,
     ResourceContext* resource_context,
diff --git a/chromium/content/public/browser/resource_dispatcher_host_delegate.h b/chromium/content/public/browser/resource_dispatcher_host_delegate.h
index 8a11639fba0..f0f9b73a62c 100644
--- a/chromium/content/public/browser/resource_dispatcher_host_delegate.h
+++ b/chromium/content/public/browser/resource_dispatcher_host_delegate.h
@@ -37,12 +37,6 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
  public:
   virtual ~ResourceDispatcherHostDelegate();
 
-  // Called when a request begins. Return false to abort the request.
-  virtual bool ShouldBeginRequest(const std::string& method,
-                                  const GURL& url,
-                                  ResourceType resource_type,
-                                  ResourceContext* resource_context);
-
   // Called after ShouldBeginRequest to allow the embedder to add resource
   // throttles.
   virtual void RequestBeginning(
diff --git a/chromium/content/public/browser/resource_hints.h b/chromium/content/public/browser/resource_hints.h
index 0364cf0e627..e5b293eaa3a 100644
--- a/chromium/content/public/browser/resource_hints.h
+++ b/chromium/content/public/browser/resource_hints.h
@@ -27,13 +27,11 @@ namespace content {
 // coalesce. |allow_credentials| corresponds to the fetch spec.
 // Note: This should only be called on the IO thread, with a valid
 // URLRequestContextGetter.
-CONTENT_EXPORT void PreconnectUrl(
-    net::URLRequestContextGetter* getter,
-    const GURL& url,
-    const GURL& site_for_cookies,
-    int count,
-    bool allow_credentials,
-    net::HttpRequestInfo::RequestMotivation motivation);
+CONTENT_EXPORT void PreconnectUrl(net::URLRequestContextGetter* getter,
+                                  const GURL& url,
+                                  const GURL& site_for_cookies,
+                                  int count,
+                                  bool allow_credentials);
 
 // Issues a DNS request to |url|. Note that these requests are sent to the host
 // resolver with priority net::IDLE.
diff --git a/chromium/content/public/browser/resource_request_info.h b/chromium/content/public/browser/resource_request_info.h
index 6e05dd71c37..dee1f061b99 100644
--- a/chromium/content/public/browser/resource_request_info.h
+++ b/chromium/content/public/browser/resource_request_info.h
@@ -12,6 +12,7 @@
 #include "content/public/browser/navigation_ui_data.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/resource_type.h"
+#include "third_party/blink/public/platform/resource_request_blocked_reason.h"
 #include "third_party/blink/public/platform/web_referrer_policy.h"
 #include "ui/base/page_transition_types.h"
 
@@ -183,9 +184,14 @@ class ResourceRequestInfo {
     kNotCanceled,
   };
 
-  // If and why this request was canceled by DevTools.
+  // If and why this request was canceled by DevTools. TODO(johannes): Remove.
   virtual DevToolsStatus GetDevToolsStatus() const = 0;
 
+  // For net::ERR_BLOCKED_BY_CLIENT and net::ERR_BLOCKED_BY_RESPONSE
+  // errors, this will return the reason, otherwise base::nullopt.
+  virtual base::Optional<blink::ResourceRequestBlockedReason>
+  GetResourceRequestBlockedReason() const = 0;
+
   // When the client of a request decides to cancel it, it may optionally
   // provide an application-defined description of the canncellation reason.
   // This method returns the custom reason. If no such reason has been provided,
diff --git a/chromium/content/public/browser/screen_orientation_delegate.h b/chromium/content/public/browser/screen_orientation_delegate.h
index 6862cc4145e..aed3680b1fa 100644
--- a/chromium/content/public/browser/screen_orientation_delegate.h
+++ b/chromium/content/public/browser/screen_orientation_delegate.h
@@ -7,7 +7,7 @@
 
 #include "base/macros.h"
 #include "content/common/content_export.h"
-#include "third_party/blink/public/platform/modules/screen_orientation/web_screen_orientation_lock_type.h"
+#include "third_party/blink/public/common/screen_orientation/web_screen_orientation_lock_type.h"
 
 namespace content {
 
diff --git a/chromium/content/public/browser/service_worker_context_observer.h b/chromium/content/public/browser/service_worker_context_observer.h
index 2fc757d673e..1f1b3b8315a 100644
--- a/chromium/content/public/browser/service_worker_context_observer.h
+++ b/chromium/content/public/browser/service_worker_context_observer.h
@@ -12,7 +12,11 @@ namespace content {
 class ServiceWorkerContextObserver {
  public:
   // Called when a service worker has been registered with scope |pattern|.
-  virtual void OnRegistrationStored(const GURL& pattern) {}
+  //
+  // This is called when the ServiceWorkerContainer.register() promise is
+  // resolved, which happens before the service worker registration is persisted
+  // to disk.
+  virtual void OnRegistrationCompleted(const GURL& pattern) {}
 
  protected:
   virtual ~ServiceWorkerContextObserver() {}
diff --git a/chromium/content/public/browser/site_isolation_policy.cc b/chromium/content/public/browser/site_isolation_policy.cc
index aa1599deaae..f6736b39a3b 100644
--- a/chromium/content/public/browser/site_isolation_policy.cc
+++ b/chromium/content/public/browser/site_isolation_policy.cc
@@ -72,11 +72,6 @@ bool SiteIsolationPolicy::IsTopDocumentIsolationEnabled() {
   if (UseDedicatedProcessesForAllSites())
     return false;
 
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kDisableSiteIsolationTrials)) {
-    return false;
-  }
-
   // The feature needs to be checked last, because checking the feature
   // activates the field trial and assigns the client either to a control or an
   // experiment group - such assignment should be final.
@@ -105,7 +100,11 @@ bool SiteIsolationPolicy::AreIsolatedOriginsEnabled() {
 }
 
 // static
+bool SiteIsolationPolicy::IsErrorPageIsolationEnabled(bool in_main_frame) {
+  return GetContentClient()->browser()->ShouldIsolateErrorPage(in_main_frame);
+}
 
+// static
 bool SiteIsolationPolicy::ShouldPdfCompositorBeEnabledForOopifs() {
   // TODO(weili): We only create pdf compositor client and use pdf compositor
   // service when site-per-process or isolate-origins flag/feature is enabled,
diff --git a/chromium/content/public/browser/site_isolation_policy.h b/chromium/content/public/browser/site_isolation_policy.h
index 06e13c0d98a..e0edfc6e8ee 100644
--- a/chromium/content/public/browser/site_isolation_policy.h
+++ b/chromium/content/public/browser/site_isolation_policy.h
@@ -43,6 +43,9 @@ class CONTENT_EXPORT SiteIsolationPolicy {
   // Returns true if isolated origins feature is enabled.
   static bool AreIsolatedOriginsEnabled();
 
+  // Returns true if error page isolation is enabled.
+  static bool IsErrorPageIsolationEnabled(bool in_main_frame);
+
   // Returns true if the PDF compositor should be enabled to allow out-of-
   // process iframes (OOPIF's) to print properly.
   static bool ShouldPdfCompositorBeEnabledForOopifs();
diff --git a/chromium/content/public/browser/speech_recognition_manager.h b/chromium/content/public/browser/speech_recognition_manager.h
index 8c6040ef98c..10f82b91beb 100644
--- a/chromium/content/public/browser/speech_recognition_manager.h
+++ b/chromium/content/public/browser/speech_recognition_manager.h
@@ -65,12 +65,6 @@ class SpeechRecognitionManager {
   virtual SpeechRecognitionSessionContext GetSessionContext(
       int session_id) const = 0;
 
-  // Looks up an existing session from the context tuple
-  // {render_process_id, render_frame_id, request_id}.
-  virtual int GetSession(int render_process_id,
-                         int render_frame_id,
-                         int request_id) const = 0;
-
  protected:
   virtual ~SpeechRecognitionManager() {}
 
diff --git a/chromium/content/public/browser/speech_recognition_session_config.h b/chromium/content/public/browser/speech_recognition_session_config.h
index d3bea186e1d..9b57ba02b31 100644
--- a/chromium/content/public/browser/speech_recognition_session_config.h
+++ b/chromium/content/public/browser/speech_recognition_session_config.h
@@ -14,8 +14,9 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/speech_recognition_session_context.h"
 #include "content/public/browser/speech_recognition_session_preamble.h"
-#include "content/public/common/speech_recognition_grammar.h"
+#include "content/public/common/speech_recognition_grammar.mojom.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -28,8 +29,8 @@ struct CONTENT_EXPORT SpeechRecognitionSessionConfig {
   ~SpeechRecognitionSessionConfig();
 
   std::string language;
-  SpeechRecognitionGrammarArray grammars;
-  std::string origin_url;
+  std::vector<mojom::SpeechRecognitionGrammar> grammars;
+  url::Origin origin;
   bool filter_profanities;
   bool continuous;
   bool interim_results;
diff --git a/chromium/content/public/browser/speech_recognition_session_context.cc b/chromium/content/public/browser/speech_recognition_session_context.cc
index ebcb190fb81..fa196e3573e 100644
--- a/chromium/content/public/browser/speech_recognition_session_context.cc
+++ b/chromium/content/public/browser/speech_recognition_session_context.cc
@@ -12,8 +12,7 @@ SpeechRecognitionSessionContext::SpeechRecognitionSessionContext()
     : render_process_id(0),
       render_frame_id(MSG_ROUTING_NONE),
       embedder_render_process_id(0),
-      embedder_render_frame_id(MSG_ROUTING_NONE),
-      request_id(0) {}
+      embedder_render_frame_id(MSG_ROUTING_NONE) {}
 
 SpeechRecognitionSessionContext::SpeechRecognitionSessionContext(
     const SpeechRecognitionSessionContext& other) = default;
diff --git a/chromium/content/public/browser/speech_recognition_session_context.h b/chromium/content/public/browser/speech_recognition_session_context.h
index b0cfb8e6b3d..1575e5a8f85 100644
--- a/chromium/content/public/browser/speech_recognition_session_context.h
+++ b/chromium/content/public/browser/speech_recognition_session_context.h
@@ -10,6 +10,7 @@
 #include "content/common/content_export.h"
 #include "content/public/common/media_stream_request.h"
 #include "ui/gfx/geometry/rect.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -34,12 +35,9 @@ struct CONTENT_EXPORT SpeechRecognitionSessionContext {
   int embedder_render_process_id;
   int embedder_render_frame_id;
 
-  // The request id provided by the originating SpeechRecognitionDispatcher.
-  int request_id;
-
-  // A textual description of the context (website, extension name) that is
-  // requesting recognition, for prompting security notifications to the user.
-  std::string context_name;
+  // Origin that is requesting recognition, for prompting security notifications
+  // to the user.
+  url::Origin security_origin;
 
   // The label for the permission request, it is used for request abortion.
   std::string label;
diff --git a/chromium/content/public/browser/storage_partition.h b/chromium/content/public/browser/storage_partition.h
index ec12926fcbb..28e2c251a11 100644
--- a/chromium/content/public/browser/storage_partition.h
+++ b/chromium/content/public/browser/storage_partition.h
@@ -7,14 +7,15 @@
 
 #include <stdint.h>
 
+#include <set>
 #include <string>
 
 #include "base/callback_forward.h"
 #include "base/files/file_path.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
-#include "net/cookies/cookie_store.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "services/network/public/mojom/cookie_manager.mojom.h"
 
 class GURL;
 
@@ -75,7 +76,12 @@ class CONTENT_EXPORT StoragePartition {
   virtual base::FilePath GetPath() = 0;
   virtual net::URLRequestContextGetter* GetURLRequestContext() = 0;
   virtual net::URLRequestContextGetter* GetMediaURLRequestContext() = 0;
+
+  // Returns a raw mojom::NetworkContext pointer. When network service crashes
+  // or restarts, the raw pointer will not be valid or safe to use. Therefore,
+  // caller should not hold onto this pointer beyond the same message loop task.
   virtual network::mojom::NetworkContext* GetNetworkContext() = 0;
+
   // Returns a pointer/info to a URLLoaderFactory/CookieManager owned by
   // the storage partition. Prefer to use this instead of creating a new
   // URLLoaderFactory when issuing requests from the Browser process, to
@@ -119,6 +125,7 @@ class CONTENT_EXPORT StoragePartition {
     REMOVE_DATA_MASK_SERVICE_WORKERS = 1 << 7,
     REMOVE_DATA_MASK_CACHE_STORAGE = 1 << 8,
     REMOVE_DATA_MASK_PLUGIN_PRIVATE_DATA = 1 << 9,
+    REMOVE_DATA_MASK_BACKGROUND_FETCH = 1 << 10,
     REMOVE_DATA_MASK_ALL = 0xFFFFFFFF,
 
     // Corresponds to storage::kStorageTypeTemporary.
@@ -152,9 +159,6 @@ class CONTENT_EXPORT StoragePartition {
   typedef base::Callback<bool(const GURL&, storage::SpecialStoragePolicy*)>
       OriginMatcherFunction;
 
-  // A callback type to check if a given cookie should be cleared.
-  using CookieMatcherFunction = net::CookieStore::CookiePredicate;
-
   // Similar to ClearDataForOrigin().
   // Deletes all data out for the StoragePartition if |storage_origin| is empty.
   // |origin_matcher| is present if special storage policy is to be handled,
@@ -176,20 +180,24 @@ class CONTENT_EXPORT StoragePartition {
   // * |origin_matcher| is present if special storage policy is to be handled,
   //   otherwise the callback should be null (base::Callback::is_null()==true).
   //   The origin matcher does not apply to cookies, instead use:
-  // * |cookies_matcher| is present if special cookie clearing is to be handled.
-  //   If the callback is null all cookies withing the time range will be
-  //   cleared.
+  // * |cookie_deletion_filter| identifies the cookies to delete and will be
+  //   used if |remove_mask| has the REMOVE_DATA_MASK_COOKIES bit set. Note:
+  //   CookieDeletionFilterPtr also contains a time interval
+  //   (created_after_time/created_before_time), so when deleting cookies
+  //   |begin| and |end| will be used ignoring the interval in
+  //   |cookie_deletion_filter|.
   // * |callback| is called when data deletion is done or at least the deletion
   //   is scheduled.
   // Note: Make sure you know what you are doing before clearing cookies
   // selectively. You don't want to break the web.
-  virtual void ClearData(uint32_t remove_mask,
-                         uint32_t quota_storage_remove_mask,
-                         const OriginMatcherFunction& origin_matcher,
-                         const CookieMatcherFunction& cookie_matcher,
-                         const base::Time begin,
-                         const base::Time end,
-                         base::OnceClosure callback) = 0;
+  virtual void ClearData(
+      uint32_t remove_mask,
+      uint32_t quota_storage_remove_mask,
+      const OriginMatcherFunction& origin_matcher,
+      network::mojom::CookieDeletionFilterPtr cookie_deletion_filter,
+      const base::Time begin,
+      const base::Time end,
+      base::OnceClosure callback) = 0;
 
   // Clears the HTTP and media caches associated with this StoragePartition's
   // request contexts. If |begin| and |end| are not null, only entries with
diff --git a/chromium/content/public/browser/trace_uploader.h b/chromium/content/public/browser/trace_uploader.h
index 9f293d4647f..cd0c7e662a9 100644
--- a/chromium/content/public/browser/trace_uploader.h
+++ b/chromium/content/public/browser/trace_uploader.h
@@ -21,10 +21,11 @@ class TraceUploader {
   // This should be called when the tracing is complete.
   // The bool denotes success or failure, the string is feedback
   // to show in the Tracing UI.
-  typedef base::Callback<void(bool, const std::string&)> UploadDoneCallback;
+  typedef base::OnceCallback<void(bool, const std::string&)> UploadDoneCallback;
   // Call this to update the progress UI with the current bytes uploaded,
   // as well as the total.
-  typedef base::Callback<void(int64_t, int64_t)> UploadProgressCallback;
+  typedef base::RepeatingCallback<void(int64_t, int64_t)>
+      UploadProgressCallback;
 
   virtual ~TraceUploader() {}
 
@@ -35,7 +36,7 @@ class TraceUploader {
                         UploadMode upload_mode,
                         std::unique_ptr<const base::DictionaryValue> metadata,
                         const UploadProgressCallback& progress_callback,
-                        const UploadDoneCallback& done_callback) = 0;
+                        UploadDoneCallback done_callback) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/url_loader_request_interceptor.h b/chromium/content/public/browser/url_loader_request_interceptor.h
new file mode 100644
index 00000000000..473902d6f07
--- /dev/null
+++ b/chromium/content/public/browser/url_loader_request_interceptor.h
@@ -0,0 +1,48 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_URL_LOADER_REQUEST_INTERCEPTOR_H_
+#define CONTENT_PUBLIC_BROWSER_URL_LOADER_REQUEST_INTERCEPTOR_H_
+
+#include "base/callback_forward.h"
+#include "base/macros.h"
+#include "content/common/content_export.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+namespace network {
+struct ResourceRequest;
+}
+
+namespace content {
+
+class ResourceContext;
+
+// URLLoaderRequestInterceptor is given a chance to create a URLLoader and
+// intercept a navigation request before the request is handed off to the
+// default URLLoader, e.g. the one from the network service.
+// URLLoaderRequestInterceptor is a per-request object and kept around during
+// the lifetime of a navigation request (including multiple redirect legs).
+class URLLoaderRequestInterceptor {
+ public:
+  URLLoaderRequestInterceptor() = default;
+  virtual ~URLLoaderRequestInterceptor() = default;
+
+  using RequestHandler =
+      base::OnceCallback<void(network::mojom::URLLoaderRequest,
+                              network::mojom::URLLoaderClientPtr)>;
+  using LoaderCallback = base::OnceCallback<void(RequestHandler)>;
+
+  // Asks this handler to handle this resource load request.
+  // The handler must invoke |callback| eventually with either a non-null
+  // RequestHandler indicating its willingness to handle the request, or a null
+  // RequestHandler to indicate that someone else should handle the request.
+  virtual void MaybeCreateLoader(
+      const network::ResourceRequest& resource_request,
+      ResourceContext* resource_context,
+      LoaderCallback callback) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_URL_LOADER_REQUEST_INTERCEPTOR_H_
diff --git a/chromium/content/public/browser/web_contents.cc b/chromium/content/public/browser/web_contents.cc
index 53d56abb35a..df508da0aef 100644
--- a/chromium/content/public/browser/web_contents.cc
+++ b/chromium/content/public/browser/web_contents.cc
@@ -29,7 +29,7 @@ WebContents::CreateParams::CreateParams(BrowserContext* context,
       guest_delegate(nullptr),
       context(nullptr),
       renderer_initiated_creation(false),
-      initialize_renderer(false),
+      desired_renderer_state(kOkayToHaveRendererProcess),
       starting_sandbox_flags(blink::WebSandboxFlags::kNone) {}
 
 WebContents::CreateParams::CreateParams(const CreateParams& other) = default;
diff --git a/chromium/content/public/browser/web_contents.h b/chromium/content/public/browser/web_contents.h
index 423362cb245..dee5814a247 100644
--- a/chromium/content/public/browser/web_contents.h
+++ b/chromium/content/public/browser/web_contents.h
@@ -41,6 +41,10 @@
 #include "base/android/scoped_java_ref.h"
 #endif
 
+namespace blink {
+struct Manifest;
+}
+
 namespace base {
 class TimeTicks;
 }
@@ -75,7 +79,6 @@ class RenderWidgetHostView;
 class WebContentsDelegate;
 struct CustomContextMenuContext;
 struct DropData;
-struct Manifest;
 struct MHTMLGenerationParams;
 struct PageImportanceSignals;
 struct RendererPreferences;
@@ -165,20 +168,58 @@ class WebContents : public PageNavigator,
     // WebContents construction should take this into account.
     bool renderer_initiated_creation;
 
-    // True if the WebContents should create its renderer process and main
-    // RenderFrame before the first navigation. This is useful to reduce
-    // the latency of the first navigation in cases where it might
-    // not happen right away.
+    // Used to specify how far WebContents::Create can initialize a renderer
+    // process.
+    //
+    // This is useful in two scenarios:
+    // - Conserving resources - e.g. tab discarding and session restore do not
+    //   want to use an actual renderer process before the WebContents are
+    //   loaded or reloaded.  This can be accomplished via kNoRendererProcess.
+    // - Avoiding the latency of the first navigation
+    //   - kInitializeAndWarmupRendererProcess is most aggressive in avoiding
+    //     the latency, but may be incompatible with scenarios that require
+    //     manipulating the freshly created WebContents prior to initializing
+    //     renderer-side objects (e.g. in scenarios like
+    //     WebContentsImpl::CreateNewWindow which needs to copy the
+    //     SessionStorageNamespace)
+    //   - kOkayToHaveRendererProcess is the default latency-conserving mode.
+    //     In this mode a spare, pre-spawned RenderProcessHost may be claimed
+    //     by the newly created WebContents, but no renderer-side objects will
+    //     be initialized from within WebContents::Create method.
+    //
     // Note that the pre-created renderer process may not be used if the first
     // navigation requires a dedicated or privileged process, such as a WebUI.
-    bool initialize_renderer;
+    // This can be avoided by ensuring that |site_instance| matches the first
+    // navigation's destination.
+    enum RendererInitializationState {
+      // Creation of WebContents should not spawn a new OS process and should
+      // not reuse a RenderProcessHost that might be associated with an existing
+      // OS process (as in the case of SpareRenderProcessHostManager).
+      kNoRendererProcess,
+
+      // Created WebContents may or may not be associated with an actual OS
+      // process.
+      kOkayToHaveRendererProcess,
+
+      // Ensures that the created WebContents are backed by an OS process which
+      // has an initialized RenderView.
+      //
+      // TODO(lukasza): https://crbug.com/848366: Remove
+      // kInitializeAndWarmupRendererProcess value - warming up the renderer by
+      // initializing the RenderView is redundant with the warm-up that can be
+      // achieved by either 1) warming up the spare renderer before creating
+      // WebContents and/or 2) speculative RenderFrameHost used internally
+      // during a navigation.
+      kInitializeAndWarmupRendererProcess,
+    } desired_renderer_state;
 
     // Sandboxing flags set on the new WebContents.
     blink::WebSandboxFlags starting_sandbox_flags;
   };
 
   // Creates a new WebContents.
-  CONTENT_EXPORT static WebContents* Create(const CreateParams& params);
+  CONTENT_EXPORT static std::unique_ptr<WebContents> Create(
+      const CreateParams& params);
 
   // Similar to Create() above but should be used when you need to prepopulate
   // the SessionStorageNamespaceMap of the WebContents. This can happen if
@@ -190,7 +231,7 @@ class WebContents : public PageNavigator,
   // understand when SessionStorageNamespace objects should be cloned, why
   // they should not be shared by multiple WebContents, and what bad things
   // can happen if you share the object.
-  CONTENT_EXPORT static WebContents* CreateWithSessionStorage(
+  CONTENT_EXPORT static std::unique_ptr<WebContents> CreateWithSessionStorage(
       const CreateParams& params,
       const SessionStorageNamespaceMap& session_storage_namespace_map);
 
@@ -418,6 +459,9 @@ class WebContents : public PageNavigator,
   // Device.
   virtual bool IsConnectedToBluetoothDevice() const = 0;
 
+  // Indicates whether a video is in Picture-in-Picture for |this|.
+  virtual bool HasPictureInPictureVideo() const = 0;
+
   // Indicates whether this tab should be considered crashed. The setter will
   // also notify the delegate when the flag is changed.
   virtual bool IsCrashed() const  = 0;
@@ -460,11 +504,8 @@ class WebContents : public PageNavigator,
   // returns false.
   virtual bool NeedToFireBeforeUnload() = 0;
 
-  // Runs the beforeunload handler for the main frame. See also ClosePage and
-  // SwapOut in RenderViewHost, which run the unload handler.
-  //
-  // TODO(creis): We should run the beforeunload handler for every frame that
-  // has one.
+  // Runs the beforeunload handler for the main frame and all its subframes.
+  // See also ClosePage in RenderViewHostImpl, which runs the unload handler.
   virtual void DispatchBeforeUnload() = 0;
 
   // Attaches this inner WebContents to its container frame
@@ -494,7 +535,7 @@ class WebContents : public PageNavigator,
 
   // Creates a new WebContents with the same state as this one. The returned
   // heap-allocated pointer is owned by the caller.
-  virtual WebContents* Clone() = 0;
+  virtual std::unique_ptr<WebContents> Clone() = 0;
 
   // Reloads the focused frame.
   virtual void ReloadFocusedFrame(bool bypass_cache) = 0;
@@ -770,7 +811,7 @@ class WebContents : public PageNavigator,
   // frame document's manifest. The url will be empty if the document specifies
   // no manifest, and the manifest will be empty if any other failures occurred.
   using GetManifestCallback =
-      base::OnceCallback<void(const GURL&, const Manifest&)>;
+      base::OnceCallback<void(const GURL&, const blink::Manifest&)>;
 
   // Requests the manifest URL and the Manifest of the main frame's document.
   virtual void GetManifest(GetManifestCallback callback) = 0;
@@ -863,6 +904,13 @@ class WebContents : public PageNavigator,
   virtual bool CompletedFirstVisuallyNonEmptyPaint() const = 0;
 #endif  // OS_ANDROID
 
+  // TODO(https://crbug.com/826293): This is a simple mitigation to validate
+  // that an action that requires a user gesture actually has one in the
+  // trustworthy browser process, rather than relying on the untrustworthy
+  // renderer. This should be eventually merged into and accounted for in the
+  // user activation work.
+  virtual bool HasRecentInteractiveInputEvent() const = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class WebContentsImpl;
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index a30f195a3a0..b6c6478c858 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -269,9 +269,10 @@ bool WebContentsDelegate::DoBrowserControlsShrinkBlinkSize() const {
   return false;
 }
 
-void WebContentsDelegate::UpdatePictureInPictureSurfaceId(
-    const viz::SurfaceId& surface_id,
-    const gfx::Size& natural_size) {}
+gfx::Size WebContentsDelegate::EnterPictureInPicture(const viz::SurfaceId&,
+                                                     const gfx::Size&) {
+  return gfx::Size();
+}
 
 void WebContentsDelegate::ExitPictureInPicture() {}
 
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index 28cf408db3b..4fc457c9e41 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -18,13 +18,15 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/bluetooth_chooser.h"
 #include "content/public/browser/invalidate_type.h"
+#include "content/public/browser/web_contents.h"
 #include "content/public/common/media_stream_request.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/window_container_type.mojom.h"
+#include "third_party/blink/public/common/manifest/web_display_mode.h"
 #include "third_party/blink/public/mojom/color_chooser/color_chooser.mojom.h"
-#include "third_party/blink/public/platform/web_display_mode.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/blink/public/platform/web_security_style.h"
+#include "third_party/blink/public/web/web_fullscreen_options.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -48,7 +50,6 @@ class RenderProcessHost;
 class RenderWidgetHost;
 class SessionStorageNamespace;
 class SiteInstance;
-class WebContents;
 class WebContentsImpl;
 struct ContextMenuParams;
 struct DropData;
@@ -121,7 +122,7 @@ class CONTENT_EXPORT WebContentsDelegate {
   // |*was_blocked| will be set to true if the popup gets blocked, and left
   // unchanged otherwise.
   virtual void AddNewContents(WebContents* source,
-                              WebContents* new_contents,
+                              std::unique_ptr<WebContents> new_contents,
                               WindowOpenDisposition disposition,
                               const gfx::Rect& initial_rect,
                               bool user_gesture,
@@ -384,8 +385,10 @@ class CONTENT_EXPORT WebContentsDelegate {
   // |origin| is the origin of the initiating frame inside the |web_contents|.
   // |origin| can be empty in which case the |web_contents| last committed
   // URL's origin should be used.
-  virtual void EnterFullscreenModeForTab(WebContents* web_contents,
-                                         const GURL& origin) {}
+  virtual void EnterFullscreenModeForTab(
+      WebContents* web_contents,
+      const GURL& origin,
+      const blink::WebFullscreenOptions& options) {}
 
   // Called when the renderer puts a tab out of fullscreen mode.
   virtual void ExitFullscreenModeForTab(WebContents*) {}
@@ -534,9 +537,6 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Requests the app banner. This method is called from the DevTools.
   virtual void RequestAppBannerFromDevTools(content::WebContents* web_contents);
 
-  // Called when an audio change occurs.
-  virtual void OnAudioStateChanged(WebContents* web_contents, bool audible) {}
-
   // Called when a suspicious navigation of the main frame has been blocked.
   // Allows the delegate to provide some UI to let the user know about the
   // blocked navigation and give them the option to recover from it. The given
@@ -580,10 +580,11 @@ class CONTENT_EXPORT WebContentsDelegate {
                                          RenderFrameHost* subframe_host) const {
   }
 
-  // Updates the Picture-in-Picture controller with the relevant viz::SurfaceId
-  // and natural size of the video to be in Picture-in-Picture mode.
-  virtual void UpdatePictureInPictureSurfaceId(const viz::SurfaceId& surface_id,
-                                               const gfx::Size& natural_size);
+  // Notifies the Picture-in-Picture controller that there is a new player
+  // entering Picture-in-Picture.
+  // Returns the size of the Picture-in-Picture window.
+  virtual gfx::Size EnterPictureInPicture(const viz::SurfaceId&,
+                                          const gfx::Size& natural_size);
 
   // Updates the Picture-in-Picture controller with a signal that
   // Picture-in-Picture mode has ended.
diff --git a/chromium/content/public/browser/web_contents_observer.h b/chromium/content/public/browser/web_contents_observer.h
index a0acf0a102d..9a875c6bb40 100644
--- a/chromium/content/public/browser/web_contents_observer.h
+++ b/chromium/content/public/browser/web_contents_observer.h
@@ -256,9 +256,10 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
       const std::string& mime_type,
       ResourceType resource_type) {}
 
-  // This method is invoked when a resource has been loaded, successfully or
-  // not.
+  // This method is invoked when a resource associate with the frame
+  // |render_frame_host| has been loaded, successfully or not.
   virtual void ResourceLoadComplete(
+      RenderFrameHost* render_frame_host,
       const mojom::ResourceLoadInfo& resource_load_info) {}
 
   // This method is invoked when a new non-pending navigation entry is created.
@@ -387,6 +388,9 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // process.
   virtual void DidUpdateFaviconURL(const std::vector<FaviconURL>& candidates) {}
 
+  // Called when an audio change occurs.
+  virtual void OnAudioStateChanged(bool audible) {}
+
   // Invoked when the WebContents is muted/unmuted.
   virtual void DidUpdateAudioMutingState(bool muted) {}
 
diff --git a/chromium/content/public/browser/web_ui_message_handler.h b/chromium/content/public/browser/web_ui_message_handler.h
index 966992cb648..0ce6334e74b 100644
--- a/chromium/content/public/browser/web_ui_message_handler.h
+++ b/chromium/content/public/browser/web_ui_message_handler.h
@@ -15,6 +15,7 @@
 #include "content/public/browser/web_ui.h"
 
 class WebUIBrowserTest;
+class MojoWebUIBrowserTest;
 
 namespace base {
 class ListValue;
@@ -137,6 +138,7 @@ class CONTENT_EXPORT WebUIMessageHandler {
   // RenderViewReused.
   friend class WebUIImpl;
   friend class ::WebUIBrowserTest;
+  friend class ::MojoWebUIBrowserTest;
 
   // TODO(dbeam): disallow JavaScript when a renderer process crashes.
   // http://crbug.com/610450
diff --git a/chromium/content/public/browser/webrtc_log.h b/chromium/content/public/browser/webrtc_log.h
index 0cc7ab8cc05..449cacbe504 100644
--- a/chromium/content/public/browser/webrtc_log.h
+++ b/chromium/content/public/browser/webrtc_log.h
@@ -12,10 +12,6 @@
 #include "content/common/content_export.h"
 #include "media/media_buildflags.h"
 
-#if !BUILDFLAG(ENABLE_WEBRTC)
-#error "WebRTC not enabled."
-#endif
-
 namespace content {
 
 class CONTENT_EXPORT WebRtcLog {
diff --git a/chromium/content/public/browser/zygote_host_linux.h b/chromium/content/public/browser/zygote_host_linux.h
deleted file mode 100644
index 537d6d3f763..00000000000
--- a/chromium/content/public/browser/zygote_host_linux.h
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_ZYGOTE_HOST_LINUX_H_
-#define CONTENT_PUBLIC_BROWSER_ZYGOTE_HOST_LINUX_H_
-
-#include <unistd.h>
-
-#include "base/process/process.h"
-#include "content/common/content_export.h"
-
-namespace content {
-
-// https://chromium.googlesource.com/chromium/src/+/master/docs/linux_zygote.md
-
-// The zygote host is an interface, in the browser process, to the zygote
-// process.
-class ZygoteHost {
- public:
-  // Returns the singleton instance.
-  CONTENT_EXPORT static ZygoteHost* GetInstance();
-
-  virtual ~ZygoteHost() {}
-
-  // Returns the pid of the Zygote process.
-  virtual bool IsZygotePid(pid_t pid) = 0;
-
-  // Returns an int which is a bitmask of kSandboxLinux* values. Only valid
-  // after the first render has been forked.
-  virtual int GetRendererSandboxStatus() const = 0;
-
-  // Adjust the OOM score of the given renderer's PID.  The allowed
-  // range for the score is [0, 1000], where higher values are more
-  // likely to be killed by the OOM killer.
-  virtual void AdjustRendererOOMScore(base::ProcessHandle process_handle,
-                                      int score) = 0;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_ZYGOTE_HOST_LINUX_H_