BASELINE: Update Chromium to 84.0.4147.141

Change-Id: Ib85eb4cfa1cbe2b2b81e5022c8cad5c493969535
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

209 files changed, 2911 insertions, 4482 deletions

diff --git a/chromium/content/renderer/BUILD.gn b/chromium/content/renderer/BUILD.gn
index 32fc54e791a..12e9157d582 100644
--- a/chromium/content/renderer/BUILD.gn
+++ b/chromium/content/renderer/BUILD.gn
@@ -39,8 +39,6 @@ target(link_target_type, "renderer") {
     "accessibility/ax_image_annotator.h",
     "accessibility/blink_ax_action_target.cc",
     "accessibility/blink_ax_action_target.h",
-    "accessibility/blink_ax_enum_conversion.cc",
-    "accessibility/blink_ax_enum_conversion.h",
     "accessibility/blink_ax_tree_source.cc",
     "accessibility/blink_ax_tree_source.h",
     "accessibility/render_accessibility_impl.cc",
@@ -57,9 +55,6 @@ target(link_target_type, "renderer") {
     "child_frame_compositing_helper.h",
     "child_frame_compositor.h",
     "compositor/compositor_dependencies.h",
-    "compositor/layer_tree_view.cc",
-    "compositor/layer_tree_view.h",
-    "compositor/layer_tree_view_delegate.h",
     "content_security_policy_util.cc",
     "content_security_policy_util.h",
     "context_menu_params_builder.cc",
@@ -88,6 +83,8 @@ target(link_target_type, "renderer") {
     "history_serialization.h",
     "ime_event_guard.cc",
     "ime_event_guard.h",
+    "impression_conversions.cc",
+    "impression_conversions.h",
     "in_process_renderer_thread.cc",
     "in_process_renderer_thread.h",
     "input/frame_input_handler_impl.cc",
@@ -104,8 +101,6 @@ target(link_target_type, "renderer") {
     "input/render_widget_input_handler.cc",
     "input/render_widget_input_handler.h",
     "input/render_widget_input_handler_delegate.h",
-    "input/scoped_web_input_event_with_latency_info.cc",
-    "input/scoped_web_input_event_with_latency_info.h",
     "input/widget_input_handler_impl.cc",
     "input/widget_input_handler_impl.h",
     "input/widget_input_handler_manager.cc",
@@ -191,6 +186,8 @@ target(link_target_type, "renderer") {
     "media/inspector_media_event_handler.h",
     "media/media_factory.cc",
     "media/media_factory.h",
+    "media/media_interface_factory.cc",
+    "media/media_interface_factory.h",
     "media/media_permission_dispatcher.cc",
     "media/media_permission_dispatcher.h",
     "media/power_status_helper_impl.cc",
@@ -409,6 +406,7 @@ target(link_target_type, "renderer") {
     "//ui/accessibility",
     "//ui/base",
     "//ui/base/clipboard",
+    "//ui/base/cursor",
     "//ui/base/ime",
     "//ui/display",
     "//ui/events:dom_keycode_converter",
@@ -423,13 +421,6 @@ target(link_target_type, "renderer") {
   ]
   allow_circular_includes_from = []
 
-  if (use_external_popup_menu) {
-    sources += [
-      "external_popup_menu.cc",
-      "external_popup_menu.h",
-    ]
-  }
-
   if (is_android) {
     set_sources_assignment_filter([])
     sources += [
@@ -648,10 +639,11 @@ target(link_target_type, "renderer") {
       "//ppapi/host",
       "//ppapi/proxy",
       "//ppapi/shared_impl",
+      "//printing/mojom",
       "//third_party/libvpx",
       "//third_party/opus",
       "//ui/base/cursor",
-      "//ui/base/mojom:cursor_type",
+      "//ui/base/cursor/mojom:cursor_type",
     ]
   }
 
@@ -659,17 +651,17 @@ target(link_target_type, "renderer") {
     deps += [ "//printing" ]
   }
 
-  if (enable_mojo_media) {
-    sources += [
-      "media/media_interface_factory.cc",
-      "media/media_interface_factory.h",
-    ]
-  }
-
   if (is_linux || is_android) {
     deps += [ "//sandbox:sandbox_buildflags" ]
   }
 
+  if (is_chromeos) {
+    deps += [
+      "//chromeos:chromeos_export",
+      "//chromeos/system:system",
+    ]
+  }
+
   if (use_ozone) {
     deps += [ "//ui/ozone" ]
   }
@@ -682,7 +674,7 @@ target(link_target_type, "renderer") {
 # See comment at the top of //content/BUILD.gn for how this works.
 group("for_content_tests") {
   visibility = [
-    "//content/shell/test_runner",
+    "//content/shell:web_test_renderer",
     "//content/test/*",
   ]
 
diff --git a/chromium/content/renderer/DEPS b/chromium/content/renderer/DEPS
index 9d9a9a0a4ff..aee8b4d69cc 100644
--- a/chromium/content/renderer/DEPS
+++ b/chromium/content/renderer/DEPS
@@ -16,6 +16,7 @@ include_rules = [
   # If adding a new component dependency, email content/OWNERS first.
   # ****************************************************************************
 
+  "+chromeos/system/core_scheduling.h",
   "+content/public/child",
   "+content/public/renderer",
   "+content/child",
@@ -30,6 +31,7 @@ include_rules = [
   "+third_party/hyphen/hyphen.h",
   "+third_party/webrtc_overrides",
   "+third_party/blink/public/common",
+  "+third_party/blink/public/mojom",
   "+v8/include",
   "+v8/src/third_party/vtune",
 ]
diff --git a/chromium/content/renderer/OWNERS b/chromium/content/renderer/OWNERS
index 9a367842cfc..a97b9653677 100644
--- a/chromium/content/renderer/OWNERS
+++ b/chromium/content/renderer/OWNERS
@@ -1,6 +1,7 @@
 dcheng@chromium.org
 haraken@chromium.org
 szager@chromium.org
+danakj@chromium.org
 
 # These are for the common case of adding or renaming files. If you're doing
 # structural changes, please get a review from a reviewer in this file.
diff --git a/chromium/content/renderer/accessibility/ax_image_annotator.cc b/chromium/content/renderer/accessibility/ax_image_annotator.cc
index a5b7e079568..3a38e7be07f 100644
--- a/chromium/content/renderer/accessibility/ax_image_annotator.cc
+++ b/chromium/content/renderer/accessibility/ax_image_annotator.cc
@@ -28,10 +28,8 @@ namespace content {
 
 AXImageAnnotator::AXImageAnnotator(
     RenderAccessibilityImpl* const render_accessibility,
-    const std::string& preferred_language,
     mojo::PendingRemote<image_annotation::mojom::Annotator> annotator)
     : render_accessibility_(render_accessibility),
-      preferred_language_(preferred_language),
       annotator_(std::move(annotator)) {
   DCHECK(render_accessibility_);
 }
@@ -82,12 +80,13 @@ void AXImageAnnotator::OnImageAdded(blink::WebAXObject& image) {
   image_annotations_.emplace(image.AxID(), image);
   ImageInfo& image_info = image_annotations_.at(image.AxID());
   // Fetch image annotation.
-  annotator_->AnnotateImage(image_id, preferred_language_,
+  annotator_->AnnotateImage(image_id, render_accessibility_->GetLanguage(),
                             image_info.GetImageProcessor(),
                             base::BindOnce(&AXImageAnnotator::OnImageAnnotated,
                                            weak_factory_.GetWeakPtr(), image));
   VLOG(1) << "Requesting annotation for " << image_id << " with language '"
-          << preferred_language_ << "' from page " << GetDocumentUrl();
+          << render_accessibility_->GetLanguage() << "' from page "
+          << GetDocumentUrl();
 }
 
 void AXImageAnnotator::OnImageUpdated(blink::WebAXObject& image) {
@@ -99,7 +98,7 @@ void AXImageAnnotator::OnImageUpdated(blink::WebAXObject& image) {
 
   ImageInfo& image_info = image_annotations_.at(image.AxID());
   // Update annotation.
-  annotator_->AnnotateImage(image_id, preferred_language_,
+  annotator_->AnnotateImage(image_id, render_accessibility_->GetLanguage(),
                             image_info.GetImageProcessor(),
                             base::BindOnce(&AXImageAnnotator::OnImageAnnotated,
                                            weak_factory_.GetWeakPtr(), image));
diff --git a/chromium/content/renderer/accessibility/ax_image_annotator.h b/chromium/content/renderer/accessibility/ax_image_annotator.h
index 9b574244842..fcc1a316106 100644
--- a/chromium/content/renderer/accessibility/ax_image_annotator.h
+++ b/chromium/content/renderer/accessibility/ax_image_annotator.h
@@ -40,7 +40,6 @@ class CONTENT_EXPORT AXImageAnnotator : public base::CheckedObserver {
  public:
   AXImageAnnotator(
       RenderAccessibilityImpl* const render_accessibility,
-      const std::string& preferred_language,
       mojo::PendingRemote<image_annotation::mojom::Annotator> annotator);
   ~AXImageAnnotator() override;
 
@@ -56,10 +55,6 @@ class CONTENT_EXPORT AXImageAnnotator : public base::CheckedObserver {
   void OnImageUpdated(blink::WebAXObject& image);
   void OnImageRemoved(blink::WebAXObject& image);
 
-  void set_preferred_language(const std::string& language) {
-    preferred_language_ = language;
-  }
-
  private:
   // Keeps track of the image data and the automatic annotation for each image.
   class ImageInfo final {
@@ -122,9 +117,6 @@ class CONTENT_EXPORT AXImageAnnotator : public base::CheckedObserver {
   // Weak, owns us.
   RenderAccessibilityImpl* const render_accessibility_;
 
-  // The language in which to request image descriptions.
-  std::string preferred_language_;
-
   // A pointer to the automatic image annotation service.
   mojo::Remote<image_annotation::mojom::Annotator> annotator_;
 
diff --git a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.cc b/chromium/content/renderer/accessibility/blink_ax_enum_conversion.cc
deleted file mode 100644
index 656c0c2bfed..00000000000
--- a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.cc
+++ /dev/null
@@ -1,83 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/accessibility/blink_ax_enum_conversion.h"
-
-#include "base/logging.h"
-
-namespace content {
-
-void AXStateFromBlink(const blink::WebAXObject& o, ui::AXNodeData* dst) {
-  blink::WebAXExpanded expanded = o.IsExpanded();
-  if (expanded) {
-    if (expanded == blink::kWebAXExpandedCollapsed)
-      dst->AddState(ax::mojom::State::kCollapsed);
-    else if (expanded == blink::kWebAXExpandedExpanded)
-      dst->AddState(ax::mojom::State::kExpanded);
-  }
-
-  if (o.CanSetFocusAttribute())
-    dst->AddState(ax::mojom::State::kFocusable);
-
-  if (o.HasPopup() != ax::mojom::HasPopup::kFalse)
-    dst->SetHasPopup(o.HasPopup());
-  else if (o.Role() == ax::mojom::Role::kPopUpButton)
-    dst->SetHasPopup(ax::mojom::HasPopup::kMenu);
-
-  if (o.IsAutofillAvailable())
-    dst->AddState(ax::mojom::State::kAutofillAvailable);
-
-  if (o.IsDefault())
-    dst->AddState(ax::mojom::State::kDefault);
-
-  // aria-grabbed is deprecated in WAI-ARIA 1.1.
-  if (o.IsGrabbed() != blink::kWebAXGrabbedStateUndefined)
-    dst->AddBoolAttribute(ax::mojom::BoolAttribute::kGrabbed,
-                          o.IsGrabbed() == blink::kWebAXGrabbedStateTrue);
-
-  if (o.IsHovered())
-    dst->AddState(ax::mojom::State::kHovered);
-
-  if (!o.IsVisible())
-    dst->AddState(ax::mojom::State::kInvisible);
-
-  if (o.IsLinked())
-    dst->AddState(ax::mojom::State::kLinked);
-
-  if (o.IsMultiline())
-    dst->AddState(ax::mojom::State::kMultiline);
-
-  if (o.IsMultiSelectable())
-    dst->AddState(ax::mojom::State::kMultiselectable);
-
-  if (o.IsPasswordField())
-    dst->AddState(ax::mojom::State::kProtected);
-
-  if (o.IsRequired())
-    dst->AddState(ax::mojom::State::kRequired);
-
-  if (o.IsEditable())
-    dst->AddState(ax::mojom::State::kEditable);
-
-  if (o.IsSelected() != blink::kWebAXSelectedStateUndefined) {
-    dst->AddBoolAttribute(ax::mojom::BoolAttribute::kSelected,
-                          o.IsSelected() == blink::kWebAXSelectedStateTrue);
-  }
-
-  if (o.IsRichlyEditable())
-    dst->AddState(ax::mojom::State::kRichlyEditable);
-
-  if (o.IsVisited())
-    dst->AddState(ax::mojom::State::kVisited);
-
-  if (o.Orientation() == blink::kWebAXOrientationVertical)
-    dst->AddState(ax::mojom::State::kVertical);
-  else if (o.Orientation() == blink::kWebAXOrientationHorizontal)
-    dst->AddState(ax::mojom::State::kHorizontal);
-
-  if (o.AccessibilityIsIgnored())
-    dst->AddState(ax::mojom::State::kIgnored);
-}
-
-}  // namespace content.
diff --git a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.h b/chromium/content/renderer/accessibility/blink_ax_enum_conversion.h
deleted file mode 100644
index 64c32dd3cbb..00000000000
--- a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.h
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_ACCESSIBILITY_BLINK_AX_ENUM_CONVERSION_H_
-#define CONTENT_RENDERER_ACCESSIBILITY_BLINK_AX_ENUM_CONVERSION_H_
-
-#include <stdint.h>
-
-#include "third_party/blink/public/web/web_ax_object.h"
-#include "ui/accessibility/ax_enums.mojom-forward.h"
-#include "ui/accessibility/ax_node_data.h"
-
-namespace content {
-
-// Provides a conversion between the WebAXObject state
-// accessors and a state bitmask stored in an AXNodeData.
-// (Note that some rare states are sent as boolean attributes
-// in AXNodeData instead.)
-void AXStateFromBlink(const blink::WebAXObject& o, ui::AXNodeData* dst);
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_ACCESSIBILITY_BLINK_AX_ENUM_CONVERSION_H_
diff --git a/chromium/content/renderer/accessibility/blink_ax_tree_source.cc b/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
index 3a89fdbbd6d..370c3edcba2 100644
--- a/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
+++ b/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
@@ -15,9 +15,9 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
+#include "content/common/ax_serialization_utils.h"
 #include "content/public/common/content_features.h"
 #include "content/renderer/accessibility/ax_image_annotator.h"
-#include "content/renderer/accessibility/blink_ax_enum_conversion.h"
 #include "content/renderer/accessibility/render_accessibility_impl.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_frame_proxy.h"
@@ -550,6 +550,10 @@ WebAXObject BlinkAXTreeSource::GetNull() const {
   return WebAXObject();
 }
 
+std::string BlinkAXTreeSource::GetDebugString(blink::WebAXObject node) const {
+  return node.ToString(true).Utf8();
+}
+
 void BlinkAXTreeSource::SerializeNode(WebAXObject src,
                                       AXContentNodeData* dst) const {
 #if DCHECK_IS_ON()
@@ -559,8 +563,12 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
   blink::WebDisallowTransitionScope disallow(&document);
 #endif
 
+  // TODO(crbug.com/1068668): AX onion soup - finish migrating the rest of
+  // this function inside of AXObject::Serialize and removing
+  // unneeded WebAXObject interfaces.
+  src.Serialize(dst);
+
   dst->role = src.Role();
-  AXStateFromBlink(src, dst);
   dst->id = src.AxID();
 
   TRACE_EVENT1("accessibility", "BlinkAXTreeSource::SerializeNode", "role",
@@ -573,8 +581,7 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
   src.GetRelativeBounds(offset_container, bounds_in_container,
                         container_transform, &clips_children);
   dst->relative_bounds.bounds = bounds_in_container;
-#if !defined(OS_ANDROID) && !defined(OS_MACOSX)
-  if (src.Equals(root())) {
+  if (content::AXShouldIncludePageScaleFactorInRoot() && src.Equals(root())) {
     WebView* web_view = render_frame_->GetRenderView()->GetWebView();
     std::unique_ptr<gfx::Transform> container_transform_gfx =
         std::make_unique<gfx::Transform>(container_transform);
@@ -584,14 +591,10 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
         -web_view->VisualViewportOffset().OffsetFromOrigin());
     if (!container_transform_gfx->IsIdentity())
       dst->relative_bounds.transform = std::move(container_transform_gfx);
-  } else if (!container_transform.isIdentity())
+  } else if (!container_transform.isIdentity()) {
     dst->relative_bounds.transform =
         base::WrapUnique(new gfx::Transform(container_transform));
-#else
-  if (!container_transform.isIdentity())
-    dst->relative_bounds.transform =
-        base::WrapUnique(new gfx::Transform(container_transform));
-#endif  // !defined(OS_ANDROID) && !defined(OS_MACOSX)
+  }
   if (!offset_container.IsDetached())
     dst->relative_bounds.offset_container_id = offset_container.AxID();
   if (clips_children)
@@ -958,7 +961,7 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
         dst->role == ax::mojom::Role::kSlider ||
         dst->role == ax::mojom::Role::kSpinButton ||
         (dst->role == ax::mojom::Role::kSplitter &&
-         src.CanSetFocusAttribute())) {
+         dst->HasState(ax::mojom::State::kFocusable))) {
       float value;
       if (src.ValueForRange(&value))
         dst->AddFloatAttribute(ax::mojom::FloatAttribute::kValueForRange,
@@ -983,8 +986,7 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
       }
     }
 
-    if (dst->role == ax::mojom::Role::kDialog ||
-        dst->role == ax::mojom::Role::kAlertDialog) {
+    if (ui::IsDialog(dst->role)) {
       dst->AddBoolAttribute(ax::mojom::BoolAttribute::kModal, src.IsModal());
     }
 
@@ -994,42 +996,32 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
 
     const bool is_table_like_role = ui::IsTableLike(dst->role);
     if (is_table_like_role) {
-      int column_count = src.ColumnCount();
-      int row_count = src.RowCount();
-      if (column_count > 0 && row_count > 0) {
-        dst->AddIntAttribute(ax::mojom::IntAttribute::kTableColumnCount,
-                             column_count);
-        dst->AddIntAttribute(ax::mojom::IntAttribute::kTableRowCount,
-                             row_count);
-      }
-
       int aria_colcount = src.AriaColumnCount();
-      if (aria_colcount)
+      if (aria_colcount) {
         dst->AddIntAttribute(ax::mojom::IntAttribute::kAriaColumnCount,
                              aria_colcount);
+      }
 
       int aria_rowcount = src.AriaRowCount();
-      if (aria_rowcount)
+      if (aria_rowcount) {
         dst->AddIntAttribute(ax::mojom::IntAttribute::kAriaRowCount,
                              aria_rowcount);
+      }
     }
 
     if (ui::IsTableRow(dst->role)) {
-      dst->AddIntAttribute(ax::mojom::IntAttribute::kTableRowIndex,
-                           src.RowIndex());
       WebAXObject header = src.RowHeader();
-      if (!header.IsDetached())
+      if (!header.IsDetached()) {
+        // TODO(accessibility): these should be computed by ui::AXTableInfo and
+        // removed here.
         dst->AddIntAttribute(ax::mojom::IntAttribute::kTableRowHeaderId,
                              header.AxID());
+      }
     }
 
     if (ui::IsCellOrTableHeader(dst->role)) {
-      dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellColumnIndex,
-                           src.CellColumnIndex());
       dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellColumnSpan,
                            src.CellColumnSpan());
-      dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellRowIndex,
-                           src.CellRowIndex());
       dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellRowSpan,
                            src.CellRowSpan());
     }
@@ -1038,9 +1030,10 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
       // aria-rowindex and aria-colindex are supported on cells, headers and
       // rows.
       int aria_rowindex = src.AriaRowIndex();
-      if (aria_rowindex)
+      if (aria_rowindex) {
         dst->AddIntAttribute(ax::mojom::IntAttribute::kAriaCellRowIndex,
                              aria_rowindex);
+      }
 
       int aria_colindex = src.AriaColumnIndex();
       if (aria_colindex) {
@@ -1124,7 +1117,8 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
       if (src.IsEditableRoot())
         dst->AddBoolAttribute(ax::mojom::BoolAttribute::kEditableRoot, true);
 
-      if (src.IsControl() && !src.IsRichlyEditable()) {
+      if (src.IsControl() &&
+          !dst->HasState(ax::mojom::State::kRichlyEditable)) {
         // Only for simple input controls -- rich editable areas use AXTreeData.
           dst->AddIntAttribute(ax::mojom::IntAttribute::kTextSelStart,
                                src.SelectionStart());
@@ -1148,9 +1142,13 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
     if (src.HasAriaAttribute())
       dst->AddBoolAttribute(ax::mojom::BoolAttribute::kHasAriaAttribute, true);
 
-    // Frames and iframes.
+    // Frames and iframes:
+    // If there are children, the fallback content has been rendered and should
+    // be used instead. For example, the fallback content may be rendered if
+    // there was an error loading an <object>. In that case, only expose the
+    // children. A node should not have both children and a child tree.
     WebFrame* frame = WebFrame::FromFrameOwnerElement(element);
-    if (frame)
+    if (frame && !src.ChildCount())
       dst->child_routing_id = RenderFrame::GetRoutingIdForWebFrame(frame);
   }
 
diff --git a/chromium/content/renderer/accessibility/blink_ax_tree_source.h b/chromium/content/renderer/accessibility/blink_ax_tree_source.h
index 97f20cbf8a5..1cfefe0cbe8 100644
--- a/chromium/content/renderer/accessibility/blink_ax_tree_source.h
+++ b/chromium/content/renderer/accessibility/blink_ax_tree_source.h
@@ -8,6 +8,7 @@
 #include <stdint.h>
 
 #include <set>
+#include <string>
 
 #include "base/optional.h"
 #include "content/common/ax_content_node_data.h"
@@ -112,6 +113,7 @@ class BlinkAXTreeSource
   bool IsEqual(blink::WebAXObject node1,
                blink::WebAXObject node2) const override;
   blink::WebAXObject GetNull() const override;
+  std::string GetDebugString(blink::WebAXObject node) const override;
 
   blink::WebDocument GetMainDocument() const;
 
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl.cc b/chromium/content/renderer/accessibility/render_accessibility_impl.cc
index 4d9d7604deb..a504fc800b9 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl.cc
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl.cc
@@ -7,7 +7,9 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include <memory>
+#include <algorithm>
+#include <set>
+#include <string>
 #include <utility>
 
 #include "base/bind.h"
@@ -24,7 +26,6 @@
 #include "content/renderer/accessibility/ax_action_target_factory.h"
 #include "content/renderer/accessibility/ax_image_annotator.h"
 #include "content/renderer/accessibility/blink_ax_action_target.h"
-#include "content/renderer/accessibility/blink_ax_enum_conversion.h"
 #include "content/renderer/accessibility/render_accessibility_manager.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_frame_proxy.h"
@@ -39,7 +40,7 @@
 #include "third_party/blink/public/web/web_view.h"
 #include "ui/accessibility/accessibility_switches.h"
 #include "ui/accessibility/ax_enum_util.h"
-#include "ui/accessibility/ax_event.h"
+#include "ui/accessibility/ax_event_intent.h"
 #include "ui/accessibility/ax_node.h"
 #include "ui/accessibility/ax_role_properties.h"
 
@@ -72,12 +73,6 @@ void SetAccessibilityCrashKey(ui::AXMode mode) {
     base::debug::SetCrashKeyString(ax_mode_crash_key, mode.ToString());
 }
 
-// Returns the first language in the accept languages list.
-std::string GetPreferredLanguage(const std::string& accept_languages) {
-  const std::vector<std::string> tokens = base::SplitString(
-      accept_languages, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
-  return tokens.empty() ? "" : tokens[0];
-}
 }
 
 namespace content {
@@ -208,18 +203,14 @@ RenderAccessibilityImpl::RenderAccessibilityImpl(
     // It's possible that the webview has already loaded a webpage without
     // accessibility being enabled. Initialize the browser's cached
     // accessibility tree by sending it a notification.
-    HandleAXEvent(WebAXObject::FromWebDocument(document),
-                  ax::mojom::Event::kLayoutComplete);
+    WebAXObject root_object = WebAXObject::FromWebDocument(document);
+    HandleAXEvent(
+        ui::AXEvent(root_object.AxID(), ax::mojom::Event::kLayoutComplete));
   }
 
   image_annotation_debugging_ =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           ::switches::kEnableExperimentalAccessibilityLabelsDebugging);
-
-  if (render_frame->render_view()) {
-    render_frame_->render_view()->RegisterRendererPreferenceWatcher(
-        pref_watcher_receiver_.BindNewPipeAndPassRemote());
-  }
 }
 
 RenderAccessibilityImpl::~RenderAccessibilityImpl() = default;
@@ -244,6 +235,7 @@ void RenderAccessibilityImpl::DidCommitProvisionalLoad(
   tree_source_.RemoveImageAnnotator();
   ax_image_annotator_->Destroy();
   ax_image_annotator_.release();
+  page_language_.clear();
 }
 
 void RenderAccessibilityImpl::AccessibilityModeChanged(const ui::AXMode& mode) {
@@ -282,11 +274,11 @@ void RenderAccessibilityImpl::AccessibilityModeChanged(const ui::AXMode& mode) {
     // If there are any events in flight, |HandleAXEvent| will refuse to process
     // our new event.
     pending_events_.clear();
-    auto webax_object = WebAXObject::FromWebDocument(document);
-    ax::mojom::Event event = webax_object.IsLoaded()
+    auto root_object = WebAXObject::FromWebDocument(document);
+    ax::mojom::Event event = root_object.IsLoaded()
                                  ? ax::mojom::Event::kLoadComplete
                                  : ax::mojom::Event::kLayoutComplete;
-    HandleAXEvent(webax_object, event);
+    HandleAXEvent(ui::AXEvent(root_object.AxID(), event));
   }
 }
 
@@ -318,8 +310,10 @@ void RenderAccessibilityImpl::HitTest(
   tree_source_.SerializeNode(ax_object, &data);
   if (data.child_routing_id == MSG_ROUTING_NONE) {
     // Otherwise, send an event on the node that was hit.
-    HandleAXEvent(ax_object, action_data.hit_test_event_to_fire,
-                  ax::mojom::EventFrom::kAction, action_data.request_id);
+    const std::vector<ui::AXEventIntent> intents;
+    HandleAXEvent(ui::AXEvent(
+        ax_object.AxID(), action_data.hit_test_event_to_fire,
+        ax::mojom::EventFrom::kAction, intents, action_data.request_id));
 
     // The mojo message still needs a reply.
     std::move(callback).Run(/*child_frame_hit_test_info=*/nullptr);
@@ -412,7 +406,8 @@ void RenderAccessibilityImpl::PerformAction(const ui::AXActionData& data) {
     case ax::mojom::Action::kSetSelection:
       anchor->SetSelection(anchor.get(), data.anchor_offset, focus.get(),
                            data.focus_offset);
-      HandleAXEvent(root, ax::mojom::Event::kLayoutComplete);
+      HandleAXEvent(
+          ui::AXEvent(root.AxID(), ax::mojom::Event::kLayoutComplete));
       break;
     case ax::mojom::Action::kSetSequentialFocusNavigationStartingPoint:
       target->SetSequentialFocusNavigationStartingPoint();
@@ -455,7 +450,7 @@ void RenderAccessibilityImpl::PerformAction(const ui::AXActionData& data) {
       // Wait for 100ms to allow pending events to come in
       base::PlatformThread::Sleep(base::TimeDelta::FromMilliseconds(100));
 
-      HandleAXEvent(root, ax::mojom::Event::kEndOfTest);
+      HandleAXEvent(ui::AXEvent(root.AxID(), ax::mojom::Event::kEndOfTest));
       break;
     case ax::mojom::Action::kShowTooltip:
     case ax::mojom::Action::kHideTooltip:
@@ -473,26 +468,17 @@ void RenderAccessibilityImpl::Reset(int32_t reset_token) {
   if (!document.IsNull()) {
     // Tree-only mode gets used by the automation extension API which requires a
     // load complete event to invoke listener callbacks.
-    auto webax_object = WebAXObject::FromWebDocument(document);
-    ax::mojom::Event evt = webax_object.IsLoaded()
-                               ? ax::mojom::Event::kLoadComplete
-                               : ax::mojom::Event::kLayoutComplete;
-    HandleAXEvent(webax_object, evt);
+    auto root_object = WebAXObject::FromWebDocument(document);
+    ax::mojom::Event event = root_object.IsLoaded()
+                                 ? ax::mojom::Event::kLoadComplete
+                                 : ax::mojom::Event::kLayoutComplete;
+    HandleAXEvent(ui::AXEvent(root_object.AxID(), event));
   }
 }
 
-void RenderAccessibilityImpl::NotifyUpdate(
-    blink::mojom::RendererPreferencesPtr new_prefs) {
-  if (ax_image_annotator_)
-    ax_image_annotator_->set_preferred_language(
-        GetPreferredLanguage(new_prefs->accept_languages));
-}
-
 void RenderAccessibilityImpl::HandleWebAccessibilityEvent(
-    const WebAXObject& obj,
-    ax::mojom::Event event,
-    ax::mojom::EventFrom event_from) {
-  HandleAXEvent(obj, event, event_from);
+    const ui::AXEvent& event) {
+  HandleAXEvent(event);
 }
 
 void RenderAccessibilityImpl::MarkWebAXObjectDirty(const WebAXObject& obj,
@@ -508,14 +494,15 @@ void RenderAccessibilityImpl::MarkWebAXObjectDirty(const WebAXObject& obj,
   ScheduleSendAccessibilityEventsIfNeeded();
 }
 
-void RenderAccessibilityImpl::HandleAXEvent(const WebAXObject& obj,
-                                            ax::mojom::Event event,
-                                            ax::mojom::EventFrom event_from,
-                                            int action_request_id) {
+void RenderAccessibilityImpl::HandleAXEvent(const ui::AXEvent& event) {
   const WebDocument& document = GetMainDocument();
   if (document.IsNull())
     return;
 
+  auto obj = WebAXObject::FromWebDocumentByID(document, event.id);
+  if (obj.IsDetached())
+    return;
+
   if (document.GetFrame()) {
     gfx::Size scroll_offset = document.GetFrame()->GetScrollOffset();
     if (scroll_offset != last_scroll_offset_) {
@@ -525,10 +512,11 @@ void RenderAccessibilityImpl::HandleAXEvent(const WebAXObject& obj,
       // TODO(dmazzoni): remove this as soon as
       // https://bugs.webkit.org/show_bug.cgi?id=73460 is fixed.
       last_scroll_offset_ = scroll_offset;
-      auto webax_object = WebAXObject::FromWebDocument(document);
-      if (!obj.Equals(webax_object)) {
-        HandleAXEvent(webax_object, ax::mojom::Event::kLayoutComplete,
-                      event_from);
+      auto root_object = WebAXObject::FromWebDocument(document);
+      if (!obj.Equals(root_object)) {
+        HandleAXEvent(ui::AXEvent(root_object.AxID(),
+                                  ax::mojom::Event::kLayoutComplete,
+                                  event.event_from));
       }
     }
   }
@@ -536,47 +524,30 @@ void RenderAccessibilityImpl::HandleAXEvent(const WebAXObject& obj,
 #if defined(OS_ANDROID)
   // Force the newly focused node to be re-serialized so we include its
   // inline text boxes.
-  if (event == ax::mojom::Event::kFocus)
+  if (event.event_type == ax::mojom::Event::kFocus)
     serializer_.InvalidateSubtree(obj);
 #endif
 
-  // If some cell IDs have been added or removed, we need to update the whole
-  // table.
-  if (obj.Role() == ax::mojom::Role::kRow &&
-      event == ax::mojom::Event::kChildrenChanged) {
-    WebAXObject table_like_object = obj.ParentObject();
-    if (!table_like_object.IsDetached()) {
-      serializer_.InvalidateSubtree(table_like_object);
-      HandleAXEvent(table_like_object, ax::mojom::Event::kChildrenChanged);
-    }
-  }
-
   // If a select tag is opened or closed, all the children must be updated
   // because their visibility may have changed.
   if (obj.Role() == ax::mojom::Role::kMenuListPopup &&
-      event == ax::mojom::Event::kChildrenChanged) {
+      event.event_type == ax::mojom::Event::kChildrenChanged) {
     WebAXObject popup_like_object = obj.ParentObject();
     if (!popup_like_object.IsDetached()) {
       serializer_.InvalidateSubtree(popup_like_object);
-      HandleAXEvent(popup_like_object, ax::mojom::Event::kChildrenChanged);
+      HandleAXEvent(ui::AXEvent(popup_like_object.AxID(),
+                                ax::mojom::Event::kChildrenChanged));
     }
   }
 
-  // Add the accessibility object to our cache and ensure it's valid.
-  ui::AXEvent acc_event;
-  acc_event.id = obj.AxID();
-  acc_event.event_type = event;
-  acc_event.event_from = event_from;
-  acc_event.action_request_id = action_request_id;
-
   // Discard duplicate accessibility events.
-  for (uint32_t i = 0; i < pending_events_.size(); ++i) {
-    if (pending_events_[i].id == acc_event.id &&
-        pending_events_[i].event_type == acc_event.event_type) {
+  for (const ui::AXEvent& pending_event : pending_events_) {
+    if (pending_event.id == event.id &&
+        pending_event.event_type == event.event_type) {
       return;
     }
   }
-  pending_events_.push_back(acc_event);
+  pending_events_.push_back(event);
 
   ScheduleSendAccessibilityEventsIfNeeded();
 }
@@ -635,7 +606,8 @@ void RenderAccessibilityImpl::OnPluginRootNodeUpdated() {
     if (!node.IsNull() && node.IsElementNode()) {
       WebElement element = node.To<WebElement>();
       if (element.HasHTMLTagName("embed")) {
-        HandleAXEvent(obj, ax::mojom::Event::kChildrenChanged);
+        HandleAXEvent(
+            ui::AXEvent(obj.AxID(), ax::mojom::Event::kChildrenChanged));
         break;
       }
     }
@@ -654,6 +626,10 @@ WebDocument RenderAccessibilityImpl::GetMainDocument() {
   return WebDocument();
 }
 
+std::string RenderAccessibilityImpl::GetLanguage() {
+  return page_language_;
+}
+
 void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
   TRACE_EVENT0("accessibility",
                "RenderAccessibilityImpl::SendPendingAccessibilityEvents");
@@ -689,6 +665,10 @@ void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
 
   ScopedFreezeBlinkAXTreeSource freeze(&tree_source_);
 
+  // Save the page language.
+  WebAXObject root = tree_source_.GetRoot();
+  page_language_ = root.Language().Utf8();
+
   // Loop over each event and generate an updated event message.
   for (auto& event : src_events) {
     if (event.event_type == ax::mojom::Event::kLayoutComplete)
@@ -750,18 +730,6 @@ void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
 
     events.push_back(event);
 
-    // Whenever there's a change within a table, invalidate the
-    // whole table so that row and cell indexes are recomputed.
-    const ax::mojom::Role role = obj.Role();
-    if (ui::IsTableLike(role) || role == ax::mojom::Role::kRow ||
-        ui::IsCellOrTableHeader(role)) {
-      auto table = obj;
-      while (!table.IsDetached() && !ui::IsTableLike(table.Role()))
-        table = table.ParentObject();
-      if (!table.IsDetached())
-        serializer_.InvalidateSubtree(table);
-    }
-
     VLOG(1) << "Accessibility event: " << ui::ToString(event.event_type)
             << " on node id " << event.id;
 
@@ -949,7 +917,7 @@ void RenderAccessibilityImpl::OnLoadInlineTextBoxes(
   serializer_.InvalidateSubtree(obj);
 
   // Explicitly send a tree change update event now.
-  HandleAXEvent(obj, ax::mojom::Event::kTreeChanged);
+  HandleAXEvent(ui::AXEvent(obj.AxID(), ax::mojom::Event::kTreeChanged));
 }
 
 void RenderAccessibilityImpl::OnGetImageData(const ui::AXActionTarget* target,
@@ -972,7 +940,7 @@ void RenderAccessibilityImpl::OnGetImageData(const ui::AXActionTarget* target,
     return;
 
   serializer_.InvalidateSubtree(obj);
-  HandleAXEvent(obj, ax::mojom::Event::kImageFrameUpdated);
+  HandleAXEvent(ui::AXEvent(obj.AxID(), ax::mojom::Event::kImageFrameUpdated));
 }
 
 void RenderAccessibilityImpl::OnDestruct() {
@@ -1021,13 +989,8 @@ void RenderAccessibilityImpl::CreateAXImageAnnotator() {
   render_frame_->GetBrowserInterfaceBroker()->GetInterface(
       annotator.InitWithNewPipeAndPassReceiver());
 
-  const std::string preferred_language =
-      render_frame_->render_view()
-          ? GetPreferredLanguage(
-                render_frame_->render_view()->GetAcceptLanguages())
-          : std::string();
-  ax_image_annotator_ = std::make_unique<AXImageAnnotator>(
-      this, preferred_language, std::move(annotator));
+  ax_image_annotator_ =
+      std::make_unique<AXImageAnnotator>(this, std::move(annotator));
   tree_source_.AddImageAnnotator(ax_image_annotator_.get());
 }
 
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl.h b/chromium/content/renderer/accessibility/render_accessibility_impl.h
index f064ebf3119..47814c1adcc 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl.h
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_RENDERER_ACCESSIBILITY_RENDER_ACCESSIBILITY_IMPL_H_
 #define CONTENT_RENDERER_ACCESSIBILITY_RENDER_ACCESSIBILITY_IMPL_H_
 
+#include <memory>
 #include <unordered_map>
 #include <vector>
 
@@ -18,9 +19,9 @@
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "content/renderer/accessibility/blink_ax_tree_source.h"
-#include "third_party/blink/public/mojom/renderer_preference_watcher.mojom.h"
 #include "third_party/blink/public/web/web_ax_context.h"
 #include "third_party/blink/public/web/web_ax_object.h"
+#include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_relative_bounds.h"
 #include "ui/accessibility/ax_tree.h"
 #include "ui/accessibility/ax_tree_serializer.h"
@@ -91,10 +92,8 @@ class AXTreeSnapshotterImpl : public AXTreeSnapshotter {
 // representation of that tree whenever it changes. It also handles requests
 // from the browser to perform accessibility actions on nodes in the tree (e.g.,
 // change focus, or click on a button).
-class CONTENT_EXPORT RenderAccessibilityImpl
-    : public RenderAccessibility,
-      public RenderFrameObserver,
-      public blink::mojom::RendererPreferenceWatcher {
+class CONTENT_EXPORT RenderAccessibilityImpl : public RenderAccessibility,
+                                               public RenderFrameObserver {
  public:
   // Request a one-time snapshot of the accessibility tree without
   // enabling accessibility if it wasn't already enabled.
@@ -128,25 +127,19 @@ class CONTENT_EXPORT RenderAccessibilityImpl
   void PerformAction(const ui::AXActionData& data);
   void Reset(int32_t reset_token);
 
-  // blink::mojom::RendererPreferenceObserver implementation.
-  void NotifyUpdate(blink::mojom::RendererPreferencesPtr new_prefs) override;
-
   // Called when an accessibility notification occurs in Blink.
-  void HandleWebAccessibilityEvent(const blink::WebAXObject& obj,
-                                   ax::mojom::Event event,
-                                   ax::mojom::EventFrom event_from);
+  void HandleWebAccessibilityEvent(const ui::AXEvent& event);
   void MarkWebAXObjectDirty(const blink::WebAXObject& obj, bool subtree);
 
-  void HandleAXEvent(
-      const blink::WebAXObject& obj,
-      ax::mojom::Event event,
-      ax::mojom::EventFrom event_from = ax::mojom::EventFrom::kNone,
-      int action_request_id = -1);
+  void HandleAXEvent(const ui::AXEvent& event);
 
   // Returns the main top-level document for this page, or NULL if there's
   // no view or frame.
   blink::WebDocument GetMainDocument();
 
+  // Returns the page language.
+  std::string GetLanguage();
+
  protected:
   // Send queued events from the renderer to the browser.
   void SendPendingAccessibilityEvents();
@@ -210,10 +203,6 @@ class CONTENT_EXPORT RenderAccessibilityImpl
   // Manages the automatic image annotations, if enabled.
   std::unique_ptr<AXImageAnnotator> ax_image_annotator_;
 
-  // The Mojo receiver for this object as a RenderPreferenceWatcher.
-  mojo::Receiver<blink::mojom::RendererPreferenceWatcher>
-      pref_watcher_receiver_{this};
-
   // Events from Blink are collected until they are ready to be
   // sent to the browser.
   std::vector<ui::AXEvent> pending_events_;
@@ -259,6 +248,9 @@ class CONTENT_EXPORT RenderAccessibilityImpl
   // for debugging.
   bool image_annotation_debugging_ = false;
 
+  // The specified page language, or empty if unknown.
+  std::string page_language_;
+
   // So we can queue up tasks to be executed later.
   base::WeakPtrFactory<RenderAccessibilityImpl> weak_factory_{this};
 
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc b/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
index b46fb4e0342..3781c691064 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
@@ -50,6 +50,8 @@
 #include "third_party/blink/public/web/web_node.h"
 #include "third_party/blink/public/web/web_view.h"
 #include "ui/accessibility/ax_action_target.h"
+#include "ui/accessibility/ax_enums.mojom.h"
+#include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/accessibility/null_ax_action_target.h"
@@ -61,13 +63,24 @@ using blink::WebAXObject;
 using blink::WebDocument;
 using testing::ElementsAre;
 
+namespace {
+
+#if !defined(OS_ANDROID)
+bool IsSelected(const WebAXObject& obj) {
+  ui::AXNodeData node_data;
+  obj.Serialize(&node_data);
+  return node_data.GetBoolAttribute(ax::mojom::BoolAttribute::kSelected);
+}
+#endif  // !defined(OS_ANDROID)
+
+}  // namespace
+
 class TestAXImageAnnotator : public AXImageAnnotator {
  public:
   TestAXImageAnnotator(
       RenderAccessibilityImpl* const render_accessibility,
       mojo::PendingRemote<image_annotation::mojom::Annotator> annotator)
       : AXImageAnnotator(render_accessibility,
-                         std::string() /* preferred_language */,
                          std::move(annotator)) {}
   ~TestAXImageAnnotator() override = default;
 
@@ -262,7 +275,7 @@ class RenderAccessibilityImplTest : public RenderViewTest {
     WebAXObject root_obj = WebAXObject::FromWebDocument(document);
     EXPECT_FALSE(root_obj.IsNull());
     GetRenderAccessibilityImpl()->HandleAXEvent(
-        root_obj, ax::mojom::Event::kLayoutComplete);
+        ui::AXEvent(root_obj.AxID(), ax::mojom::Event::kLayoutComplete));
     SendPendingAccessibilityEvents();
   }
 
@@ -356,7 +369,7 @@ TEST_F(RenderAccessibilityImplTest, SendFullAccessibilityTreeOnReload) {
   WebDocument document = GetMainFrame()->GetDocument();
   WebAXObject root_obj = WebAXObject::FromWebDocument(document);
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      root_obj, ax::mojom::Event::kLayoutComplete);
+      ui::AXEvent(root_obj.AxID(), ax::mojom::Event::kLayoutComplete));
   SendPendingAccessibilityEvents();
   EXPECT_EQ(1, CountAccessibilityNodesSentToBrowser());
   {
@@ -373,7 +386,7 @@ TEST_F(RenderAccessibilityImplTest, SendFullAccessibilityTreeOnReload) {
   root_obj = WebAXObject::FromWebDocument(document);
   ClearHandledUpdates();
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      root_obj, ax::mojom::Event::kLayoutComplete);
+      ui::AXEvent(root_obj.AxID(), ax::mojom::Event::kLayoutComplete));
   SendPendingAccessibilityEvents();
   EXPECT_EQ(5, CountAccessibilityNodesSentToBrowser());
 
@@ -386,7 +399,7 @@ TEST_F(RenderAccessibilityImplTest, SendFullAccessibilityTreeOnReload) {
   ClearHandledUpdates();
   const WebAXObject& first_child = root_obj.ChildAt(0);
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      first_child, ax::mojom::Event::kLiveRegionChanged);
+      ui::AXEvent(first_child.AxID(), ax::mojom::Event::kLiveRegionChanged));
   SendPendingAccessibilityEvents();
   EXPECT_EQ(5, CountAccessibilityNodesSentToBrowser());
 }
@@ -424,7 +437,7 @@ TEST_F(RenderAccessibilityImplTest, HideAccessibilityObject) {
   // Send a childrenChanged on "A".
   ClearHandledUpdates();
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      node_a, ax::mojom::Event::kChildrenChanged);
+      ui::AXEvent(node_a.AxID(), ax::mojom::Event::kChildrenChanged));
   SendPendingAccessibilityEvents();
   AXContentTreeUpdate update = GetLastAccUpdate();
   ASSERT_EQ(2U, update.nodes.size());
@@ -472,7 +485,7 @@ TEST_F(RenderAccessibilityImplTest, ShowAccessibilityObject) {
   ClearHandledUpdates();
 
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      node_a, ax::mojom::Event::kChildrenChanged);
+      ui::AXEvent(node_a.AxID(), ax::mojom::Event::kChildrenChanged));
   SendPendingAccessibilityEvents();
   AXContentTreeUpdate update = GetLastAccUpdate();
 
@@ -708,9 +721,9 @@ TEST_F(BlinkAXActionTargetTest, TestMethods) {
 
   // Android does not produce accessible items for option elements.
 #if !defined(OS_ANDROID)
-  EXPECT_EQ(blink::kWebAXSelectedStateFalse, option.IsSelected());
+  EXPECT_FALSE(IsSelected(option));
   EXPECT_TRUE(option_action_target->SetSelected(true));
-  EXPECT_EQ(blink::kWebAXSelectedStateTrue, option.IsSelected());
+  EXPECT_TRUE(IsSelected(option));
 #endif
 
   std::string value_to_set("test-value");
diff --git a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
index 1716c649c2c..d002a87ab24 100644
--- a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
+++ b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
@@ -8,9 +8,10 @@
 
 #include "base/auto_reset.h"
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
+#include "base/notreached.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "cc/trees/layer_tree_frame_sink_client.h"
@@ -137,7 +138,9 @@ class SynchronousLayerTreeFrameSink::SoftwareOutputSurface
 };
 
 base::TimeDelta SynchronousLayerTreeFrameSink::StubDisplayClient::
-    GetPreferredFrameIntervalForFrameSinkId(const viz::FrameSinkId& id) {
+    GetPreferredFrameIntervalForFrameSinkId(
+        const viz::FrameSinkId& id,
+        viz::mojom::CompositorFrameSinkType* type) {
   return viz::BeginFrameArgs::MinInterval();
 }
 
diff --git a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h
index 14b9c3b12e1..8e2a2c39220 100644
--- a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h
+++ b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h
@@ -188,9 +188,11 @@ class SynchronousLayerTreeFrameSink
     void DisplayDidReceiveCALayerParams(
         const gfx::CALayerParams& ca_layer_params) override {}
     void DisplayDidCompleteSwapWithSize(const gfx::Size& pixel_size) override {}
+    void SetWideColorEnabled(bool enabled) override {}
     void SetPreferredFrameInterval(base::TimeDelta interval) override {}
     base::TimeDelta GetPreferredFrameIntervalForFrameSinkId(
-        const viz::FrameSinkId& id) override;
+        const viz::FrameSinkId& id,
+        viz::mojom::CompositorFrameSinkType* type) override;
   };
 
   // TODO(danakj): These don't to be stored in unique_ptrs when OutputSurface
diff --git a/chromium/content/renderer/browser_render_view_browsertest.cc b/chromium/content/renderer/browser_render_view_browsertest.cc
index 28e0505c030..7431feb78d8 100644
--- a/chromium/content/renderer/browser_render_view_browsertest.cc
+++ b/chromium/content/renderer/browser_render_view_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_view.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -156,18 +157,8 @@ IN_PROC_BROWSER_TEST_F(RenderViewBrowserTest,
   GURL test_url(embedded_test_server()->GetURL("/nocache-with-etag.html"));
   NavigateToURLAndWaitForTitle(test_url, "Nocache Test Page", 1);
 
-  // Reload same URL after forcing an error from the the network layer;
-  // confirm that the error page is told the cached copy exists.
-  {
-    mojo::ScopedAllowSyncCallForTesting allow_sync_call;
-    content::StoragePartition* partition = shell()
-                                               ->web_contents()
-                                               ->GetMainFrame()
-                                               ->GetProcess()
-                                               ->GetStoragePartition();
-    partition->GetNetworkContext()->SetFailingHttpTransactionForTesting(
-        net::ERR_FAILED);
-  }
+  // Shut down the server to force a network error.
+  ASSERT_TRUE(embedded_test_server()->ShutdownAndWaitUntilComplete());
 
   // An error results in one completed navigation.
   NavigateToURLBlockUntilNavigationsComplete(shell(), test_url, 1);
@@ -175,7 +166,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewBrowserTest,
   bool stale_cache_entry_present = false;
   ASSERT_TRUE(GetLatestErrorFromRendererClient(
       &error_code, &stale_cache_entry_present));
-  EXPECT_EQ(net::ERR_FAILED, error_code);
+  EXPECT_EQ(net::ERR_CONNECTION_REFUSED, error_code);
   EXPECT_TRUE(stale_cache_entry_present);
 
   // Clear the cache and repeat; confirm lack of entry in cache reported.
@@ -198,7 +189,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewBrowserTest,
   stale_cache_entry_present = true;
   ASSERT_TRUE(GetLatestErrorFromRendererClient(
       &error_code, &stale_cache_entry_present));
-  EXPECT_EQ(net::ERR_FAILED, error_code);
+  EXPECT_EQ(net::ERR_CONNECTION_REFUSED, error_code);
   EXPECT_FALSE(stale_cache_entry_present);
 }
 
diff --git a/chromium/content/renderer/categorized_worker_pool.cc b/chromium/content/renderer/categorized_worker_pool.cc
index 7e010566456..7ada1cfffac 100644
--- a/chromium/content/renderer/categorized_worker_pool.cc
+++ b/chromium/content/renderer/categorized_worker_pool.cc
@@ -239,9 +239,10 @@ bool CategorizedWorkerPool::PostDelayedTask(const base::Location& from_here,
   DCHECK(completed_tasks_.empty());
   CollectCompletedTasksWithLockAcquired(namespace_token_, &completed_tasks_);
 
-  base::EraseIf(tasks_, [this](const scoped_refptr<cc::Task>& e) {
-    return base::Contains(this->completed_tasks_, e);
-  });
+  base::EraseIf(tasks_, [this](const scoped_refptr<cc::Task>& e)
+                            EXCLUSIVE_LOCKS_REQUIRED(lock_) {
+                              return base::Contains(this->completed_tasks_, e);
+                            });
 
   tasks_.push_back(base::MakeRefCounted<ClosureTask>(std::move(task)));
   graph_.Reset();
diff --git a/chromium/content/renderer/categorized_worker_pool.h b/chromium/content/renderer/categorized_worker_pool.h
index 24c1b2a0f54..ab0b9959702 100644
--- a/chromium/content/renderer/categorized_worker_pool.h
+++ b/chromium/content/renderer/categorized_worker_pool.h
@@ -12,6 +12,7 @@
 #include "base/sequenced_task_runner.h"
 #include "base/synchronization/condition_variable.h"
 #include "base/task_runner.h"
+#include "base/thread_annotations.h"
 #include "base/threading/simple_thread.h"
 #include "cc/raster/task_category.h"
 #include "cc/raster/task_graph_runner.h"
@@ -104,25 +105,31 @@ class CONTENT_EXPORT CategorizedWorkerPool : public base::TaskRunner,
   };
 
   void ScheduleTasksWithLockAcquired(cc::NamespaceToken token,
-                                     cc::TaskGraph* graph);
+                                     cc::TaskGraph* graph)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
   void CollectCompletedTasksWithLockAcquired(cc::NamespaceToken token,
-                                             cc::Task::Vector* completed_tasks);
+                                             cc::Task::Vector* completed_tasks)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Runs a task from one of the provided categories. Categories listed first
   // have higher priority. Returns false if there were no tasks to run.
-  bool RunTaskWithLockAcquired(const std::vector<cc::TaskCategory>& categories);
+  bool RunTaskWithLockAcquired(const std::vector<cc::TaskCategory>& categories)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Run next task for the given category. Caller must acquire |lock_| prior to
   // calling this function and make sure at least one task is ready to run.
-  void RunTaskInCategoryWithLockAcquired(cc::TaskCategory category);
+  void RunTaskInCategoryWithLockAcquired(cc::TaskCategory category)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Helper function which signals worker threads if tasks are ready to run.
-  void SignalHasReadyToRunTasksWithLockAcquired();
+  void SignalHasReadyToRunTasksWithLockAcquired()
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Determines if we should run a new task for the given category. This factors
   // in whether a task is available and whether the count of running tasks is
   // low enough to start a new one.
-  bool ShouldRunTaskForCategoryWithLockAcquired(cc::TaskCategory category);
+  bool ShouldRunTaskForCategoryWithLockAcquired(cc::TaskCategory category)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // The actual threads where work is done.
   std::vector<std::unique_ptr<base::SimpleThread>> threads_;
@@ -131,16 +138,16 @@ class CONTENT_EXPORT CategorizedWorkerPool : public base::TaskRunner,
   // implement the TaskRunner and TaskGraphRunner interfaces.
   base::Lock lock_;
   // Stores the tasks to be run, sorted by priority.
-  cc::TaskGraphWorkQueue work_queue_;
+  cc::TaskGraphWorkQueue work_queue_ GUARDED_BY(lock_);
   // Namespace used to schedule tasks in the task graph runner.
-  cc::NamespaceToken namespace_token_;
+  const cc::NamespaceToken namespace_token_;
   // List of tasks currently queued up for execution.
-  cc::Task::Vector tasks_;
+  cc::Task::Vector tasks_ GUARDED_BY(lock_);
   // Graph object used for scheduling tasks.
-  cc::TaskGraph graph_;
+  cc::TaskGraph graph_ GUARDED_BY(lock_);
   // Cached vector to avoid allocation when getting the list of complete
   // tasks.
-  cc::Task::Vector completed_tasks_;
+  cc::Task::Vector completed_tasks_ GUARDED_BY(lock_);
   // Condition variables for foreground and background tasks.
   base::ConditionVariable has_ready_to_run_foreground_tasks_cv_;
   base::ConditionVariable has_ready_to_run_background_tasks_cv_;
@@ -148,7 +155,7 @@ class CONTENT_EXPORT CategorizedWorkerPool : public base::TaskRunner,
   // has finished running all associated tasks.
   base::ConditionVariable has_namespaces_with_finished_running_tasks_cv_;
   // Set during shutdown. Tells Run() to return when no more tasks are pending.
-  bool shutdown_;
+  bool shutdown_ GUARDED_BY(lock_);
 
   base::OnceCallback<void(base::PlatformThreadId)> backgrounding_callback_;
   scoped_refptr<base::SingleThreadTaskRunner> background_task_runner_;
diff --git a/chromium/content/renderer/compositor/compositor_dependencies.h b/chromium/content/renderer/compositor/compositor_dependencies.h
index d0e022df4f5..7d00b7c14ac 100644
--- a/chromium/content/renderer/compositor/compositor_dependencies.h
+++ b/chromium/content/renderer/compositor/compositor_dependencies.h
@@ -47,12 +47,7 @@ class CONTENT_EXPORT CompositorDependencies {
   virtual bool IsGpuMemoryBufferCompositorResourcesEnabled() = 0;
   virtual bool IsElasticOverscrollEnabled() = 0;
   virtual bool IsUseZoomForDSFEnabled() = 0;
-  virtual scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorMainThreadTaskRunner() = 0;
-  // Returns null if the compositor is in single-threaded mode (ie. there is no
-  // compositor thread).
-  virtual scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorImplThreadTaskRunner() = 0;
+  virtual bool IsSingleThreaded() = 0;
   virtual scoped_refptr<base::SingleThreadTaskRunner>
   GetCleanupTaskRunner() = 0;
   virtual blink::scheduler::WebThreadScheduler* GetWebMainThreadScheduler() = 0;
diff --git a/chromium/content/renderer/compositor/layer_tree_view.cc b/chromium/content/renderer/compositor/layer_tree_view.cc
deleted file mode 100644
index d26fe9db351..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view.cc
+++ /dev/null
@@ -1,369 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/compositor/layer_tree_view.h"
-
-#include <stddef.h>
-#include <string>
-#include <utility>
-
-#include "base/auto_reset.h"
-#include "base/bind.h"
-#include "base/callback.h"
-#include "base/feature_list.h"
-#include "base/location.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/single_thread_task_runner.h"
-#include "base/task/post_task.h"
-#include "base/task/task_traits.h"
-#include "base/task/thread_pool.h"
-#include "base/task/thread_pool/thread_pool_instance.h"
-#include "base/time/time.h"
-#include "base/values.h"
-#include "cc/animation/animation_host.h"
-#include "cc/animation/animation_timeline.h"
-#include "cc/base/region.h"
-#include "cc/benchmarks/micro_benchmark.h"
-#include "cc/debug/layer_tree_debug_state.h"
-#include "cc/input/layer_selection_bound.h"
-#include "cc/layers/layer.h"
-#include "cc/trees/layer_tree_host.h"
-#include "cc/trees/layer_tree_mutator.h"
-#include "cc/trees/render_frame_metadata_observer.h"
-#include "cc/trees/swap_promise.h"
-#include "cc/trees/ukm_manager.h"
-#include "components/viz/common/frame_sinks/begin_frame_args.h"
-#include "components/viz/common/frame_sinks/begin_frame_source.h"
-#include "components/viz/common/quads/compositor_frame_metadata.h"
-#include "components/viz/common/resources/single_release_callback.h"
-#include "content/renderer/compositor/layer_tree_view_delegate.h"
-#include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "third_party/blink/public/platform/web_runtime_features.h"
-#include "third_party/blink/public/web/blink.h"
-#include "ui/gfx/presentation_feedback.h"
-
-namespace base {
-class Value;
-}
-
-namespace cc {
-class Layer;
-}
-
-namespace content {
-
-LayerTreeView::LayerTreeView(
-    LayerTreeViewDelegate* delegate,
-    scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-    scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-    cc::TaskGraphRunner* task_graph_runner,
-    blink::scheduler::WebThreadScheduler* scheduler)
-    : main_thread_(std::move(main_thread)),
-      compositor_thread_(std::move(compositor_thread)),
-      task_graph_runner_(task_graph_runner),
-      web_main_thread_scheduler_(scheduler),
-      animation_host_(cc::AnimationHost::CreateMainInstance()),
-      delegate_(delegate) {}
-
-LayerTreeView::~LayerTreeView() = default;
-
-void LayerTreeView::Initialize(
-    const cc::LayerTreeSettings& settings,
-    std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory) {
-  DCHECK(delegate_);
-  const bool is_threaded = !!compositor_thread_;
-
-  cc::LayerTreeHost::InitParams params;
-  params.client = this;
-  params.scheduling_client = this;
-  params.settings = &settings;
-  params.task_graph_runner = task_graph_runner_;
-  params.main_task_runner = main_thread_;
-  params.mutator_host = animation_host_.get();
-  params.ukm_recorder_factory = std::move(ukm_recorder_factory);
-  if (base::ThreadPoolInstance::Get()) {
-    // The image worker thread needs to allow waiting since it makes discardable
-    // shared memory allocations which need to make synchronous calls to the
-    // IO thread.
-    params.image_worker_task_runner =
-        base::ThreadPool::CreateSequencedTaskRunner(
-            {base::WithBaseSyncPrimitives(), base::TaskPriority::USER_VISIBLE,
-             base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN});
-  }
-  if (!is_threaded) {
-    // Single-threaded web tests, and unit tests.
-    layer_tree_host_ =
-        cc::LayerTreeHost::CreateSingleThreaded(this, std::move(params));
-  } else {
-    layer_tree_host_ = cc::LayerTreeHost::CreateThreaded(compositor_thread_,
-                                                         std::move(params));
-  }
-}
-
-void LayerTreeView::Disconnect() {
-  DCHECK(delegate_);
-  // Drop compositor resources immediately, while keeping the compositor alive
-  // until after this class is destroyed.
-  layer_tree_host_->SetVisible(false);
-  layer_tree_host_->ReleaseLayerTreeFrameSink();
-  delegate_ = nullptr;
-}
-
-void LayerTreeView::SetVisible(bool visible) {
-  DCHECK(delegate_);
-  layer_tree_host_->SetVisible(visible);
-
-  if (visible && layer_tree_frame_sink_request_failed_while_invisible_)
-    DidFailToInitializeLayerTreeFrameSink();
-}
-
-void LayerTreeView::SetLayerTreeFrameSink(
-    std::unique_ptr<cc::LayerTreeFrameSink> layer_tree_frame_sink,
-    std::unique_ptr<cc::RenderFrameMetadataObserver>
-        render_frame_metadata_observer) {
-  DCHECK(delegate_);
-  if (!layer_tree_frame_sink) {
-    DidFailToInitializeLayerTreeFrameSink();
-    return;
-  }
-  if (render_frame_metadata_observer) {
-    layer_tree_host_->SetRenderFrameObserver(
-        std::move(render_frame_metadata_observer));
-  }
-  layer_tree_host_->SetLayerTreeFrameSink(std::move(layer_tree_frame_sink));
-}
-
-void LayerTreeView::WillBeginMainFrame() {
-  if (!delegate_)
-    return;
-  delegate_->WillBeginCompositorFrame();
-}
-
-void LayerTreeView::DidBeginMainFrame() {
-  if (!delegate_)
-    return;
-  delegate_->DidBeginMainFrame();
-}
-
-void LayerTreeView::WillUpdateLayers() {
-  if (!delegate_)
-    return;
-  delegate_->BeginUpdateLayers();
-}
-
-void LayerTreeView::DidUpdateLayers() {
-  if (!delegate_)
-    return;
-  delegate_->EndUpdateLayers();
-  // Dump property trees and layers if run with:
-  //   --vmodule=layer_tree_view=3
-  VLOG(3) << "After updating layers:\n"
-          << "property trees:\n"
-          << layer_tree_host_->property_trees()->ToString() << "\n"
-          << "cc::Layers:\n"
-          << layer_tree_host_->LayersAsString();
-}
-
-void LayerTreeView::BeginMainFrame(const viz::BeginFrameArgs& args) {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->WillBeginFrame(args);
-  delegate_->BeginMainFrame(args.frame_time);
-}
-
-void LayerTreeView::OnDeferMainFrameUpdatesChanged(bool status) {
-  if (!delegate_)
-    return;
-  delegate_->OnDeferMainFrameUpdatesChanged(status);
-}
-
-void LayerTreeView::OnDeferCommitsChanged(bool status) {
-  if (!delegate_)
-    return;
-  delegate_->OnDeferCommitsChanged(status);
-}
-
-void LayerTreeView::BeginMainFrameNotExpectedSoon() {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->BeginFrameNotExpectedSoon();
-}
-
-void LayerTreeView::BeginMainFrameNotExpectedUntil(base::TimeTicks time) {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->BeginMainFrameNotExpectedUntil(time);
-}
-
-void LayerTreeView::UpdateLayerTreeHost() {
-  if (!delegate_)
-    return;
-  delegate_->UpdateVisualState();
-}
-
-void LayerTreeView::ApplyViewportChanges(
-    const cc::ApplyViewportChangesArgs& args) {
-  if (!delegate_)
-    return;
-  delegate_->ApplyViewportChanges(args);
-}
-
-void LayerTreeView::RecordManipulationTypeCounts(cc::ManipulationInfo info) {
-  if (!delegate_)
-    return;
-  delegate_->RecordManipulationTypeCounts(info);
-}
-
-void LayerTreeView::SendOverscrollEventFromImplSide(
-    const gfx::Vector2dF& overscroll_delta,
-    cc::ElementId scroll_latched_element_id) {
-  if (!delegate_)
-    return;
-  delegate_->SendOverscrollEventFromImplSide(overscroll_delta,
-                                             scroll_latched_element_id);
-}
-
-void LayerTreeView::SendScrollEndEventFromImplSide(
-    cc::ElementId scroll_latched_element_id) {
-  if (!delegate_)
-    return;
-  delegate_->SendScrollEndEventFromImplSide(scroll_latched_element_id);
-}
-
-void LayerTreeView::RequestNewLayerTreeFrameSink() {
-  if (!delegate_)
-    return;
-  // When the compositor is not visible it would not request a
-  // LayerTreeFrameSink so this is a race where it requested one on the
-  // compositor thread while becoming non-visible on the main thread. In that
-  // case, we can wait for it to become visible again before replying.
-  if (!layer_tree_host_->IsVisible()) {
-    layer_tree_frame_sink_request_failed_while_invisible_ = true;
-    return;
-  }
-
-  delegate_->RequestNewLayerTreeFrameSink(base::BindOnce(
-      &LayerTreeView::SetLayerTreeFrameSink, weak_factory_.GetWeakPtr()));
-}
-
-void LayerTreeView::DidInitializeLayerTreeFrameSink() {}
-
-void LayerTreeView::DidFailToInitializeLayerTreeFrameSink() {
-  if (!delegate_)
-    return;
-  // When the RenderWidget is made hidden while an async request for a
-  // LayerTreeFrameSink is being processed, then if it fails we would arrive
-  // here. Since the compositor does not request a LayerTreeFrameSink while not
-  // visible, we can delay trying again until becoming visible again.
-  if (!layer_tree_host_->IsVisible()) {
-    layer_tree_frame_sink_request_failed_while_invisible_ = true;
-    return;
-  }
-  layer_tree_frame_sink_request_failed_while_invisible_ = false;
-  layer_tree_host_->GetTaskRunnerProvider()->MainThreadTaskRunner()->PostTask(
-      FROM_HERE, base::BindOnce(&LayerTreeView::RequestNewLayerTreeFrameSink,
-                                weak_factory_.GetWeakPtr()));
-}
-
-void LayerTreeView::WillCommit() {
-  if (!delegate_)
-    return;
-  delegate_->WillCommitCompositorFrame();
-}
-
-void LayerTreeView::DidCommit(base::TimeTicks commit_start_time) {
-  if (!delegate_)
-    return;
-  delegate_->DidCommitCompositorFrame(commit_start_time);
-  web_main_thread_scheduler_->DidCommitFrameToCompositor();
-}
-
-void LayerTreeView::DidCommitAndDrawFrame() {
-  if (!delegate_)
-    return;
-  delegate_->DidCommitAndDrawCompositorFrame();
-}
-
-void LayerTreeView::DidCompletePageScaleAnimation() {
-  if (!delegate_)
-    return;
-  delegate_->DidCompletePageScaleAnimation();
-}
-
-void LayerTreeView::DidPresentCompositorFrame(
-    uint32_t frame_token,
-    const gfx::PresentationFeedback& feedback) {
-  if (!delegate_)
-    return;
-  DCHECK(layer_tree_host_->GetTaskRunnerProvider()
-             ->MainThreadTaskRunner()
-             ->RunsTasksInCurrentSequence());
-  while (!presentation_callbacks_.empty()) {
-    const auto& front = presentation_callbacks_.begin();
-    if (viz::FrameTokenGT(front->first, frame_token))
-      break;
-    for (auto& callback : front->second)
-      std::move(callback).Run(feedback.timestamp);
-    presentation_callbacks_.erase(front);
-  }
-}
-
-void LayerTreeView::RecordStartOfFrameMetrics() {
-  if (!delegate_)
-    return;
-  delegate_->RecordStartOfFrameMetrics();
-}
-
-void LayerTreeView::RecordEndOfFrameMetrics(
-    base::TimeTicks frame_begin_time,
-    cc::ActiveFrameSequenceTrackers trackers) {
-  if (!delegate_)
-    return;
-  delegate_->RecordEndOfFrameMetrics(frame_begin_time, trackers);
-}
-
-std::unique_ptr<cc::BeginMainFrameMetrics>
-LayerTreeView::GetBeginMainFrameMetrics() {
-  if (!delegate_)
-    return nullptr;
-  return delegate_->GetBeginMainFrameMetrics();
-}
-
-void LayerTreeView::DidScheduleBeginMainFrame() {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->DidScheduleBeginMainFrame();
-}
-
-void LayerTreeView::DidRunBeginMainFrame() {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->DidRunBeginMainFrame();
-}
-
-void LayerTreeView::DidSubmitCompositorFrame() {}
-
-void LayerTreeView::DidLoseLayerTreeFrameSink() {}
-
-void LayerTreeView::AddPresentationCallback(
-    uint32_t frame_token,
-    base::OnceCallback<void(base::TimeTicks)> callback) {
-  DCHECK(delegate_);
-  if (!presentation_callbacks_.empty()) {
-    auto& previous = presentation_callbacks_.back();
-    uint32_t previous_frame_token = previous.first;
-    if (previous_frame_token == frame_token) {
-      previous.second.push_back(std::move(callback));
-      DCHECK_LE(previous.second.size(), 250u);
-      return;
-    }
-    DCHECK(viz::FrameTokenGT(frame_token, previous_frame_token));
-  }
-  std::vector<base::OnceCallback<void(base::TimeTicks)>> callbacks;
-  callbacks.push_back(std::move(callback));
-  presentation_callbacks_.push_back({frame_token, std::move(callbacks)});
-  DCHECK_LE(presentation_callbacks_.size(), 25u);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/compositor/layer_tree_view.h b/chromium/content/renderer/compositor/layer_tree_view.h
deleted file mode 100644
index 343c2a9bf82..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view.h
+++ /dev/null
@@ -1,162 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_H_
-#define CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_H_
-
-#include <stdint.h>
-
-#include "base/callback.h"
-#include "base/containers/circular_deque.h"
-#include "base/memory/weak_ptr.h"
-#include "base/single_thread_task_runner.h"
-#include "base/time/time.h"
-#include "base/values.h"
-#include "cc/input/browser_controls_state.h"
-#include "cc/trees/layer_tree_host_client.h"
-#include "cc/trees/layer_tree_host_single_thread_client.h"
-#include "cc/trees/swap_promise.h"
-#include "cc/trees/swap_promise_monitor.h"
-#include "content/common/content_export.h"
-#include "ui/gfx/geometry/rect.h"
-
-namespace blink {
-namespace scheduler {
-class WebThreadScheduler;
-}
-}  // namespace blink
-
-namespace cc {
-class AnimationHost;
-class LayerTreeFrameSink;
-class LayerTreeHost;
-class LayerTreeSettings;
-class RenderFrameMetadataObserver;
-class TaskGraphRunner;
-class UkmRecorderFactory;
-}  // namespace cc
-
-namespace content {
-class LayerTreeViewDelegate;
-
-class CONTENT_EXPORT LayerTreeView : public cc::LayerTreeHostClient,
-                                     public cc::LayerTreeHostSingleThreadClient,
-                                     public cc::LayerTreeHostSchedulingClient {
- public:
-  // The |main_thread| is the task runner that the compositor will use for the
-  // main thread (where it is constructed). The |compositor_thread| is the task
-  // runner for the compositor thread, but is null if the compositor will run in
-  // single-threaded mode (in tests only).
-  LayerTreeView(LayerTreeViewDelegate* delegate,
-                scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-                scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-                cc::TaskGraphRunner* task_graph_runner,
-                blink::scheduler::WebThreadScheduler* scheduler);
-  ~LayerTreeView() override;
-
-  // The |ukm_recorder_factory| may be null to disable recording (in tests
-  // only).
-  void Initialize(const cc::LayerTreeSettings& settings,
-                  std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory);
-
-  // Drops any references back to the delegate in preparation for being
-  // destroyed.
-  void Disconnect();
-
-  cc::AnimationHost* animation_host() { return animation_host_.get(); }
-
-  void SetVisible(bool visible);
-
-  // cc::LayerTreeHostClient implementation.
-  void WillBeginMainFrame() override;
-  void DidBeginMainFrame() override;
-  void WillUpdateLayers() override;
-  void DidUpdateLayers() override;
-  void BeginMainFrame(const viz::BeginFrameArgs& args) override;
-  void OnDeferMainFrameUpdatesChanged(bool) override;
-  void OnDeferCommitsChanged(bool) override;
-  void BeginMainFrameNotExpectedSoon() override;
-  void BeginMainFrameNotExpectedUntil(base::TimeTicks time) override;
-  void UpdateLayerTreeHost() override;
-  void ApplyViewportChanges(const cc::ApplyViewportChangesArgs& args) override;
-  void RecordManipulationTypeCounts(cc::ManipulationInfo info) override;
-  void SendOverscrollEventFromImplSide(
-      const gfx::Vector2dF& overscroll_delta,
-      cc::ElementId scroll_latched_element_id) override;
-  void SendScrollEndEventFromImplSide(
-      cc::ElementId scroll_latched_element_id) override;
-  void RequestNewLayerTreeFrameSink() override;
-  void DidInitializeLayerTreeFrameSink() override;
-  void DidFailToInitializeLayerTreeFrameSink() override;
-  void WillCommit() override;
-  void DidCommit(base::TimeTicks commit_start_time) override;
-  void DidCommitAndDrawFrame() override;
-  void DidReceiveCompositorFrameAck() override {}
-  void DidCompletePageScaleAnimation() override;
-  void DidPresentCompositorFrame(
-      uint32_t frame_token,
-      const gfx::PresentationFeedback& feedback) override;
-  void RecordStartOfFrameMetrics() override;
-  void RecordEndOfFrameMetrics(
-      base::TimeTicks frame_begin_time,
-      cc::ActiveFrameSequenceTrackers trackers) override;
-  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
-      override;
-
-  // cc::LayerTreeHostSingleThreadClient implementation.
-  void DidSubmitCompositorFrame() override;
-  void DidLoseLayerTreeFrameSink() override;
-
-  // cc::LayerTreeHostSchedulingClient implementation.
-  void DidScheduleBeginMainFrame() override;
-  void DidRunBeginMainFrame() override;
-
-  void AddPresentationCallback(
-      uint32_t frame_token,
-      base::OnceCallback<void(base::TimeTicks)> callback);
-
-  cc::LayerTreeHost* layer_tree_host() { return layer_tree_host_.get(); }
-  const cc::LayerTreeHost* layer_tree_host() const {
-    return layer_tree_host_.get();
-  }
-
- protected:
-  friend class RenderViewImplScaleFactorTest;
-
- private:
-  void SetLayerTreeFrameSink(
-      std::unique_ptr<cc::LayerTreeFrameSink> layer_tree_frame_sink,
-      std::unique_ptr<cc::RenderFrameMetadataObserver>
-          render_frame_metadata_observer);
-
-  const scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  const scoped_refptr<base::SingleThreadTaskRunner> compositor_thread_;
-  cc::TaskGraphRunner* const task_graph_runner_;
-  blink::scheduler::WebThreadScheduler* const web_main_thread_scheduler_;
-  const std::unique_ptr<cc::AnimationHost> animation_host_;
-
-  // The delegate_ becomes null when Disconnect() is called. After that, the
-  // class should do nothing in calls from the LayerTreeHost, and just wait to
-  // be destroyed. It is not expected to be used at all after Disconnect()
-  // outside of handling/dropping LayerTreeHost client calls.
-  LayerTreeViewDelegate* delegate_;
-  std::unique_ptr<cc::LayerTreeHost> layer_tree_host_;
-
-  // This class should do nothing and access no pointers once this value becomes
-  // true.
-  bool layer_tree_frame_sink_request_failed_while_invisible_ = false;
-
-  base::circular_deque<
-      std::pair<uint32_t,
-                std::vector<base::OnceCallback<void(base::TimeTicks)>>>>
-      presentation_callbacks_;
-
-  base::WeakPtrFactory<LayerTreeView> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(LayerTreeView);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_H_
diff --git a/chromium/content/renderer/compositor/layer_tree_view_delegate.h b/chromium/content/renderer/compositor/layer_tree_view_delegate.h
deleted file mode 100644
index 45deac5fd7c..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view_delegate.h
+++ /dev/null
@@ -1,123 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_DELEGATE_H_
-#define CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_DELEGATE_H_
-
-#include <memory>
-#include <vector>
-
-#include "base/callback.h"
-#include "base/time/time.h"
-#include "cc/trees/layer_tree_host_client.h"
-
-namespace cc {
-class LayerTreeFrameSink;
-struct BeginMainFrameMetrics;
-struct ElementId;
-class RenderFrameMetadataObserver;
-}  // namespace cc
-
-namespace content {
-
-// Consumers of LayerTreeView implement this delegate in order to
-// transport compositing information across processes.
-class LayerTreeViewDelegate {
- public:
-  using LayerTreeFrameSinkCallback = base::OnceCallback<void(
-      std::unique_ptr<cc::LayerTreeFrameSink>,
-      std::unique_ptr<cc::RenderFrameMetadataObserver>)>;
-
-  // Report viewport related properties during a commit from the compositor
-  // thread.
-  virtual void ApplyViewportChanges(
-      const cc::ApplyViewportChangesArgs& args) = 0;
-
-  // Record use counts of different methods of scrolling (e.g. wheel, touch,
-  // precision touchpad, etc.).
-  virtual void RecordManipulationTypeCounts(cc::ManipulationInfo info) = 0;
-
-  // Send overscroll DOM event when overscrolling has happened on the compositor
-  // thread.
-  virtual void SendOverscrollEventFromImplSide(
-      const gfx::Vector2dF& overscroll_delta,
-      cc::ElementId scroll_latched_element_id) = 0;
-
-  // Send scrollend DOM event when gesture scrolling on the compositor thread
-  // has finished.
-  virtual void SendScrollEndEventFromImplSide(
-      cc::ElementId scroll_latched_element_id) = 0;
-
-  // Notifies that the compositor has issued a BeginMainFrame.
-  virtual void BeginMainFrame(base::TimeTicks frame_time) = 0;
-
-  virtual void OnDeferMainFrameUpdatesChanged(bool) = 0;
-  virtual void OnDeferCommitsChanged(bool) = 0;
-
-  // Notifies that the layer tree host has completed a call to
-  // RequestMainFrameUpdate in response to a BeginMainFrame.
-  virtual void DidBeginMainFrame() = 0;
-
-  // Requests a LayerTreeFrameSink to submit CompositorFrames to.
-  virtual void RequestNewLayerTreeFrameSink(
-      LayerTreeFrameSinkCallback callback) = 0;
-
-  // Notifies that the draw commands for a committed frame have been issued.
-  virtual void DidCommitAndDrawCompositorFrame() = 0;
-
-  // Notifies that a compositor frame commit operation is about to start.
-  virtual void WillCommitCompositorFrame() = 0;
-
-  // Notifies about a compositor frame commit operation having finished.
-  // The commit_start_time is the time that the impl thread started processing
-  // the commit.
-  virtual void DidCommitCompositorFrame(base::TimeTicks commit_start_time) = 0;
-
-  // Called by the compositor when page scale animation completed.
-  virtual void DidCompletePageScaleAnimation() = 0;
-
-  // Requests that a UMA and UKM metrics be recorded for the total frame time
-  // and the portion of frame time spent in various sub-systems.
-  // Call RecordStartOfFrameMetrics when a main frame is starting, and call
-  // RecordEndOfFrameMetrics as soon as the total frame time becomes known for
-  // a given frame. For example, ProxyMain::BeginMainFrame calls
-  // RecordStartOfFrameMetrics just be WillBeginCompositorFrame() and
-  // RecordEndOfFrameMetrics immediately before aborting or completing the
-  // BeginMainFrame method.
-  virtual void RecordStartOfFrameMetrics() = 0;
-  virtual void RecordEndOfFrameMetrics(
-      base::TimeTicks frame_begin_time,
-      cc::ActiveFrameSequenceTrackers trackers) = 0;
-  // Return metrics information for the stages of BeginMainFrame. This is
-  // ultimately implemented by Blink's LocalFrameUKMAggregator. It must be a
-  // distinct call from the FrameMetrics above because the BeginMainFrameMetrics
-  // for compositor latency must be gathered before the layer tree is
-  // committed to the compositor, which is before the call to
-  // RecordEndOfFrameMetrics.
-  virtual std::unique_ptr<cc::BeginMainFrameMetrics>
-  GetBeginMainFrameMetrics() = 0;
-
-  // Notification of the beginning and end of LayerTreeHost::UpdateLayers, for
-  // metrics collection.
-  virtual void BeginUpdateLayers() = 0;
-  virtual void EndUpdateLayers() = 0;
-
-  // Requests a visual frame-based update to the state of the delegate if there
-  // is an update available.
-  virtual void UpdateVisualState() = 0;
-
-  // Indicates that the compositor is about to begin a frame. This is primarily
-  // to signal to flow control mechanisms that a frame is beginning, not to
-  // perform actual painting work. When |record_main_frame_metrics| is true
-  // we are in a frame that shoujld capture metrics data, and the local frame's
-  // UKM aggregator must be informed that the frame is starting.
-  virtual void WillBeginCompositorFrame() = 0;
-
- protected:
-  virtual ~LayerTreeViewDelegate() {}
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_DELEGATE_H_
diff --git a/chromium/content/renderer/compositor/layer_tree_view_unittest.cc b/chromium/content/renderer/compositor/layer_tree_view_unittest.cc
deleted file mode 100644
index c45ef845302..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view_unittest.cc
+++ /dev/null
@@ -1,381 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/compositor/layer_tree_view.h"
-
-#include <utility>
-
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/macros.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/test/metrics/histogram_tester.h"
-#include "base/test/task_environment.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "build/build_config.h"
-#include "cc/test/fake_layer_tree_frame_sink.h"
-#include "cc/test/test_task_graph_runner.h"
-#include "cc/test/test_ukm_recorder_factory.h"
-#include "cc/trees/layer_tree_host.h"
-#include "cc/trees/render_frame_metadata_observer.h"
-#include "components/viz/common/frame_sinks/copy_output_request.h"
-#include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
-#include "components/viz/test/test_context_provider.h"
-#include "content/test/stub_layer_tree_view_delegate.h"
-#include "gpu/GLES2/gl2extchromium.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/scheduler/test/web_fake_thread_scheduler.h"
-
-using testing::AllOf;
-using testing::Field;
-
-namespace content {
-namespace {
-
-enum FailureMode {
-  NO_FAILURE,
-  BIND_CONTEXT_FAILURE,
-  GPU_CHANNEL_FAILURE,
-};
-
-class FakeLayerTreeViewDelegate : public StubLayerTreeViewDelegate {
- public:
-  FakeLayerTreeViewDelegate() = default;
-
-  void RequestNewLayerTreeFrameSink(
-      LayerTreeFrameSinkCallback callback) override {
-    // Subtract one cuz the current request has already been counted but should
-    // not be included for this.
-    if (num_requests_since_last_success_ - 1 < num_requests_before_success_) {
-      std::move(callback).Run(nullptr, nullptr);
-      return;
-    }
-
-    auto context_provider = viz::TestContextProvider::Create();
-    if (num_failures_since_last_success_ < num_failures_before_success_) {
-      context_provider->UnboundTestContextGL()->LoseContextCHROMIUM(
-          GL_GUILTY_CONTEXT_RESET_ARB, GL_INNOCENT_CONTEXT_RESET_ARB);
-    }
-    std::move(callback).Run(
-        cc::FakeLayerTreeFrameSink::Create3d(std::move(context_provider)),
-        nullptr);
-  }
-
-  void Reset() {
-    num_requests_ = 0;
-    num_requests_before_success_ = 0;
-    num_requests_since_last_success_ = 0;
-    num_failures_ = 0;
-    num_failures_before_success_ = 0;
-    num_failures_since_last_success_ = 0;
-    num_successes_ = 0;
-  }
-
-  void add_success() {
-    ++num_successes_;
-    num_requests_since_last_success_ = 0;
-    num_failures_since_last_success_ = 0;
-  }
-  int num_successes() const { return num_successes_; }
-
-  void add_request() {
-    ++num_requests_since_last_success_;
-    ++num_requests_;
-  }
-  int num_requests() const { return num_requests_; }
-
-  void add_failure() {
-    ++num_failures_since_last_success_;
-    ++num_failures_;
-  }
-  int num_failures() const { return num_failures_; }
-
-  void set_num_requests_before_success(int n) {
-    num_requests_before_success_ = n;
-  }
-  void set_num_failures_before_success(int n) {
-    num_failures_before_success_ = n;
-  }
-  int num_failures_before_success() const {
-    return num_failures_before_success_;
-  }
-
- private:
-  int num_requests_ = 0;
-  int num_requests_before_success_ = 0;
-  int num_requests_since_last_success_ = 0;
-  int num_failures_ = 0;
-  int num_failures_before_success_ = 0;
-  int num_failures_since_last_success_ = 0;
-  int num_successes_ = 0;
-
-  DISALLOW_COPY_AND_ASSIGN(FakeLayerTreeViewDelegate);
-};
-
-// Verify that failing to create an output surface will cause the compositor
-// to attempt to repeatedly create another output surface.
-// The use null output surface parameter allows testing whether failures
-// from RenderWidget (couldn't create an output surface) vs failures from
-// the compositor (couldn't bind the output surface) are handled identically.
-class LayerTreeViewWithFrameSinkTracking : public LayerTreeView {
- public:
-  LayerTreeViewWithFrameSinkTracking(
-      FakeLayerTreeViewDelegate* delegate,
-      scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-      scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-      cc::TaskGraphRunner* task_graph_runner,
-      blink::scheduler::WebThreadScheduler* scheduler)
-      : LayerTreeView(delegate,
-                      std::move(main_thread),
-                      std::move(compositor_thread),
-                      task_graph_runner,
-                      scheduler),
-        delegate_(delegate) {}
-
-  // Force a new output surface to be created.
-  void SynchronousComposite() {
-    layer_tree_host()->SetVisible(false);
-    layer_tree_host()->ReleaseLayerTreeFrameSink();
-    layer_tree_host()->SetVisible(true);
-
-    base::TimeTicks some_time;
-    layer_tree_host()->Composite(some_time, true /* raster */);
-  }
-
-  void RequestNewLayerTreeFrameSink() override {
-    delegate_->add_request();
-    LayerTreeView::RequestNewLayerTreeFrameSink();
-  }
-
-  void DidInitializeLayerTreeFrameSink() override {
-    LayerTreeView::DidInitializeLayerTreeFrameSink();
-    delegate_->add_success();
-    if (delegate_->num_successes() == expected_successes_) {
-      EXPECT_EQ(delegate_->num_requests(), expected_requests_);
-      EndTest();
-    } else {
-      // Post the synchronous composite task so that it is not called
-      // reentrantly as a part of RequestNewLayerTreeFrameSink.
-      blink::scheduler::GetSingleThreadTaskRunnerForTesting()->PostTask(
-          FROM_HERE,
-          base::BindOnce(
-              &LayerTreeViewWithFrameSinkTracking::SynchronousComposite,
-              base::Unretained(this)));
-    }
-  }
-
-  void DidFailToInitializeLayerTreeFrameSink() override {
-    LayerTreeView::DidFailToInitializeLayerTreeFrameSink();
-    delegate_->add_failure();
-    if (delegate_->num_requests() == expected_requests_) {
-      EXPECT_EQ(delegate_->num_successes(), expected_successes_);
-      EndTest();
-      return;
-    }
-  }
-
-  void SetUp(int expected_successes,
-             int num_tries,
-             FailureMode failure_mode,
-             base::RunLoop* run_loop) {
-    run_loop_ = run_loop;
-    failure_mode_ = failure_mode;
-    expected_successes_ = expected_successes;
-    switch (failure_mode_) {
-      case NO_FAILURE:
-        expected_requests_ = expected_successes;
-        break;
-      case BIND_CONTEXT_FAILURE:
-      case GPU_CHANNEL_FAILURE:
-        expected_requests_ = num_tries * std::max(1, expected_successes);
-        break;
-    }
-  }
-
-  void EndTest() { run_loop_->Quit(); }
-
- private:
-  FakeLayerTreeViewDelegate* delegate_;
-  base::RunLoop* run_loop_ = nullptr;
-  int expected_successes_ = 0;
-  int expected_requests_ = 0;
-  FailureMode failure_mode_ = NO_FAILURE;
-
-  DISALLOW_COPY_AND_ASSIGN(LayerTreeViewWithFrameSinkTracking);
-};
-
-class LayerTreeViewWithFrameSinkTrackingTest : public testing::Test {
- public:
-  LayerTreeViewWithFrameSinkTrackingTest()
-      : layer_tree_view_(
-            &layer_tree_view_delegate_,
-            blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
-            /*compositor_thread=*/nullptr,
-            &test_task_graph_runner_,
-            &fake_thread_scheduler_) {
-    cc::LayerTreeSettings settings;
-    settings.single_thread_proxy_scheduler = false;
-    layer_tree_view_.Initialize(settings,
-                                std::make_unique<cc::TestUkmRecorderFactory>());
-  }
-
-  void RunTest(int expected_successes, FailureMode failure_mode) {
-    layer_tree_view_delegate_.Reset();
-    // 6 is just an artibrary "large" number to show it keeps trying.
-    const int kTries = 6;
-    // If it should fail, then it will fail every attempt, otherwise it fails
-    // until the last attempt.
-    int tries_before_success = kTries - (expected_successes ? 1 : 0);
-    switch (failure_mode) {
-      case NO_FAILURE:
-        layer_tree_view_delegate_.set_num_failures_before_success(0);
-        layer_tree_view_delegate_.set_num_requests_before_success(0);
-        break;
-      case BIND_CONTEXT_FAILURE:
-        layer_tree_view_delegate_.set_num_failures_before_success(
-            tries_before_success);
-        layer_tree_view_delegate_.set_num_requests_before_success(0);
-        break;
-      case GPU_CHANNEL_FAILURE:
-        layer_tree_view_delegate_.set_num_failures_before_success(0);
-        layer_tree_view_delegate_.set_num_requests_before_success(
-            tries_before_success);
-        break;
-    }
-    base::RunLoop run_loop;
-    layer_tree_view_.SetUp(expected_successes, kTries, failure_mode, &run_loop);
-    layer_tree_view_.SetVisible(true);
-    blink::scheduler::GetSingleThreadTaskRunnerForTesting()->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &LayerTreeViewWithFrameSinkTracking::SynchronousComposite,
-            base::Unretained(&layer_tree_view_)));
-    run_loop.Run();
-  }
-
- protected:
-  base::test::TaskEnvironment task_environment_;
-  cc::TestTaskGraphRunner test_task_graph_runner_;
-  blink::scheduler::WebFakeThreadScheduler fake_thread_scheduler_;
-  FakeLayerTreeViewDelegate layer_tree_view_delegate_;
-  LayerTreeViewWithFrameSinkTracking layer_tree_view_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(LayerTreeViewWithFrameSinkTrackingTest);
-};
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedOnce) {
-  RunTest(1, NO_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedOnce_AfterNullChannel) {
-  RunTest(1, GPU_CHANNEL_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedOnce_AfterLostContext) {
-  RunTest(1, BIND_CONTEXT_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedTwice) {
-  RunTest(2, NO_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedTwice_AfterNullChannel) {
-  RunTest(2, GPU_CHANNEL_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedTwice_AfterLostContext) {
-  RunTest(2, BIND_CONTEXT_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, FailWithNullChannel) {
-  RunTest(0, GPU_CHANNEL_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, FailWithLostContext) {
-  RunTest(0, BIND_CONTEXT_FAILURE);
-}
-
-class VisibilityTestLayerTreeView : public LayerTreeView {
- public:
-  VisibilityTestLayerTreeView(
-      StubLayerTreeViewDelegate* delegate,
-      scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-      scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-      cc::TaskGraphRunner* task_graph_runner,
-      blink::scheduler::WebThreadScheduler* scheduler)
-      : LayerTreeView(delegate,
-                      std::move(main_thread),
-                      std::move(compositor_thread),
-                      task_graph_runner,
-                      scheduler) {}
-
-  void RequestNewLayerTreeFrameSink() override {
-    LayerTreeView::RequestNewLayerTreeFrameSink();
-    num_requests_sent_++;
-    if (run_loop_)
-      run_loop_->Quit();
-  }
-
-  void set_run_loop(base::RunLoop* run_loop) { run_loop_ = run_loop; }
-  int num_requests_sent() { return num_requests_sent_; }
-
- private:
-  int num_requests_sent_ = 0;
-  base::RunLoop* run_loop_;
-};
-
-TEST(LayerTreeViewTest, VisibilityTest) {
-  // Test that LayerTreeView does not retry FrameSink request while
-  // invisible.
-
-  base::test::TaskEnvironment task_environment;
-
-  cc::TestTaskGraphRunner test_task_graph_runner;
-  blink::scheduler::WebFakeThreadScheduler fake_thread_scheduler;
-  // Synchronously callback with null FrameSink.
-  StubLayerTreeViewDelegate layer_tree_view_delegate;
-  VisibilityTestLayerTreeView layer_tree_view(
-      &layer_tree_view_delegate,
-      blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
-      /*compositor_thread=*/nullptr, &test_task_graph_runner,
-      &fake_thread_scheduler);
-
-  layer_tree_view.Initialize(cc::LayerTreeSettings(),
-                             std::make_unique<cc::TestUkmRecorderFactory>());
-
-  {
-    // Make one request and stop immediately while invisible.
-    base::RunLoop run_loop;
-    layer_tree_view.set_run_loop(&run_loop);
-    layer_tree_view.SetVisible(false);
-    layer_tree_view.RequestNewLayerTreeFrameSink();
-    run_loop.Run();
-    layer_tree_view.set_run_loop(nullptr);
-    EXPECT_EQ(1, layer_tree_view.num_requests_sent());
-  }
-
-  {
-    // Make sure there are no more requests.
-    base::RunLoop run_loop;
-    run_loop.RunUntilIdle();
-    EXPECT_EQ(1, layer_tree_view.num_requests_sent());
-  }
-
-  {
-    // Becoming visible retries request.
-    base::RunLoop run_loop;
-    layer_tree_view.set_run_loop(&run_loop);
-    layer_tree_view.SetVisible(true);
-    run_loop.Run();
-    layer_tree_view.set_run_loop(nullptr);
-    EXPECT_EQ(2, layer_tree_view.num_requests_sent());
-  }
-}
-
-}  // namespace
-}  // namespace content
diff --git a/chromium/content/renderer/content_security_policy_util.cc b/chromium/content/renderer/content_security_policy_util.cc
index b4187bdb485..4d05093aefa 100644
--- a/chromium/content/renderer/content_security_policy_util.cc
+++ b/chromium/content/renderer/content_security_policy_util.cc
@@ -42,6 +42,7 @@ network::mojom::ContentSecurityPolicyPtr BuildContentSecurityPolicy(
     auto name = network::ToCSPDirectiveName(directive.name.Utf8());
     policy->directives[name] = BuildCSPSourceList(directive.source_list);
   }
+  policy->upgrade_insecure_requests = policy_in.upgrade_insecure_requests;
 
   for (const blink::WebString& endpoint : policy_in.report_endpoints)
     policy->report_endpoints.push_back(endpoint.Utf8());
diff --git a/chromium/content/renderer/dom_automation_controller.cc b/chromium/content/renderer/dom_automation_controller.cc
index af3e1e727ea..f0162ba4ce9 100644
--- a/chromium/content/renderer/dom_automation_controller.cc
+++ b/chromium/content/renderer/dom_automation_controller.cc
@@ -106,7 +106,17 @@ bool DomAutomationController::SendMsg(const gin::Arguments& args) {
   if (!value || !serializer.Serialize(*value))
     return false;
 
-  return Send(new FrameHostMsg_DomOperationResponse(routing_id(), json));
+  GetDomAutomationControllerHost()->DomOperationResponse(json);
+  return true;
+}
+
+const mojo::AssociatedRemote<mojom::DomAutomationControllerHost>&
+DomAutomationController::GetDomAutomationControllerHost() {
+  if (!dom_automation_controller_host_) {
+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(
+        &dom_automation_controller_host_);
+  }
+  return dom_automation_controller_host_;
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/dom_automation_controller.h b/chromium/content/renderer/dom_automation_controller.h
index 9dff350ec16..fb532ab4c1d 100644
--- a/chromium/content/renderer/dom_automation_controller.h
+++ b/chromium/content/renderer/dom_automation_controller.h
@@ -8,8 +8,10 @@
 #include <stdint.h>
 
 #include "base/macros.h"
+#include "content/common/dom_automation_controller.mojom.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "gin/wrappable.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 
 namespace blink {
 class WebLocalFrame;
@@ -27,8 +29,6 @@ class RenderFrame;
 // Javascript can call domAutomationController.send(...) to send arbitrary data
 // to the browser.  On the browser side, the data is received via one of the
 // following:
-// - Product code:
-//   - Explicit handlers of FrameHostMsg_DomOperationResponse IPC
 // - Test code:
 //   - DOMMessageQueue class
 //   - ExecuteScriptAndExtractInt/Bool/String functions
@@ -58,6 +58,12 @@ class DomAutomationController : public gin::Wrappable<DomAutomationController>,
   void DidCreateScriptContext(v8::Local<v8::Context> context,
                               int32_t world_id) override;
 
+  const mojo::AssociatedRemote<mojom::DomAutomationControllerHost>&
+  GetDomAutomationControllerHost();
+
+  mojo::AssociatedRemote<mojom::DomAutomationControllerHost>
+      dom_automation_controller_host_;
+
   DISALLOW_COPY_AND_ASSIGN(DomAutomationController);
 };
 
diff --git a/chromium/content/renderer/dom_serializer_browsertest.cc b/chromium/content/renderer/dom_serializer_browsertest.cc
index eaf66a5e840..63da2c9fff1 100644
--- a/chromium/content/renderer/dom_serializer_browsertest.cc
+++ b/chromium/content/renderer/dom_serializer_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_view.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/frame_load_waiter.h"
diff --git a/chromium/content/renderer/external_popup_menu.cc b/chromium/content/renderer/external_popup_menu.cc
deleted file mode 100644
index c61530a96d4..00000000000
--- a/chromium/content/renderer/external_popup_menu.cc
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/external_popup_menu.h"
-
-#include <stddef.h>
-
-#include "build/build_config.h"
-#include "content/common/frame_messages.h"
-#include "content/renderer/menu_item_builder.h"
-#include "content/renderer/render_frame_impl.h"
-#include "third_party/blink/public/platform/web_rect.h"
-#include "third_party/blink/public/web/web_external_popup_menu_client.h"
-
-namespace content {
-
-ExternalPopupMenu::ExternalPopupMenu(
-    RenderFrameImpl* render_frame,
-    const blink::WebPopupMenuInfo& popup_menu_info,
-    blink::WebExternalPopupMenuClient* popup_menu_client)
-    : render_frame_(render_frame),
-      popup_menu_info_(popup_menu_info),
-      popup_menu_client_(popup_menu_client),
-      origin_scale_for_emulation_(0) {
-}
-
-void ExternalPopupMenu::SetOriginScaleForEmulation(float scale) {
-  origin_scale_for_emulation_ = scale;
-}
-
-void ExternalPopupMenu::Show(const blink::WebRect& bounds) {
-  blink::WebRect rect = bounds;
-  if (origin_scale_for_emulation_) {
-    rect.x *= origin_scale_for_emulation_;
-    rect.y *= origin_scale_for_emulation_;
-  }
-
-  FrameHostMsg_ShowPopup_Params popup_params;
-  popup_params.bounds = rect;
-  popup_params.item_height = popup_menu_info_.item_height;
-  popup_params.item_font_size = popup_menu_info_.item_font_size;
-  popup_params.selected_item = popup_menu_info_.selected_index;
-  for (size_t i = 0; i < popup_menu_info_.items.size(); ++i) {
-    popup_params.popup_items.push_back(
-        MenuItemBuilder::Build(popup_menu_info_.items[i]));
-  }
-  popup_params.right_aligned = popup_menu_info_.right_aligned;
-  popup_params.allow_multiple_selection =
-      popup_menu_info_.allow_multiple_selection;
-  render_frame_->Send(
-      new FrameHostMsg_ShowPopup(render_frame_->GetRoutingID(), popup_params));
-}
-
-void ExternalPopupMenu::Close() {
-  render_frame_->Send(
-      new FrameHostMsg_HidePopup(render_frame_->GetRoutingID()));
-  render_frame_->DidHideExternalPopupMenu();
-  // |this| was deleted.
-}
-
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-void ExternalPopupMenu::DidSelectItem(int index) {
-  if (!popup_menu_client_)
-    return;
-  if (index == -1)
-    popup_menu_client_->DidCancel();
-  else
-    popup_menu_client_->DidAcceptIndex(index);
-}
-#else
-void ExternalPopupMenu::DidSelectItems(bool canceled,
-                                       const std::vector<int>& indices) {
-  if (!popup_menu_client_)
-    return;
-  if (canceled)
-    popup_menu_client_->DidCancel();
-  else
-    popup_menu_client_->DidAcceptIndices(indices);
-}
-#endif
-#endif
-
-}  // namespace content
diff --git a/chromium/content/renderer/external_popup_menu.h b/chromium/content/renderer/external_popup_menu.h
deleted file mode 100644
index 8b25066507c..00000000000
--- a/chromium/content/renderer/external_popup_menu.h
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
-#define CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
-
-#include <vector>
-
-#include "base/macros.h"
-#include "build/build_config.h"
-#include "content/common/buildflags.h"
-#include "third_party/blink/public/web/web_external_popup_menu.h"
-#include "third_party/blink/public/web/web_popup_menu_info.h"
-#include "ui/gfx/geometry/point_f.h"
-
-namespace blink {
-class WebExternalPopupMenuClient;
-}
-
-namespace content {
-class RenderFrameImpl;
-
-class ExternalPopupMenu : public blink::WebExternalPopupMenu {
- public:
-  ExternalPopupMenu(RenderFrameImpl* render_frame,
-                    const blink::WebPopupMenuInfo& popup_menu_info,
-                    blink::WebExternalPopupMenuClient* popup_menu_client);
-
-  virtual ~ExternalPopupMenu() {}
-
-  void SetOriginScaleForEmulation(float scale);
-
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-  // Called when the user has selected an item. |selected_item| is -1 if the
-  // user canceled the popup.
-  void DidSelectItem(int selected_index);
-#else
-  // Called when the user has selected items or canceled the popup.
-  void DidSelectItems(bool canceled, const std::vector<int>& selected_indices);
-#endif
-#endif
-
-  // blink::WebExternalPopupMenu implementation:
-  void Show(const blink::WebRect& bounds) override;
-  void Close() override;
-
- private:
-  RenderFrameImpl* render_frame_;
-  blink::WebPopupMenuInfo popup_menu_info_;
-  blink::WebExternalPopupMenuClient* popup_menu_client_;
-
-  // Popups may be displaced when screen metrics emulation is enabled.
-  // These scale and offset are used to properly adjust popup position.
-  float origin_scale_for_emulation_;
-
-  DISALLOW_COPY_AND_ASSIGN(ExternalPopupMenu);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
diff --git a/chromium/content/renderer/external_popup_menu_browsertest.cc b/chromium/content/renderer/external_popup_menu_browsertest.cc
deleted file mode 100644
index 1816b99f1f7..00000000000
--- a/chromium/content/renderer/external_popup_menu_browsertest.cc
+++ /dev/null
@@ -1,238 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <tuple>
-
-#include "base/macros.h"
-#include "base/strings/utf_string_conversions.h"
-#include "content/common/frame_messages.h"
-#include "content/public/test/render_view_test.h"
-#include "content/renderer/render_frame_impl.h"
-#include "content/renderer/render_view_impl.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/web_size.h"
-#include "third_party/blink/public/web/web_local_frame.h"
-#include "third_party/blink/public/web/web_view.h"
-
-// Tests for the external select popup menu (Mac specific).
-
-namespace content {
-namespace {
-
-const char* const kSelectID = "mySelect";
-const char* const kEmptySelectID = "myEmptySelect";
-
-}  // namespace
-
-class ExternalPopupMenuTest : public RenderViewTest {
- public:
-  ExternalPopupMenuTest() {}
-
-  RenderViewImpl* view() {
-    return static_cast<RenderViewImpl*>(view_);
-  }
-
-  RenderWidget* main_frame_widget() {
-    return view()->GetMainRenderFrame()->GetLocalRootRenderWidget();
-  }
-
-  RenderFrameImpl* frame() {
-    return view()->GetMainRenderFrame();
-  }
-
-  void SetUp() override {
-    RenderViewTest::SetUp();
-    // We need to set this explictly as RenderMain is not run.
-    blink::WebView::SetUseExternalPopupMenus(true);
-
-    std::string html = "<select id='mySelect' onchange='selectChanged(this)'>"
-                       "  <option>zero</option>"
-                       "  <option selected='1'>one</option>"
-                       "  <option>two</option>"
-                       "</select>"
-                       "<select id='myEmptySelect'>"
-                       "</select>";
-    if (ShouldRemoveSelectOnChange()) {
-      html += "<script>"
-              "  function selectChanged(select) {"
-              "    select.parentNode.removeChild(select);"
-              "  }"
-              "</script>";
-    }
-
-    // Load the test page.
-    LoadHTML(html.c_str());
-
-    // Set a minimum size and give focus so simulated events work.
-    main_frame_widget()->GetWebWidget()->Resize(blink::WebSize(500, 500));
-    main_frame_widget()->GetWebWidget()->SetFocus(true);
-  }
-
-  int GetSelectedIndex() {
-    base::string16 script(base::ASCIIToUTF16(kSelectID));
-    script.append(base::ASCIIToUTF16(".selectedIndex"));
-    int selected_index = -1;
-    ExecuteJavaScriptAndReturnIntValue(script, &selected_index);
-    return selected_index;
-  }
-
- protected:
-  virtual bool ShouldRemoveSelectOnChange() const { return false; }
-
-  DISALLOW_COPY_AND_ASSIGN(ExternalPopupMenuTest);
-};
-
-// Normal case: test showing a select popup, canceling/selecting an item.
-TEST_F(ExternalPopupMenuTest, NormalCase) {
-  IPC::TestSink& sink = render_thread_->sink();
-
-  // Click the text field once.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // We should have sent a message to the browser to show the popup menu.
-  const IPC::Message* message =
-      sink.GetUniqueMessageMatching(FrameHostMsg_ShowPopup::ID);
-  ASSERT_TRUE(message != NULL);
-  std::tuple<FrameHostMsg_ShowPopup_Params> param;
-  FrameHostMsg_ShowPopup::Read(message, &param);
-  ASSERT_EQ(3U, std::get<0>(param).popup_items.size());
-  EXPECT_EQ(1, std::get<0>(param).selected_item);
-
-  // Simulate the user canceling the popup; the index should not have changed.
-  frame()->OnSelectPopupMenuItem(-1);
-  EXPECT_EQ(1, GetSelectedIndex());
-
-  // Show the pop-up again and this time make a selection.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-  frame()->OnSelectPopupMenuItem(0);
-  EXPECT_EQ(0, GetSelectedIndex());
-
-  // Show the pop-up again and make another selection.
-  sink.ClearMessages();
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-  message = sink.GetUniqueMessageMatching(FrameHostMsg_ShowPopup::ID);
-  ASSERT_TRUE(message != NULL);
-  FrameHostMsg_ShowPopup::Read(message, &param);
-  ASSERT_EQ(3U, std::get<0>(param).popup_items.size());
-  EXPECT_EQ(0, std::get<0>(param).selected_item);
-}
-
-// Page shows popup, then navigates away while popup showing, then select.
-TEST_F(ExternalPopupMenuTest, ShowPopupThenNavigate) {
-  // Click the text field once.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // Now we navigate to another pager.
-  LoadHTML("<blink>Awesome page!</blink>");
-
-  // Now the user selects something, we should not crash.
-  frame()->OnSelectPopupMenuItem(-1);
-}
-
-// An empty select should not cause a crash when clicked.
-// http://crbug.com/63774
-TEST_F(ExternalPopupMenuTest, EmptySelect) {
-  EXPECT_TRUE(SimulateElementClick(kEmptySelectID));
-}
-
-class ExternalPopupMenuRemoveTest : public ExternalPopupMenuTest {
- public:
-  ExternalPopupMenuRemoveTest() {}
-
- protected:
-  bool ShouldRemoveSelectOnChange() const override { return true; }
-};
-
-// Tests that nothing bad happen when the page removes the select when it
-// changes. (http://crbug.com/61997)
-TEST_F(ExternalPopupMenuRemoveTest, RemoveOnChange) {
-  // Click the text field once to show the popup.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // Select something, it causes the select to be removed from the page.
-  frame()->OnSelectPopupMenuItem(0);
-
-  // Just to check the soundness of the test, call SimulateElementClick again.
-  // It should return false as the select has been removed.
-  EXPECT_FALSE(SimulateElementClick(kSelectID));
-}
-
-// crbug.com/912211
-TEST_F(ExternalPopupMenuRemoveTest, RemoveFrameOnChange) {
-  LoadHTML(
-      "<style>* { margin: 0; } iframe { border: 0; }</style>"
-      "<body><iframe srcdoc=\""
-      "<style>* { margin: 0; }</style><select><option>opt1<option>opt2"
-      "\"></iframe>"
-      "<script>"
-      "onload = function() {"
-      "  const frame = document.querySelector('iframe');"
-      "  frame.contentDocument.querySelector('select').onchange = "
-      "      () => { frame.remove(); };"
-      "};"
-      "</script>");
-  // Open a popup.
-  SimulatePointClick(gfx::Point(8, 8));
-  // Select something on the sub-frame, it causes the frame to be removed from
-  // the page.
-  auto* child_web_frame =
-      static_cast<blink::WebLocalFrame*>(frame()->GetWebFrame()->FirstChild());
-  static_cast<RenderFrameImpl*>(RenderFrame::FromWebFrame(child_web_frame))
-      ->OnSelectPopupMenuItem(1);
-  // The test passes if the test didn't crash and ASAN didn't complain.
-}
-
-class ExternalPopupMenuDisplayNoneTest : public ExternalPopupMenuTest {
-  public:
-  ExternalPopupMenuDisplayNoneTest() {}
-
-  void SetUp() override {
-    RenderViewTest::SetUp();
-    // We need to set this explictly as RenderMain is not run.
-    blink::WebView::SetUseExternalPopupMenus(true);
-
-    std::string html = "<select id='mySelect'>"
-                       "  <option value='zero'>zero</option>"
-                       "  <optgroup label='hide' style='display: none'>"
-                       "    <option value='one'>one</option>"
-                       "  </optgroup>"
-                       "  <option value='two'>two</option>"
-                       "  <option value='three'>three</option>"
-                       "  <option value='four'>four</option>"
-                       "  <option value='five'>five</option>"
-                       "</select>";
-    // Load the test page.
-    LoadHTML(html.c_str());
-
-    // Set a minimum size and give focus so simulated events work.
-    main_frame_widget()->GetWebWidget()->Resize(blink::WebSize(500, 500));
-    main_frame_widget()->GetWebWidget()->SetFocus(true);
-  }
-
-};
-
-TEST_F(ExternalPopupMenuDisplayNoneTest, SelectItem) {
-  IPC::TestSink& sink = render_thread_->sink();
-
-  // Click the text field once to show the popup.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // Read the message sent to browser to show the popup menu.
-  const IPC::Message* message =
-      sink.GetUniqueMessageMatching(FrameHostMsg_ShowPopup::ID);
-  ASSERT_TRUE(message != NULL);
-  std::tuple<FrameHostMsg_ShowPopup_Params> param;
-  FrameHostMsg_ShowPopup::Read(message, &param);
-  // Number of items should match item count minus the number
-  // of "display: none" items.
-  ASSERT_EQ(5U, std::get<0>(param).popup_items.size());
-
-  // Select index 1 item. This should select item with index 2,
-  // skipping the item with 'display: none'
-  frame()->OnSelectPopupMenuItem(1);
-
-  EXPECT_EQ(2, GetSelectedIndex());
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/frame_swap_message_queue.cc b/chromium/content/renderer/frame_swap_message_queue.cc
index 2e9f14e6008..d85fe7038e8 100644
--- a/chromium/content/renderer/frame_swap_message_queue.cc
+++ b/chromium/content/renderer/frame_swap_message_queue.cc
@@ -9,7 +9,7 @@
 #include <memory>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/macros.h"
 #include "base/stl_util.h"
 #include "ipc/ipc_message.h"
diff --git a/chromium/content/renderer/gpu_benchmarking_extension.cc b/chromium/content/renderer/gpu_benchmarking_extension.cc
index 8bc1d09a4f8..45766087a71 100644
--- a/chromium/content/renderer/gpu_benchmarking_extension.cc
+++ b/chromium/content/renderer/gpu_benchmarking_extension.cc
@@ -48,7 +48,7 @@
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
-#include "third_party/blink/public/common/page/page_visibility_state.h"
+#include "third_party/blink/public/mojom/page/page_visibility_state.mojom.h"
 #include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_image_cache.h"
@@ -284,22 +284,66 @@ bool ThrowIfPointOutOfBounds(GpuBenchmarkingContext* context,
   return false;
 }
 
+base::Optional<gfx::Vector2dF> ToVector(const std::string& direction,
+                                        float distance) {
+  if (direction == "down") {
+    return gfx::Vector2dF(0, distance);
+  } else if (direction == "up") {
+    return gfx::Vector2dF(0, -distance);
+  } else if (direction == "right") {
+    return gfx::Vector2dF(distance, 0);
+  } else if (direction == "left") {
+    return gfx::Vector2dF(-distance, 0);
+  } else if (direction == "upleft") {
+    return gfx::Vector2dF(-distance, -distance);
+  } else if (direction == "upright") {
+    return gfx::Vector2dF(distance, -distance);
+  } else if (direction == "downleft") {
+    return gfx::Vector2dF(-distance, distance);
+  } else if (direction == "downright") {
+    return gfx::Vector2dF(distance, distance);
+  }
+  return base::nullopt;
+}
+
+int ToKeyModifiers(const base::StringPiece& key) {
+  if (key == "Alt")
+    return blink::WebInputEvent::kAltKey;
+  if (key == "Control")
+    return blink::WebInputEvent::kControlKey;
+  if (key == "Meta")
+    return blink::WebInputEvent::kMetaKey;
+  if (key == "Shift")
+    return blink::WebInputEvent::kShiftKey;
+  if (key == "CapsLock")
+    return blink::WebInputEvent::kCapsLockOn;
+  if (key == "NumLock")
+    return blink::WebInputEvent::kNumLockOn;
+  if (key == "AltGraph")
+    return blink::WebInputEvent::kAltGrKey;
+  NOTREACHED() << "invalid key modifier";
+  return 0;
+}
+
+// BeginSmoothScroll takes pixels_to_scroll_x and pixels_to_scroll_y, positive
+// pixels_to_scroll_y means scroll down, positive pixels_to_scroll_x means
+// scroll right.
 bool BeginSmoothScroll(GpuBenchmarkingContext* context,
                        gin::Arguments* args,
                        const mojo::Remote<mojom::InputInjector>& injector,
-                       float pixels_to_scroll,
+                       const gfx::Vector2dF& pixels_to_scroll,
                        v8::Local<v8::Function> callback,
                        int gesture_source_type,
-                       const std::string& direction,
                        float speed_in_pixels_s,
                        bool prevent_fling,
                        float start_x,
                        float start_y,
-                       float fling_velocity,
+                       const gfx::Vector2dF& fling_velocity,
                        bool precise_scrolling_deltas,
                        bool scroll_by_page,
                        bool cursor_visible,
-                       bool scroll_by_percentage) {
+                       bool scroll_by_percentage,
+                       int key_modifiers) {
   DCHECK(!(precise_scrolling_deltas && scroll_by_page));
   DCHECK(!(precise_scrolling_deltas && scroll_by_percentage));
   DCHECK(!(scroll_by_page && scroll_by_percentage));
@@ -312,13 +356,13 @@ bool BeginSmoothScroll(GpuBenchmarkingContext* context,
     // Ensure the mouse is visible and move to start position, in case it will
     // trigger any hover or mousemove effects.
     context->web_view()->SetIsActive(true);
-    blink::WebMouseEvent mouseMove(blink::WebInputEvent::kMouseMove,
+    blink::WebMouseEvent mouseMove(blink::WebInputEvent::Type::kMouseMove,
                                    blink::WebInputEvent::kNoModifiers,
                                    ui::EventTimeForNow());
     mouseMove.SetPositionInWidget(start_x, start_y);
     CHECK(context->web_view()->MainFrameWidget());
     context->web_view()->MainFrameWidget()->HandleInputEvent(
-        blink::WebCoalescedInputEvent(mouseMove));
+        blink::WebCoalescedInputEvent(mouseMove, ui::LatencyInfo()));
     context->web_view()->MainFrameWidget()->SetCursorVisibilityState(
         cursor_visible);
   }
@@ -352,45 +396,17 @@ bool BeginSmoothScroll(GpuBenchmarkingContext* context,
   gesture_params.anchor.SetPoint(start_x, start_y);
 
   DCHECK(gesture_source_type != SyntheticGestureParams::TOUCH_INPUT ||
-         fling_velocity == 0);
-  float distance_length = pixels_to_scroll;
-  gfx::Vector2dF distance;
-  if (direction == "down") {
-    distance.set_y(-distance_length);
-    gesture_params.fling_velocity_y = fling_velocity;
-  } else if (direction == "up") {
-    distance.set_y(distance_length);
-    gesture_params.fling_velocity_y = -fling_velocity;
-  } else if (direction == "right") {
-    distance.set_x(-distance_length);
-    gesture_params.fling_velocity_x = fling_velocity;
-  } else if (direction == "left") {
-    distance.set_x(distance_length);
-    gesture_params.fling_velocity_x = -fling_velocity;
-  } else if (direction == "upleft") {
-    distance.set_y(distance_length);
-    distance.set_x(distance_length);
-    gesture_params.fling_velocity_x = -fling_velocity;
-    gesture_params.fling_velocity_y = -fling_velocity;
-  } else if (direction == "upright") {
-    distance.set_y(distance_length);
-    distance.set_x(-distance_length);
-    gesture_params.fling_velocity_x = fling_velocity;
-    gesture_params.fling_velocity_y = -fling_velocity;
-  } else if (direction == "downleft") {
-    distance.set_y(-distance_length);
-    distance.set_x(distance_length);
-    gesture_params.fling_velocity_x = -fling_velocity;
-    gesture_params.fling_velocity_y = fling_velocity;
-  } else if (direction == "downright") {
-    distance.set_y(-distance_length);
-    distance.set_x(-distance_length);
-    gesture_params.fling_velocity_x = fling_velocity;
-    gesture_params.fling_velocity_y = fling_velocity;
-  } else {
-    return false;
-  }
-  gesture_params.distances.push_back(distance);
+         fling_velocity.IsZero());
+  // Positive pixels_to_scroll_y means scroll down, positive pixels_to_scroll_x
+  // means scroll right, but SyntheticSmoothScrollGestureParams requests
+  // Positive X/Y to scroll left/up, which is opposite. Positive
+  // fling_velocity_x and fling_velocity_y means scroll left and up, which is
+  // the same direction with SyntheticSmoothScrollGestureParams.
+  gesture_params.fling_velocity_x = fling_velocity.x();
+  gesture_params.fling_velocity_y = fling_velocity.y();
+  gesture_params.distances.push_back(-pixels_to_scroll);
+
+  gesture_params.key_modifiers = key_modifiers;
 
   injector->QueueSyntheticSmoothScroll(
       gesture_params, base::BindOnce(&OnSyntheticGestureCompleted,
@@ -579,6 +595,7 @@ gin::ObjectTemplateBuilder GpuBenchmarking::GetObjectTemplateBuilder(
       .SetMethod("gestureSourceTypeSupported",
                  &GpuBenchmarking::GestureSourceTypeSupported)
       .SetMethod("smoothScrollBy", &GpuBenchmarking::SmoothScrollBy)
+      .SetMethod("smoothScrollByXY", &GpuBenchmarking::SmoothScrollByXY)
       .SetMethod("smoothDrag", &GpuBenchmarking::SmoothDrag)
       .SetMethod("swipe", &GpuBenchmarking::Swipe)
       .SetMethod("scrollBounce", &GpuBenchmarking::ScrollBounce)
@@ -601,6 +618,8 @@ gin::ObjectTemplateBuilder GpuBenchmarking::GetObjectTemplateBuilder(
       .SetMethod("hasGpuChannel", &GpuBenchmarking::HasGpuChannel)
       .SetMethod("hasGpuProcess", &GpuBenchmarking::HasGpuProcess)
       .SetMethod("crashGpuProcess", &GpuBenchmarking::CrashGpuProcess)
+      .SetMethod("terminateGpuProcessNormally",
+                 &GpuBenchmarking::TerminateGpuProcessNormally)
       .SetMethod("getGpuDriverBugWorkarounds",
                  &GpuBenchmarking::GetGpuDriverBugWorkarounds)
       .SetMethod("startProfiling", &GpuBenchmarking::StartProfiling)
@@ -680,6 +699,8 @@ bool GpuBenchmarking::GestureSourceTypeSupported(int gesture_source_type) {
           gesture_source_type));
 }
 
+// TODO(lanwei): this is will be removed after this is replaced by
+// SmoothScrollByXY in telemetry/internal/actions/scroll.js.
 bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
   GpuBenchmarkingContext context(render_frame_.get());
   blink::WebRect rect = context.render_widget()->ViewRect();
@@ -695,6 +716,7 @@ bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
   bool scroll_by_page = false;
   bool cursor_visible = true;
   bool scroll_by_percentage = false;
+  std::string keys_value;
 
   if (!GetOptionalArg(args, &pixels_to_scroll) ||
       !GetOptionalArg(args, &callback) || !GetOptionalArg(args, &start_x) ||
@@ -705,7 +727,8 @@ bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
       !GetOptionalArg(args, &precise_scrolling_deltas) ||
       !GetOptionalArg(args, &scroll_by_page) ||
       !GetOptionalArg(args, &cursor_visible) ||
-      !GetOptionalArg(args, &scroll_by_percentage)) {
+      !GetOptionalArg(args, &scroll_by_percentage) ||
+      !GetOptionalArg(args, &keys_value)) {
     return false;
   }
 
@@ -718,13 +741,98 @@ bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
   // Scroll by percentage only for mouse inputs.
   DCHECK(!scroll_by_percentage ||
          gesture_source_type == SyntheticGestureParams::MOUSE_INPUT);
+  // Scroll by percentage does not require speed in pixels
+  DCHECK(!scroll_by_percentage || (speed_in_pixels_s == 800));
+
+  base::Optional<gfx::Vector2dF> pixels_to_scrol_vector =
+      ToVector(direction, pixels_to_scroll);
+  if (!pixels_to_scrol_vector.has_value())
+    return false;
+  gfx::Vector2dF fling_velocity(0, 0);
+  int key_modifiers = 0;
+  std::vector<base::StringPiece> key_list = base::SplitStringPiece(
+      keys_value, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
+  for (const base::StringPiece& key : key_list) {
+    int key_modifier = ToKeyModifiers(key);
+    if (key_modifier == 0) {
+      return false;
+    }
+    key_modifiers |= key_modifier;
+  }
 
   EnsureRemoteInterface();
-  return BeginSmoothScroll(&context, args, input_injector_, pixels_to_scroll,
-                           callback, gesture_source_type, direction,
-                           speed_in_pixels_s, true, start_x, start_y, 0,
-                           precise_scrolling_deltas, scroll_by_page,
-                           cursor_visible, scroll_by_percentage);
+  return BeginSmoothScroll(
+      &context, args, input_injector_, pixels_to_scrol_vector.value(), callback,
+      gesture_source_type, speed_in_pixels_s, true /* prevent_fling */, start_x,
+      start_y, fling_velocity, precise_scrolling_deltas, scroll_by_page,
+      cursor_visible, scroll_by_percentage, key_modifiers);
+}
+
+// SmoothScrollByXY does not take direction as one of the arguments, and
+// instead we pass two scroll delta values for both x and y directions, when
+// pixels_to_scroll_y is positive, it will scroll down, otherwise scroll up.
+// When pixels_to_scroll_x is positive, it will scroll right, otherwise
+// scroll left.
+bool GpuBenchmarking::SmoothScrollByXY(gin::Arguments* args) {
+  GpuBenchmarkingContext context(render_frame_.get());
+  blink::WebRect rect = context.render_widget()->ViewRect();
+
+  float pixels_to_scroll_x = 0;
+  float pixels_to_scroll_y = 0;
+  v8::Local<v8::Function> callback;
+  float start_x = rect.width / 2;
+  float start_y = rect.height / 2;
+  int gesture_source_type = SyntheticGestureParams::DEFAULT_INPUT;
+  float speed_in_pixels_s = 800;
+  bool precise_scrolling_deltas = true;
+  bool scroll_by_page = false;
+  bool cursor_visible = true;
+  bool scroll_by_percentage = false;
+  std::string keys_value;
+
+  if (!GetOptionalArg(args, &pixels_to_scroll_x) ||
+      !GetOptionalArg(args, &pixels_to_scroll_y) ||
+      !GetOptionalArg(args, &callback) || !GetOptionalArg(args, &start_x) ||
+      !GetOptionalArg(args, &start_y) ||
+      !GetOptionalArg(args, &gesture_source_type) ||
+      !GetOptionalArg(args, &speed_in_pixels_s) ||
+      !GetOptionalArg(args, &precise_scrolling_deltas) ||
+      !GetOptionalArg(args, &scroll_by_page) ||
+      !GetOptionalArg(args, &cursor_visible) ||
+      !GetOptionalArg(args, &scroll_by_percentage) ||
+      !GetOptionalArg(args, &keys_value)) {
+    return false;
+  }
+
+  // For all touch inputs, always scroll by precise deltas.
+  DCHECK(gesture_source_type != SyntheticGestureParams::TOUCH_INPUT ||
+         precise_scrolling_deltas);
+  // Scroll by page only for mouse inputs.
+  DCHECK(!scroll_by_page ||
+         gesture_source_type == SyntheticGestureParams::MOUSE_INPUT);
+  // Scroll by percentage only for mouse inputs.
+  DCHECK(!scroll_by_percentage ||
+         gesture_source_type == SyntheticGestureParams::MOUSE_INPUT);
+
+  gfx::Vector2dF distances(pixels_to_scroll_x, pixels_to_scroll_y);
+  gfx::Vector2dF fling_velocity(0, 0);
+  int key_modifiers = 0;
+  std::vector<base::StringPiece> key_list = base::SplitStringPiece(
+      keys_value, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
+  for (const base::StringPiece& key : key_list) {
+    int key_modifier = ToKeyModifiers(key);
+    if (key_modifier == 0) {
+      return false;
+    }
+    key_modifiers |= key_modifier;
+  }
+
+  EnsureRemoteInterface();
+  return BeginSmoothScroll(
+      &context, args, input_injector_, distances, callback, gesture_source_type,
+      speed_in_pixels_s, true /* prevent_fling */, start_x, start_y,
+      fling_velocity, precise_scrolling_deltas, scroll_by_page, cursor_visible,
+      scroll_by_percentage, key_modifiers);
 }
 
 bool GpuBenchmarking::SmoothDrag(gin::Arguments* args) {
@@ -751,6 +859,10 @@ bool GpuBenchmarking::SmoothDrag(gin::Arguments* args) {
                          speed_in_pixels_s);
 }
 
+// TODO(lanwei): Swipe takes pixels_to_scroll and direction. When the
+// pixels_to_scroll is positive and direction is up, it means the finger moves
+// up, but the page scrolls down, which is opposite to SmoothScrollBy. We
+// should change this to match with SmoothScrollBy or SmoothScrollByXY.
 bool GpuBenchmarking::Swipe(gin::Arguments* args) {
   GpuBenchmarkingContext context(render_frame_.get());
   blink::WebRect rect = context.render_widget()->ViewRect();
@@ -778,16 +890,27 @@ bool GpuBenchmarking::Swipe(gin::Arguments* args) {
   // needed for touchscreen swipe, because we will calculate the velocity in
   // our code.
   if (gesture_source_type == SyntheticGestureParams::TOUCHPAD_INPUT &&
-      fling_velocity == 0)
+      fling_velocity == 0) {
     fling_velocity = 1000;
+  }
+
+  base::Optional<gfx::Vector2dF> pixels_to_scrol_vector =
+      ToVector(direction, pixels_to_scroll);
+  base::Optional<gfx::Vector2dF> fling_velocity_vector =
+      ToVector(direction, fling_velocity);
+  if (!pixels_to_scrol_vector.has_value() ||
+      !fling_velocity_vector.has_value()) {
+    return false;
+  }
 
   EnsureRemoteInterface();
   return BeginSmoothScroll(
-      &context, args, input_injector_, -pixels_to_scroll, callback,
-      gesture_source_type, direction, speed_in_pixels_s, false, start_x,
-      start_y, fling_velocity, true /* precise_scrolling_deltas */,
+      &context, args, input_injector_, -pixels_to_scrol_vector.value(),
+      callback, gesture_source_type, speed_in_pixels_s,
+      false /* prevent_fling */, start_x, start_y,
+      fling_velocity_vector.value(), true /* precise_scrolling_deltas */,
       false /* scroll_by_page */, true /* cursor_visible */,
-      false /* scroll_by_percentage */);
+      false /* scroll_by_percentage */, 0 /* key_modifiers */);
 }
 
 bool GpuBenchmarking::ScrollBounce(gin::Arguments* args) {
@@ -1132,6 +1255,15 @@ void GpuBenchmarking::CrashGpuProcess() {
   gpu_channel->CrashGpuProcessForTesting();
 }
 
+// Terminates the GPU process with an exit code of 0.
+void GpuBenchmarking::TerminateGpuProcessNormally() {
+  gpu::GpuChannelHost* gpu_channel =
+      RenderThreadImpl::current()->GetGpuChannel();
+  if (!gpu_channel)
+    return;
+  gpu_channel->TerminateGpuProcessForTesting();
+}
+
 void GpuBenchmarking::GetGpuDriverBugWorkarounds(gin::Arguments* args) {
   std::vector<std::string> gpu_driver_bug_workarounds;
   gpu::GpuChannelHost* gpu_channel =
diff --git a/chromium/content/renderer/gpu_benchmarking_extension.h b/chromium/content/renderer/gpu_benchmarking_extension.h
index 1f13e97d625..edd2c918aec 100644
--- a/chromium/content/renderer/gpu_benchmarking_extension.h
+++ b/chromium/content/renderer/gpu_benchmarking_extension.h
@@ -50,6 +50,7 @@ class GpuBenchmarking : public gin::Wrappable<GpuBenchmarking> {
 
   // All arguments in these methods are in visual viewport coordinates.
   bool SmoothScrollBy(gin::Arguments* args);
+  bool SmoothScrollByXY(gin::Arguments* args);
   bool SmoothDrag(gin::Arguments* args);
   bool Swipe(gin::Arguments* args);
   bool ScrollBounce(gin::Arguments* args);
@@ -82,6 +83,7 @@ class GpuBenchmarking : public gin::Wrappable<GpuBenchmarking> {
   bool HasGpuChannel();
   bool HasGpuProcess();
   void CrashGpuProcess();
+  void TerminateGpuProcessNormally();
   void GetGpuDriverBugWorkarounds(gin::Arguments* args);
 
   // Starts/stops the sampling profiler. StartProfiling takes one optional
diff --git a/chromium/content/renderer/impression_conversions.cc b/chromium/content/renderer/impression_conversions.cc
new file mode 100644
index 00000000000..81c7aee83b8
--- /dev/null
+++ b/chromium/content/renderer/impression_conversions.cc
@@ -0,0 +1,27 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/impression_conversions.h"
+
+#include <algorithm>
+#include <iterator>
+
+#include "third_party/blink/public/platform/web_security_origin.h"
+#include "third_party/blink/public/platform/web_string.h"
+
+namespace content {
+
+Impression ConvertWebImpressionToImpression(
+    const blink::WebImpression& web_impression) {
+  Impression result;
+
+  result.impression_data = web_impression.impression_data;
+  result.expiry = web_impression.expiry;
+  result.reporting_origin = web_impression.reporting_origin;
+  result.conversion_destination = web_impression.conversion_destination;
+
+  return result;
+}
+
+}  // namespace content
diff --git a/chromium/content/renderer/impression_conversions.h b/chromium/content/renderer/impression_conversions.h
new file mode 100644
index 00000000000..bf856b9809d
--- /dev/null
+++ b/chromium/content/renderer/impression_conversions.h
@@ -0,0 +1,18 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_IMPRESSION_CONVERSIONS_H_
+#define CONTENT_RENDERER_IMPRESSION_CONVERSIONS_H_
+
+#include "content/public/common/impression.h"
+#include "third_party/blink/public/platform/web_impression.h"
+
+namespace content {
+
+Impression ConvertWebImpressionToImpression(
+    const blink::WebImpression& web_impression);
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_IMPRESSION_CONVERSIONS_H_
diff --git a/chromium/content/renderer/in_process_renderer_thread.cc b/chromium/content/renderer/in_process_renderer_thread.cc
index 1b60fd0d630..b662e2927b5 100644
--- a/chromium/content/renderer/in_process_renderer_thread.cc
+++ b/chromium/content/renderer/in_process_renderer_thread.cc
@@ -8,6 +8,7 @@
 #include "content/renderer/render_process.h"
 #include "content/renderer/render_process_impl.h"
 #include "content/renderer/render_thread_impl.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 
 #if defined(OS_ANDROID)
@@ -38,6 +39,7 @@ void InProcessRendererThread::Init() {
   // Android. Temporary CHECK() to debug http://crbug.com/514141
   CHECK(!render_process_);
 #endif
+  blink::Platform::InitializeBlink();
   std::unique_ptr<blink::scheduler::WebThreadScheduler> main_thread_scheduler =
       blink::scheduler::WebThreadScheduler::CreateMainThreadScheduler();
 
diff --git a/chromium/content/renderer/input/frame_input_handler_impl.cc b/chromium/content/renderer/input/frame_input_handler_impl.cc
index e0f8cf58899..3f710c7066e 100644
--- a/chromium/content/renderer/input/frame_input_handler_impl.cc
+++ b/chromium/content/renderer/input/frame_input_handler_impl.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/input/ime_text_span_conversions.h"
 #include "content/common/input/input_handler.mojom.h"
 #include "content/renderer/ime_event_guard.h"
diff --git a/chromium/content/renderer/input/input_event_prediction.cc b/chromium/content/renderer/input/input_event_prediction.cc
index b8a79476e80..30a63b7f73d 100644
--- a/chromium/content/renderer/input/input_event_prediction.cc
+++ b/chromium/content/renderer/input/input_event_prediction.cc
@@ -51,10 +51,10 @@ InputEventPrediction::InputEventPrediction(bool enable_resampling)
 
   if (predictor_name.empty())
     selected_predictor_type_ =
-        ui::input_prediction::PredictorType::kScrollPredictorTypeKalman;
+        blink::input_prediction::PredictorType::kScrollPredictorTypeKalman;
   else
     selected_predictor_type_ =
-        ui::PredictorFactory::GetPredictorTypeFromName(predictor_name);
+        blink::PredictorFactory::GetPredictorTypeFromName(predictor_name);
 
   mouse_predictor_ = CreatePredictor();
 }
@@ -65,9 +65,9 @@ void InputEventPrediction::HandleEvents(
     blink::WebCoalescedInputEvent& coalesced_event,
     base::TimeTicks frame_time) {
   switch (coalesced_event.Event().GetType()) {
-    case WebInputEvent::kMouseMove:
-    case WebInputEvent::kTouchMove:
-    case WebInputEvent::kPointerMove: {
+    case WebInputEvent::Type::kMouseMove:
+    case WebInputEvent::Type::kTouchMove:
+    case WebInputEvent::Type::kPointerMove: {
       size_t coalesced_size = coalesced_event.CoalescedEventSize();
       for (size_t i = 0; i < coalesced_size; i++)
         UpdatePrediction(coalesced_event.CoalescedEvent(i));
@@ -78,8 +78,8 @@ void InputEventPrediction::HandleEvents(
       AddPredictedEvents(coalesced_event);
       break;
     }
-    case WebInputEvent::kTouchScrollStarted:
-    case WebInputEvent::kPointerCausedUaAction:
+    case WebInputEvent::Type::kTouchScrollStarted:
+    case WebInputEvent::Type::kPointerCausedUaAction:
       pointer_id_predictor_map_.clear();
       break;
     default:
@@ -87,23 +87,24 @@ void InputEventPrediction::HandleEvents(
   }
 }
 
-std::unique_ptr<ui::InputPredictor> InputEventPrediction::CreatePredictor()
+std::unique_ptr<blink::InputPredictor> InputEventPrediction::CreatePredictor()
     const {
-  return ui::PredictorFactory::GetPredictor(selected_predictor_type_);
+  return blink::PredictorFactory::GetPredictor(selected_predictor_type_);
 }
 
 void InputEventPrediction::UpdatePrediction(const WebInputEvent& event) {
   if (WebInputEvent::IsTouchEventType(event.GetType())) {
-    DCHECK(event.GetType() == WebInputEvent::kTouchMove);
+    DCHECK(event.GetType() == WebInputEvent::Type::kTouchMove);
     const WebTouchEvent& touch_event = static_cast<const WebTouchEvent&>(event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
-      if (touch_event.touches[i].state == blink::WebTouchPoint::kStateMoved) {
+      if (touch_event.touches[i].state ==
+          blink::WebTouchPoint::State::kStateMoved) {
         UpdateSinglePointer(touch_event.touches[i], touch_event.TimeStamp());
       }
     }
   } else {
-    DCHECK(event.GetType() == WebInputEvent::kMouseMove ||
-           event.GetType() == WebInputEvent::kPointerMove);
+    DCHECK(event.GetType() == WebInputEvent::Type::kMouseMove ||
+           event.GetType() == WebInputEvent::Type::kPointerMove);
     UpdateSinglePointer(*ToWebPointerProperties(&event), event.TimeStamp());
   }
   last_event_timestamp_ = event.TimeStamp();
@@ -114,10 +115,11 @@ void InputEventPrediction::ApplyResampling(base::TimeTicks frame_time,
   base::TimeDelta prediction_delta = frame_time - event->TimeStamp();
   base::TimeTicks predict_time;
 
-  if (event->GetType() == WebInputEvent::kTouchMove) {
+  if (event->GetType() == WebInputEvent::Type::kTouchMove) {
     WebTouchEvent* touch_event = static_cast<WebTouchEvent*>(event);
     for (unsigned i = 0; i < touch_event->touches_length; ++i) {
-      if (touch_event->touches[i].state == blink::WebTouchPoint::kStateMoved) {
+      if (touch_event->touches[i].state ==
+          blink::WebTouchPoint::State::kStateMoved) {
         if (auto* predictor = GetPredictor(touch_event->touches[i])) {
           // When resampling, we don't want to predict too far away because the
           // result will likely be inaccurate in that case. We then cut off the
@@ -149,9 +151,10 @@ void InputEventPrediction::ResetPredictor(const WebInputEvent& event) {
   if (WebInputEvent::IsTouchEventType(event.GetType())) {
     const WebTouchEvent& touch_event = static_cast<const WebTouchEvent&>(event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
-      if (touch_event.touches[i].state != blink::WebTouchPoint::kStateMoved &&
+      if (touch_event.touches[i].state !=
+              blink::WebTouchPoint::State::kStateMoved &&
           touch_event.touches[i].state !=
-              blink::WebTouchPoint::kStateStationary)
+              blink::WebTouchPoint::State::kStateStationary)
         pointer_id_predictor_map_.erase(touch_event.touches[i].id);
     }
   } else if (WebInputEvent::IsMouseEventType(event.GetType())) {
@@ -168,9 +171,10 @@ void InputEventPrediction::AddPredictedEvents(
       last_event_timestamp_ + mouse_predictor_->MaxPredictionTime();
   bool success = true;
   while (success) {
-    ui::WebScopedInputEvent predicted_event = coalesced_event.Event().Clone();
+    std::unique_ptr<WebInputEvent> predicted_event =
+        coalesced_event.Event().Clone();
     success = false;
-    if (predicted_event->GetType() == WebInputEvent::kTouchMove) {
+    if (predicted_event->GetType() == WebInputEvent::Type::kTouchMove) {
       WebTouchEvent& touch_event =
           static_cast<WebTouchEvent&>(*predicted_event);
       // Average all touch intervals
@@ -183,7 +187,7 @@ void InputEventPrediction::AddPredictedEvents(
       if (predict_time <= max_prediction_timestamp) {
         for (unsigned i = 0; i < touch_event.touches_length; ++i) {
           if (touch_event.touches[i].state ==
-              blink::WebTouchPoint::kStateMoved) {
+              blink::WebTouchPoint::State::kStateMoved) {
             success =
                 GetPointerPrediction(predict_time, &touch_event.touches[i]);
           }
@@ -203,7 +207,7 @@ void InputEventPrediction::AddPredictedEvents(
   }
 }
 
-ui::InputPredictor* InputEventPrediction::GetPredictor(
+blink::InputPredictor* InputEventPrediction::GetPredictor(
     const WebPointerProperties& event) const {
   if (event.pointer_type == WebPointerProperties::PointerType::kMouse)
     return mouse_predictor_.get();
@@ -225,7 +229,8 @@ base::TimeDelta InputEventPrediction::GetPredictionTimeInterval(
 void InputEventPrediction::UpdateSinglePointer(
     const WebPointerProperties& event,
     base::TimeTicks event_time) {
-  ui::InputPredictor::InputData data = {event.PositionInWidget(), event_time};
+  blink::InputPredictor::InputData data = {event.PositionInWidget(),
+                                           event_time};
   if (auto* predictor = GetPredictor(event)) {
     predictor->Update(data);
   } else {
diff --git a/chromium/content/renderer/input/input_event_prediction.h b/chromium/content/renderer/input/input_event_prediction.h
index 65456eb65a3..75610fe976a 100644
--- a/chromium/content/renderer/input/input_event_prediction.h
+++ b/chromium/content/renderer/input/input_event_prediction.h
@@ -8,10 +8,11 @@
 #include <list>
 #include <unordered_map>
 
-#include "content/renderer/input/scoped_web_input_event_with_latency_info.h"
+#include "content/common/content_export.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/platform/input/input_predictor.h"
+#include "third_party/blink/public/platform/input/predictor_factory.h"
 #include "ui/events/blink/blink_features.h"
-#include "ui/events/blink/prediction/input_predictor.h"
-#include "ui/events/blink/prediction/predictor_factory.h"
 #include "ui/events/event.h"
 
 using blink::WebInputEvent;
@@ -38,7 +39,7 @@ class CONTENT_EXPORT InputEventPrediction {
                     base::TimeTicks frame_time);
 
   // Initialize predictor for different pointer.
-  std::unique_ptr<ui::InputPredictor> CreatePredictor() const;
+  std::unique_ptr<blink::InputPredictor> CreatePredictor() const;
 
  private:
   friend class InputEventPredictionTest;
@@ -67,7 +68,7 @@ class CONTENT_EXPORT InputEventPrediction {
       const WebPointerProperties& event) const;
 
   // Returns a pointer to the predictor for given WebPointerProperties.
-  ui::InputPredictor* GetPredictor(const WebPointerProperties& event) const;
+  blink::InputPredictor* GetPredictor(const WebPointerProperties& event) const;
 
   // Get single predictor based on event id and type, and update the predictor
   // with new events coords.
@@ -84,13 +85,13 @@ class CONTENT_EXPORT InputEventPrediction {
   // predictor, for other pointer type, remove it from mapping.
   void ResetSinglePredictor(const WebPointerProperties& event);
 
-  std::unordered_map<ui::PointerId, std::unique_ptr<ui::InputPredictor>>
+  std::unordered_map<ui::PointerId, std::unique_ptr<blink::InputPredictor>>
       pointer_id_predictor_map_;
-  std::unique_ptr<ui::InputPredictor> mouse_predictor_;
+  std::unique_ptr<blink::InputPredictor> mouse_predictor_;
 
   // Store the field trial parameter used for choosing different types of
   // predictor.
-  ui::input_prediction::PredictorType selected_predictor_type_;
+  blink::input_prediction::PredictorType selected_predictor_type_;
 
   bool enable_resampling_ = false;
 
diff --git a/chromium/content/renderer/input/input_event_prediction_unittest.cc b/chromium/content/renderer/input/input_event_prediction_unittest.cc
index afc0a1ebdd9..0ad1d1df08f 100644
--- a/chromium/content/renderer/input/input_event_prediction_unittest.cc
+++ b/chromium/content/renderer/input/input_event_prediction_unittest.cc
@@ -10,9 +10,8 @@
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/public/common/content_features.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features.h"
 #include "ui/events/base_event_utils.h"
-#include "ui/events/blink/prediction/empty_predictor.h"
-#include "ui/events/blink/prediction/predictor_factory.h"
 
 namespace content {
 
@@ -21,7 +20,7 @@ using blink::WebInputEvent;
 using blink::WebMouseEvent;
 using blink::WebPointerProperties;
 using blink::WebTouchEvent;
-using ui::input_prediction::PredictorType;
+using blink::input_prediction::PredictorType;
 }  // namespace
 
 class InputEventPredictionTest : public testing::Test {
@@ -30,14 +29,14 @@ class InputEventPredictionTest : public testing::Test {
     // Default to enable resampling with empty predictor for testing.
     ConfigureFieldTrialAndInitialize(
         features::kResamplingInputEvents,
-        ui::input_prediction::kScrollPredictorNameEmpty);
+        blink::features::kScrollPredictorNameEmpty);
   }
 
   int GetPredictorMapSize() const {
     return event_predictor_->pointer_id_predictor_map_.size();
   }
 
-  std::unique_ptr<ui::InputPredictor::InputData> GetPrediction(
+  std::unique_ptr<blink::InputPredictor::InputData> GetPrediction(
       const WebPointerProperties& event) const {
     if (event.pointer_type == WebPointerProperties::PointerType::kMouse) {
       return event_predictor_->mouse_predictor_->GeneratePrediction(
@@ -52,7 +51,7 @@ class InputEventPredictionTest : public testing::Test {
   }
 
   void HandleEvents(const WebInputEvent& event) {
-    blink::WebCoalescedInputEvent coalesced_event(event);
+    blink::WebCoalescedInputEvent coalesced_event(event, ui::LatencyInfo());
     event_predictor_->HandleEvents(coalesced_event, ui::EventTimeForNow());
   }
 
@@ -88,27 +87,23 @@ TEST_F(InputEventPredictionTest, PredictorType) {
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeEmpty);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameEmpty);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameEmpty);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeEmpty);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeKalman);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeKalman);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameLsq);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameLsq);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeLsq);
 
@@ -117,9 +112,8 @@ TEST_F(InputEventPredictionTest, PredictorType) {
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeKalman);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kInputPredictorTypeChoice,
-      ui::input_prediction::kScrollPredictorNameLsq);
+  ConfigureFieldTrialAndInitialize(features::kInputPredictorTypeChoice,
+                                   blink::features::kScrollPredictorNameLsq);
   EXPECT_FALSE(event_predictor_->enable_resampling_);
   // When enable_resampling_ is true, kInputPredictorTypeChoice flag has no
   // effect.
@@ -130,7 +124,7 @@ TEST_F(InputEventPredictionTest, PredictorType) {
 
 TEST_F(InputEventPredictionTest, MouseEvent) {
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   EXPECT_FALSE(GetPrediction(mouse_move));
 
@@ -142,7 +136,7 @@ TEST_F(InputEventPredictionTest, MouseEvent) {
   EXPECT_EQ(predicted_point->pos.y(), 10);
 
   WebMouseEvent mouse_down = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseDown, 10, 10, 0);
+      WebInputEvent::Type::kMouseDown, 10, 10, 0);
 
   HandleEvents(mouse_down);
   EXPECT_FALSE(GetPrediction(mouse_down));
@@ -173,7 +167,7 @@ TEST_F(InputEventPredictionTest, SingleTouchPoint) {
 
 TEST_F(InputEventPredictionTest, MouseEventTypePen) {
   WebMouseEvent pen_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0,
+      WebInputEvent::Type::kMouseMove, 10, 10, 0,
       WebPointerProperties::PointerType::kPen);
 
   EXPECT_FALSE(GetPrediction(pen_move));
@@ -185,7 +179,7 @@ TEST_F(InputEventPredictionTest, MouseEventTypePen) {
   EXPECT_EQ(predicted_point->pos.y(), 10);
 
   WebMouseEvent pen_leave = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseLeave, 10, 10, 0,
+      WebInputEvent::Type::kMouseLeave, 10, 10, 0,
       WebPointerProperties::PointerType::kPen);
 
   HandleEvents(pen_leave);
@@ -232,14 +226,14 @@ TEST_F(InputEventPredictionTest, MultipleTouchPoint) {
 
 TEST_F(InputEventPredictionTest, TouchAndStylusResetMousePredictor) {
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   HandleEvents(mouse_move);
   auto predicted_point = GetPrediction(mouse_move);
   EXPECT_TRUE(predicted_point);
 
   WebMouseEvent pen_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 20, 20, 0,
+      WebInputEvent::Type::kMouseMove, 20, 20, 0,
       WebPointerProperties::PointerType::kPen);
   pen_move.id = 1;
 
@@ -284,7 +278,7 @@ TEST_F(InputEventPredictionTest, TouchScrollStartedRemoveAllTouchPoints) {
   HandleEvents(touch_event);
   EXPECT_EQ(GetPredictorMapSize(), 2);
 
-  touch_event.SetType(WebInputEvent::kTouchScrollStarted);
+  touch_event.SetType(WebInputEvent::Type::kTouchScrollStarted);
   HandleEvents(touch_event);
   EXPECT_EQ(GetPredictorMapSize(), 0);
 }
@@ -298,21 +292,21 @@ TEST_F(InputEventPredictionTest, ResamplingDisabled) {
 
   // Send 3 mouse move to get kalman predictor ready.
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 11, 9, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 11, 9, 0);
   HandleEvents(mouse_move);
 
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 12, 8, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 12, 8, 0);
   HandleEvents(mouse_move);
 
   // The 4th move event should generate predicted events.
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 13, 7, 0);
-  blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 13, 7, 0);
+  blink::WebCoalescedInputEvent coalesced_event(mouse_move, ui::LatencyInfo());
   event_predictor_->HandleEvents(coalesced_event, ui::EventTimeForNow());
 
   EXPECT_GT(coalesced_event.PredictedEventSize(), 0u);
@@ -327,9 +321,8 @@ TEST_F(InputEventPredictionTest, ResamplingDisabled) {
 
 // Test that when dt > maxResampling, resampling is cut off .
 TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
 
   base::TimeDelta predictor_max_resample_time =
       event_predictor_->mouse_predictor_->MaxResampleTime();
@@ -337,25 +330,26 @@ TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
   base::TimeTicks event_time = ui::EventTimeForNow();
   // Send 3 mouse move each has 8ms interval to get kalman predictor ready.
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   mouse_move.SetTimeStamp(event_time);
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 11, 9, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 11, 9, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 12, 8, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 12, 8, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
   HandleEvents(mouse_move);
 
   {
     // When frame_time is 8ms away from the last event, we have both resampling
     // and 3 predicted events.
-    mouse_move = SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove,
-                                                      13, 7, 0);
+    mouse_move = SyntheticWebMouseEventBuilder::Build(
+        WebInputEvent::Type::kMouseMove, 13, 7, 0);
     mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
-    blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+    blink::WebCoalescedInputEvent coalesced_event(mouse_move,
+                                                  ui::LatencyInfo());
     base::TimeTicks frame_time =
         event_time + predictor_max_resample_time;  // No cut off
     event_predictor_->HandleEvents(coalesced_event, frame_time);
@@ -376,10 +370,11 @@ TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
     // Test When the delta time between the frame time and the event is greater
     // than the maximum resampling time for a predictor, the resampling is cut
     // off to the maximum allowed by the predictor
-    mouse_move = SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove,
-                                                      14, 6, 0);
+    mouse_move = SyntheticWebMouseEventBuilder::Build(
+        WebInputEvent::Type::kMouseMove, 14, 6, 0);
     mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
-    blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+    blink::WebCoalescedInputEvent coalesced_event(mouse_move,
+                                                  ui::LatencyInfo());
     base::TimeTicks frame_time =
         event_time + predictor_max_resample_time +
         base::TimeDelta::FromMilliseconds(10);  // overpredict on purpose
@@ -402,30 +397,30 @@ TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
 
 // Test that when dt between events is 6ms, first predicted point is 6ms ahead.
 TEST_F(InputEventPredictionTest, PredictedEventsTimeIntervalEqualRealEvents) {
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
 
   base::TimeTicks event_time = ui::EventTimeForNow();
   // Send 3 mouse move each has 6ms interval to get kalman predictor ready.
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   mouse_move.SetTimeStamp(event_time);
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 11, 9, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 11, 9, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(6));
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 12, 8, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 12, 8, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(6));
   HandleEvents(mouse_move);
 
   {
-    mouse_move = SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove,
-                                                      13, 7, 0);
+    mouse_move = SyntheticWebMouseEventBuilder::Build(
+        WebInputEvent::Type::kMouseMove, 13, 7, 0);
     mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(6));
-    blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+    blink::WebCoalescedInputEvent coalesced_event(mouse_move,
+                                                  ui::LatencyInfo());
     event_predictor_->HandleEvents(coalesced_event, event_time);
 
     EXPECT_EQ(coalesced_event.PredictedEventSize(), 4u);
@@ -446,13 +441,16 @@ TEST_F(InputEventPredictionTest, TouchPointStates) {
     HandleEvents(touch_event);
   }
 
-  for (int state = blink::WebTouchPoint::kStateUndefined;
-       state <= blink::WebTouchPoint::kStateMax; state++) {
+  for (size_t state =
+           static_cast<size_t>(blink::WebTouchPoint::State::kStateUndefined);
+       state <= static_cast<size_t>(blink::WebTouchPoint::State::kStateMax);
+       state++) {
     touch_event.touches[0].state =
         static_cast<blink::WebTouchPoint::State>(state);
-    blink::WebCoalescedInputEvent coalesced_event(touch_event);
+    blink::WebCoalescedInputEvent coalesced_event(touch_event,
+                                                  ui::LatencyInfo());
     event_predictor_->HandleEvents(coalesced_event, ui::EventTimeForNow());
-    if (state == blink::WebTouchPoint::kStateMoved)
+    if (state == static_cast<size_t>(blink::WebTouchPoint::State::kStateMoved))
       EXPECT_GT(coalesced_event.PredictedEventSize(), 0u);
     else
       EXPECT_EQ(coalesced_event.PredictedEventSize(), 0u);
diff --git a/chromium/content/renderer/input/input_target_client_impl.cc b/chromium/content/renderer/input/input_target_client_impl.cc
index c5b1dd957c4..021c306fb72 100644
--- a/chromium/content/renderer/input/input_target_client_impl.cc
+++ b/chromium/content/renderer/input/input_target_client_impl.cc
@@ -5,7 +5,7 @@
 #include "content/renderer/input/input_target_client_impl.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_widget.h"
 
diff --git a/chromium/content/renderer/input/main_thread_event_queue.cc b/chromium/content/renderer/input/main_thread_event_queue.cc
index 1f979e5a38a..ac3ef9423a1 100644
--- a/chromium/content/renderer/input/main_thread_event_queue.cc
+++ b/chromium/content/renderer/input/main_thread_event_queue.cc
@@ -12,6 +12,7 @@
 #include "content/common/input/event_with_latency_info.h"
 #include "content/common/input_messages.h"
 #include "content/renderer/render_widget.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_input_event_attribution.h"
 
 namespace content {
@@ -47,7 +48,7 @@ constexpr base::TimeDelta kAsyncTouchMoveInterval =
 
 }  // namespace
 
-class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
+class QueuedWebInputEvent : public blink::WebCoalescedInputEvent,
                             public MainThreadEventQueueTask {
  public:
   QueuedWebInputEvent(ui::WebScopedInputEvent event,
@@ -56,7 +57,7 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
                       HandledEventCallback callback,
                       bool known_by_scheduler,
                       const blink::WebInputEventAttribution& attribution)
-      : ScopedWebInputEventWithLatencyInfo(std::move(event), latency),
+      : WebCoalescedInputEvent(std::move(event), latency),
         originally_cancelable_(originally_cancelable),
         callback_(std::move(callback)),
         known_by_scheduler_count_(known_by_scheduler ? 1 : 0),
@@ -64,12 +65,22 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
 
   ~QueuedWebInputEvent() override {}
 
-  bool ArePointerMoveEventTypes(QueuedWebInputEvent* other_event) {
+  bool AreCoalescablePointerRawUpdateEvents(QueuedWebInputEvent* other_event) {
     // There is no pointermove at this point in the queue.
-    DCHECK(event().GetType() != WebInputEvent::kPointerMove &&
-           other_event->event().GetType() != WebInputEvent::kPointerMove);
-    return event().GetType() == WebInputEvent::kPointerRawUpdate &&
-           other_event->event().GetType() == WebInputEvent::kPointerRawUpdate;
+    DCHECK(Event().GetType() != WebInputEvent::Type::kPointerMove &&
+           other_event->Event().GetType() != WebInputEvent::Type::kPointerMove);
+    // Events with modifiers differing by kRelativeMotionEvent should not be
+    // coalesced. In case of a pointer lock, kRelativeMotionEvent is sent
+    // when the cursor is recentered. Events post the recentered event have
+    // a big delta compared to the previous events and hence should not be
+    // coalesced.
+    return Event().GetType() == WebInputEvent::Type::kPointerRawUpdate &&
+           other_event->Event().GetType() ==
+               WebInputEvent::Type::kPointerRawUpdate &&
+           ((Event().GetModifiers() &
+             blink::WebInputEvent::Modifiers::kRelativeMotionEvent) ==
+            (other_event->Event().GetModifiers() &
+             blink::WebInputEvent::Modifiers::kRelativeMotionEvent));
   }
 
   FilterResult FilterNewEvent(MainThreadEventQueueTask* other_task) override {
@@ -78,30 +89,39 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
 
     QueuedWebInputEvent* other_event =
         static_cast<QueuedWebInputEvent*>(other_task);
-    if (other_event->event().GetType() ==
-        blink::WebInputEvent::kTouchScrollStarted) {
+    if (other_event->Event().GetType() ==
+        blink::WebInputEvent::Type::kTouchScrollStarted) {
       return HandleTouchScrollStartQueued();
     }
 
-    if (!event().IsSameEventClass(other_event->event()))
+    if (!Event().IsSameEventClass(other_event->Event()))
       return FilterResult::KeepIterating;
 
-    if (!ScopedWebInputEventWithLatencyInfo::CanCoalesceWith(*other_event)) {
+    if (!CanCoalesceWith(*other_event)) {
       // Two pointerevents may not be able to coalesce but we should continue
       // looking further down the queue if both of them were rawupdate or move
       // events and only their pointer_type, id, or event_type was different.
-      if (ArePointerMoveEventTypes(other_event))
+      if (AreCoalescablePointerRawUpdateEvents(other_event))
         return FilterResult::KeepIterating;
       return FilterResult::StopIterating;
     }
 
-    // If the other event was blocking store its callback to call later.
+    // If the other event was blocking store its callback to call later, but we
+    // also save the trace_id to ensure the flow events correct show the
+    // critical path.
+    //
+    // IMPORTANT: this if has to remain above CoalesceWith because that will
+    // overwrite other_event->latency_info() to be equal to |latency_|
+    // (including
+    //  trace_id).
     if (other_event->callback_) {
       blocking_coalesced_callbacks_.push_back(
-          std::move(other_event->callback_));
+          std::make_pair(std::move(other_event->callback_),
+                         other_event->latency_info().trace_id()));
     }
+
     known_by_scheduler_count_ += other_event->known_by_scheduler_count_;
-    ScopedWebInputEventWithLatencyInfo::CoalesceWith(*other_event);
+    CoalesceWith(*other_event);
 
     // The newest event (|other_item|) always wins when updating fields.
     originally_cancelable_ = other_event->originally_cancelable_;
@@ -115,19 +135,19 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
     HandledEventCallback callback =
         base::BindOnce(&QueuedWebInputEvent::HandledEvent,
                        base::Unretained(this), base::RetainedRef(queue));
-    if (!queue->HandleEventOnMainThread(coalesced_event(), latencyInfo(),
-                                        attribution(), std::move(callback))) {
+    if (!queue->HandleEventOnMainThread(*this, attribution(),
+                                        std::move(callback))) {
       // The |callback| won't be run, so our stored |callback_| should run
       // indicating error.
-      HandledEvent(queue, INPUT_EVENT_ACK_STATE_NOT_CONSUMED, latencyInfo(),
-                   nullptr, base::nullopt);
+      HandledEvent(queue, blink::mojom::InputEventResultState::kNotConsumed,
+                   latency_info(), nullptr, base::nullopt);
     }
   }
 
   void HandledEvent(MainThreadEventQueue* queue,
-                    InputEventAckState ack_result,
+                    blink::mojom::InputEventResultState ack_result,
                     const ui::LatencyInfo& latency_info,
-                    std::unique_ptr<ui::DidOverscrollParams> overscroll,
+                    blink::mojom::DidOverscrollParamsPtr overscroll,
                     base::Optional<cc::TouchAction> touch_action) {
     if (callback_) {
       std::move(callback_).Run(ack_result, latency_info, std::move(overscroll),
@@ -140,8 +160,9 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
       ui::LatencyInfo coalesced_latency_info = latency_info;
       coalesced_latency_info.set_coalesced();
       for (auto&& callback : blocking_coalesced_callbacks_) {
-        std::move(callback).Run(ack_result, coalesced_latency_info, nullptr,
-                                base::nullopt);
+        coalesced_latency_info.set_trace_id(callback.second);
+        std::move(callback.first)
+            .Run(ack_result, coalesced_latency_info, nullptr, base::nullopt);
       }
     }
 
@@ -150,9 +171,10 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
       // events processed.
       for (size_t i = 0; i < known_by_scheduler_count_; ++i) {
         queue->main_thread_scheduler_->DidHandleInputEventOnMainThread(
-            event(), ack_result == INPUT_EVENT_ACK_STATE_CONSUMED
-                         ? blink::WebInputEventResult::kHandledApplication
-                         : blink::WebInputEventResult::kNotHandled);
+            Event(),
+            ack_result == blink::mojom::InputEventResultState::kConsumed
+                ? blink::WebInputEventResult::kHandledApplication
+                : blink::WebInputEventResult::kNotHandled);
       }
     }
   }
@@ -165,27 +187,29 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
   FilterResult HandleTouchScrollStartQueued() {
     // A TouchScrollStart will queued after this touch move which will make all
     // previous touch moves that are queued uncancelable.
-    switch (event().GetType()) {
-      case blink::WebInputEvent::kTouchMove: {
-        blink::WebTouchEvent& touch_event =
-            static_cast<blink::WebTouchEvent&>(event());
-        if (touch_event.dispatch_type ==
+    switch (Event().GetType()) {
+      case blink::WebInputEvent::Type::kTouchMove: {
+        blink::WebTouchEvent* touch_event =
+            static_cast<blink::WebTouchEvent*>(EventPointer());
+        if (touch_event->dispatch_type ==
             blink::WebInputEvent::DispatchType::kBlocking) {
-          touch_event.dispatch_type =
+          touch_event->dispatch_type =
               blink::WebInputEvent::DispatchType::kEventNonBlocking;
         }
         return FilterResult::KeepIterating;
       }
-      case blink::WebInputEvent::kTouchStart:
-      case blink::WebInputEvent::kTouchEnd:
+      case blink::WebInputEvent::Type::kTouchStart:
+      case blink::WebInputEvent::Type::kTouchEnd:
         return FilterResult::StopIterating;
       default:
         return FilterResult::KeepIterating;
     }
   }
 
-  // Contains the pending callbacks to be called.
-  base::circular_deque<HandledEventCallback> blocking_coalesced_callbacks_;
+  // Contains the pending callbacks to be called, along with their associated
+  // trace_ids.
+  base::circular_deque<std::pair<HandledEventCallback, int64_t>>
+      blocking_coalesced_callbacks_;
   // Contains the number of non-blocking events coalesced.
 
   // Whether the received event was originally cancelable or not. The compositor
@@ -213,8 +237,6 @@ MainThreadEventQueue::MainThreadEventQueue(
     bool allow_raf_aligned_input)
     : client_(client),
       last_touch_start_forced_nonblocking_due_to_fling_(false),
-      enable_fling_passive_listener_flag_(base::FeatureList::IsEnabled(
-          features::kPassiveEventListenersDueToFling)),
       needs_low_latency_(false),
       needs_unbuffered_input_for_debugger_(false),
       allow_raf_aligned_input_(allow_raf_aligned_input),
@@ -233,20 +255,22 @@ void MainThreadEventQueue::HandleEvent(
     ui::WebScopedInputEvent event,
     const ui::LatencyInfo& latency,
     InputEventDispatchType original_dispatch_type,
-    InputEventAckState ack_result,
+    blink::mojom::InputEventResultState ack_result,
     const blink::WebInputEventAttribution& attribution,
     HandledEventCallback callback) {
   TRACE_EVENT2("input", "MainThreadEventQueue::HandleEvent", "dispatch_type",
                original_dispatch_type, "event_type", event->GetType());
   DCHECK(original_dispatch_type == DISPATCH_TYPE_BLOCKING ||
          original_dispatch_type == DISPATCH_TYPE_NON_BLOCKING);
-  DCHECK(ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING ||
-         ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING ||
-         ack_result == INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  bool non_blocking = original_dispatch_type == DISPATCH_TYPE_NON_BLOCKING ||
-                      ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING;
-  bool is_wheel = event->GetType() == blink::WebInputEvent::kMouseWheel;
+  DCHECK(ack_result == blink::mojom::InputEventResultState::kSetNonBlocking ||
+         ack_result ==
+             blink::mojom::InputEventResultState::kSetNonBlockingDueToFling ||
+         ack_result == blink::mojom::InputEventResultState::kNotConsumed);
+
+  bool is_blocking =
+      original_dispatch_type == DISPATCH_TYPE_BLOCKING &&
+      ack_result != blink::mojom::InputEventResultState::kSetNonBlocking;
+  bool is_wheel = event->GetType() == blink::WebInputEvent::Type::kMouseWheel;
   bool is_touch = blink::WebInputEvent::IsTouchEventType(event->GetType());
   bool originally_cancelable = false;
 
@@ -254,76 +278,77 @@ void MainThreadEventQueue::HandleEvent(
     blink::WebTouchEvent* touch_event =
         static_cast<blink::WebTouchEvent*>(event.get());
 
-    originally_cancelable =
-        touch_event->dispatch_type == blink::WebInputEvent::kBlocking;
+    originally_cancelable = touch_event->dispatch_type ==
+                            blink::WebInputEvent::DispatchType::kBlocking;
 
     // Adjust the |dispatchType| on the event since the compositor
     // determined all event listeners are passive.
-    if (non_blocking) {
+    if (!is_blocking) {
       touch_event->dispatch_type =
-          blink::WebInputEvent::kListenersNonBlockingPassive;
+          blink::WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     }
-    if (touch_event->GetType() == blink::WebInputEvent::kTouchStart)
+    if (touch_event->GetType() == blink::WebInputEvent::Type::kTouchStart)
       last_touch_start_forced_nonblocking_due_to_fling_ = false;
 
-    if (enable_fling_passive_listener_flag_ &&
-        touch_event->touch_start_or_first_touch_move &&
-        touch_event->dispatch_type == blink::WebInputEvent::kBlocking) {
+    if (touch_event->touch_start_or_first_touch_move &&
+        touch_event->dispatch_type ==
+            blink::WebInputEvent::DispatchType::kBlocking) {
       // If the touch start is forced to be passive due to fling, its following
       // touch move should also be passive.
-      if (ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING ||
+      if (ack_result ==
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling ||
           last_touch_start_forced_nonblocking_due_to_fling_) {
-        touch_event->dispatch_type =
-            blink::WebInputEvent::kListenersForcedNonBlockingDueToFling;
-        non_blocking = true;
+        touch_event->dispatch_type = blink::WebInputEvent::DispatchType::
+            kListenersForcedNonBlockingDueToFling;
+        is_blocking = false;
         last_touch_start_forced_nonblocking_due_to_fling_ = true;
       }
     }
 
     // If the event is non-cancelable ACK it right away.
-    if (!non_blocking &&
-        touch_event->dispatch_type != blink::WebInputEvent::kBlocking)
-      non_blocking = true;
+    if (is_blocking && touch_event->dispatch_type !=
+                           blink::WebInputEvent::DispatchType::kBlocking)
+      is_blocking = false;
   }
 
   if (is_wheel) {
     blink::WebMouseWheelEvent* wheel_event =
         static_cast<blink::WebMouseWheelEvent*>(event.get());
-    originally_cancelable =
-        wheel_event->dispatch_type == blink::WebInputEvent::kBlocking;
-    if (non_blocking) {
+    originally_cancelable = wheel_event->dispatch_type ==
+                            blink::WebInputEvent::DispatchType::kBlocking;
+    if (!is_blocking) {
       // Adjust the |dispatchType| on the event since the compositor
       // determined all event listeners are passive.
       wheel_event->dispatch_type =
-          blink::WebInputEvent::kListenersNonBlockingPassive;
+          blink::WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     }
   }
 
   HandledEventCallback event_callback;
-  if (!non_blocking) {
-    TRACE_EVENT_INSTANT0("input", "NonBlocking", TRACE_EVENT_SCOPE_THREAD);
+  if (is_blocking) {
+    TRACE_EVENT_INSTANT0("input", "Blocking", TRACE_EVENT_SCOPE_THREAD);
     event_callback = std::move(callback);
   }
 
   if (has_pointerrawupdate_handlers_) {
-    if (event->GetType() == WebInputEvent::kMouseMove) {
+    if (event->GetType() == WebInputEvent::Type::kMouseMove) {
       ui::WebScopedInputEvent raw_event(new blink::WebPointerEvent(
-          WebInputEvent::kPointerRawUpdate,
+          WebInputEvent::Type::kPointerRawUpdate,
           *(static_cast<blink::WebMouseEvent*>(event.get()))));
       std::unique_ptr<QueuedWebInputEvent> raw_queued_event(
           new QueuedWebInputEvent(std::move(raw_event), latency, false,
                                   HandledEventCallback(), false, attribution));
 
       QueueEvent(std::move(raw_queued_event));
-    } else if (event->GetType() == WebInputEvent::kTouchMove) {
+    } else if (event->GetType() == WebInputEvent::Type::kTouchMove) {
       const blink::WebTouchEvent& touch_event =
           *static_cast<const blink::WebTouchEvent*>(event.get());
       for (unsigned i = 0; i < touch_event.touches_length; ++i) {
         const blink::WebTouchPoint& touch_point = touch_event.touches[i];
-        if (touch_point.state == blink::WebTouchPoint::kStateMoved) {
+        if (touch_point.state == blink::WebTouchPoint::State::kStateMoved) {
           ui::WebScopedInputEvent raw_event(
               new blink::WebPointerEvent(touch_event, touch_point));
-          raw_event->SetType(WebInputEvent::kPointerRawUpdate);
+          raw_event->SetType(WebInputEvent::Type::kPointerRawUpdate);
           std::unique_ptr<QueuedWebInputEvent> raw_queued_event(
               new QueuedWebInputEvent(std::move(raw_event), latency, false,
                                       HandledEventCallback(), false,
@@ -453,10 +478,10 @@ static bool IsAsyncTouchMove(
     return false;
   const QueuedWebInputEvent* event =
       static_cast<const QueuedWebInputEvent*>(queued_item.get());
-  if (event->event().GetType() != blink::WebInputEvent::kTouchMove)
+  if (event->Event().GetType() != blink::WebInputEvent::Type::kTouchMove)
     return false;
   const blink::WebTouchEvent& touch_event =
-      static_cast<const blink::WebTouchEvent&>(event->event());
+      static_cast<const blink::WebTouchEvent&>(event->Event());
   return touch_event.moved_beyond_slop_region && !event->originallyCancelable();
 }
 
@@ -522,12 +547,12 @@ void MainThreadEventQueue::QueueEvent(
   // Record the input event's type prior to enqueueing so that the scheduler
   // can be notified of its dispatch (if the event is not coalesced).
   bool is_input_event = event->IsWebInputEvent();
-  WebInputEvent::Type input_event_type = WebInputEvent::kUndefined;
+  WebInputEvent::Type input_event_type = WebInputEvent::Type::kUndefined;
   blink::WebInputEventAttribution attribution;
   if (is_input_event) {
     auto* queued_input_event =
         static_cast<const QueuedWebInputEvent*>(event.get());
-    input_event_type = queued_input_event->event().GetType();
+    input_event_type = queued_input_event->Event().GetType();
     attribution = queued_input_event->attribution();
   }
 
@@ -562,8 +587,8 @@ bool MainThreadEventQueue::IsRawUpdateEvent(
     const std::unique_ptr<MainThreadEventQueueTask>& item) const {
   return item->IsWebInputEvent() &&
          static_cast<const QueuedWebInputEvent*>(item.get())
-                 ->event()
-                 .GetType() == blink::WebInputEvent::kPointerRawUpdate;
+                 ->Event()
+                 .GetType() == blink::WebInputEvent::Type::kPointerRawUpdate;
 }
 
 bool MainThreadEventQueue::ShouldFlushQueue(
@@ -579,10 +604,10 @@ bool MainThreadEventQueue::IsRafAlignedEvent(
     return false;
   const QueuedWebInputEvent* event =
       static_cast<const QueuedWebInputEvent*>(item.get());
-  switch (event->event().GetType()) {
-    case blink::WebInputEvent::kMouseMove:
-    case blink::WebInputEvent::kMouseWheel:
-    case blink::WebInputEvent::kTouchMove:
+  switch (event->Event().GetType()) {
+    case blink::WebInputEvent::Type::kMouseMove:
+    case blink::WebInputEvent::Type::kMouseWheel:
+    case blink::WebInputEvent::Type::kTouchMove:
       return allow_raf_aligned_input_ && !needs_low_latency_ &&
              !needs_low_latency_until_pointer_up_ &&
              !needs_unbuffered_input_for_debugger_;
@@ -596,13 +621,12 @@ void MainThreadEventQueue::HandleEventResampling(
     base::TimeTicks frame_time) {
   if (item->IsWebInputEvent() && allow_raf_aligned_input_ && event_predictor_) {
     QueuedWebInputEvent* event = static_cast<QueuedWebInputEvent*>(item.get());
-    event_predictor_->HandleEvents(event->coalesced_event(), frame_time);
+    event_predictor_->HandleEvents(*event, frame_time);
   }
 }
 
 bool MainThreadEventQueue::HandleEventOnMainThread(
     const blink::WebCoalescedInputEvent& event,
-    const ui::LatencyInfo& latency,
     const blink::WebInputEventAttribution& attribution,
     HandledEventCallback handled_callback) {
   // Notify the scheduler that the main thread is about to execute handlers.
@@ -612,18 +636,17 @@ bool MainThreadEventQueue::HandleEventOnMainThread(
 
   bool handled = false;
   if (client_) {
-    handled =
-        client_->HandleInputEvent(event, latency, std::move(handled_callback));
+    handled = client_->HandleInputEvent(event, std::move(handled_callback));
   }
 
   if (needs_low_latency_until_pointer_up_) {
     // Reset the needs low latency until pointer up mode if necessary.
     switch (event.Event().GetType()) {
-      case blink::WebInputEvent::kMouseUp:
-      case blink::WebInputEvent::kTouchCancel:
-      case blink::WebInputEvent::kTouchEnd:
-      case blink::WebInputEvent::kPointerCancel:
-      case blink::WebInputEvent::kPointerUp:
+      case blink::WebInputEvent::Type::kMouseUp:
+      case blink::WebInputEvent::Type::kTouchCancel:
+      case blink::WebInputEvent::Type::kTouchEnd:
+      case blink::WebInputEvent::Type::kPointerCancel:
+      case blink::WebInputEvent::Type::kPointerUp:
         needs_low_latency_until_pointer_up_ = false;
         break;
       default:
diff --git a/chromium/content/renderer/input/main_thread_event_queue.h b/chromium/content/renderer/input/main_thread_event_queue.h
index 0709a790c6b..8f338767dbc 100644
--- a/chromium/content/renderer/input/main_thread_event_queue.h
+++ b/chromium/content/renderer/input/main_thread_event_queue.h
@@ -13,22 +13,21 @@
 #include "content/common/content_export.h"
 #include "content/common/input/input_event_dispatch_type.h"
 #include "content/public/common/content_features.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/renderer/input/input_event_prediction.h"
 #include "content/renderer/input/main_thread_event_queue_task_list.h"
-#include "content/renderer/input/scoped_web_input_event_with_latency_info.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "ui/events/blink/did_overscroll_params.h"
 #include "ui/events/blink/web_input_event_traits.h"
 #include "ui/latency/latency_info.h"
 
 namespace content {
 
 using HandledEventCallback =
-    base::OnceCallback<void(InputEventAckState ack_state,
+    base::OnceCallback<void(blink::mojom::InputEventResultState ack_state,
                             const ui::LatencyInfo& latency_info,
-                            std::unique_ptr<ui::DidOverscrollParams>,
+                            blink::mojom::DidOverscrollParamsPtr,
                             base::Optional<cc::TouchAction>)>;
 
 // All interaction with the MainThreadEventQueueClient will occur
@@ -39,7 +38,6 @@ class CONTENT_EXPORT MainThreadEventQueueClient {
   // another event). Returns false if the event will not be handled, and the
   // |handled_callback| will not be run.
   virtual bool HandleInputEvent(const blink::WebCoalescedInputEvent& event,
-                                const ui::LatencyInfo& latency_info,
                                 HandledEventCallback handled_callback) = 0;
   // Requests a BeginMainFrame callback from the compositor.
   virtual void SetNeedsMainFrame() = 0;
@@ -95,7 +93,7 @@ class CONTENT_EXPORT MainThreadEventQueue
   void HandleEvent(ui::WebScopedInputEvent event,
                    const ui::LatencyInfo& latency,
                    InputEventDispatchType dispatch_type,
-                   InputEventAckState ack_result,
+                   blink::mojom::InputEventResultState ack_result,
                    const blink::WebInputEventAttribution& attribution,
                    HandledEventCallback handled_callback);
   void DispatchRafAlignedInput(base::TimeTicks frame_time);
@@ -115,9 +113,11 @@ class CONTENT_EXPORT MainThreadEventQueue
       const std::unique_ptr<MainThreadEventQueueTask>& item,
       base::TimeTicks frame_time);
 
-  static bool IsForwardedAndSchedulerKnown(InputEventAckState ack_state) {
-    return ack_state == INPUT_EVENT_ACK_STATE_NOT_CONSUMED ||
-           ack_state == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING;
+  static bool IsForwardedAndSchedulerKnown(
+      blink::mojom::InputEventResultState ack_state) {
+    return ack_state == blink::mojom::InputEventResultState::kNotConsumed ||
+           ack_state ==
+               blink::mojom::InputEventResultState::kSetNonBlockingDueToFling;
   }
 
  protected:
@@ -132,7 +132,6 @@ class CONTENT_EXPORT MainThreadEventQueue
   // will not be run.
   bool HandleEventOnMainThread(
       const blink::WebCoalescedInputEvent& event,
-      const ui::LatencyInfo& latency,
       const blink::WebInputEventAttribution& attribution,
       HandledEventCallback handled_callback);
 
@@ -153,7 +152,6 @@ class CONTENT_EXPORT MainThreadEventQueue
   friend class MainThreadEventQueueInitializationTest;
   MainThreadEventQueueClient* client_;
   bool last_touch_start_forced_nonblocking_due_to_fling_;
-  bool enable_fling_passive_listener_flag_;
   bool needs_low_latency_;
   bool needs_unbuffered_input_for_debugger_;
   bool allow_raf_aligned_input_;
diff --git a/chromium/content/renderer/input/main_thread_event_queue_task.h b/chromium/content/renderer/input/main_thread_event_queue_task.h
index b5503f9c2d8..e9baf679dab 100644
--- a/chromium/content/renderer/input/main_thread_event_queue_task.h
+++ b/chromium/content/renderer/input/main_thread_event_queue_task.h
@@ -5,8 +5,8 @@
 #ifndef CONTENT_RENDERER_INPUT_MAIN_THREAD_EVENT_QUEUE_TASK_H_
 #define CONTENT_RENDERER_INPUT_MAIN_THREAD_EVENT_QUEUE_TASK_H_
 
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 
 namespace content {
diff --git a/chromium/content/renderer/input/main_thread_event_queue_unittest.cc b/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
index c35f8ded6f2..69894a688df 100644
--- a/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
+++ b/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
@@ -83,7 +83,7 @@ bool Equal(const WebMouseWheelEvent& lhs, const WebMouseWheelEvent& rhs) {
 
 class HandledTask {
  public:
-  virtual ~HandledTask() {}
+  virtual ~HandledTask() = default;
 
   virtual blink::WebCoalescedInputEvent* taskAsEvent() = 0;
   virtual unsigned taskAsClosure() const = 0;
@@ -92,10 +92,8 @@ class HandledTask {
 class HandledEvent : public HandledTask {
  public:
   explicit HandledEvent(const blink::WebCoalescedInputEvent& event)
-      : event_(event.Event(),
-               event.GetCoalescedEventsPointers(),
-               event.GetPredictedEventsPointers()) {}
-  ~HandledEvent() override {}
+      : event_(event) {}
+  ~HandledEvent() override = default;
 
   blink::WebCoalescedInputEvent* taskAsEvent() override { return &event_; }
   unsigned taskAsClosure() const override {
@@ -110,7 +108,7 @@ class HandledEvent : public HandledTask {
 class HandledClosure : public HandledTask {
  public:
   explicit HandledClosure(unsigned closure_id) : closure_id_(closure_id) {}
-  ~HandledClosure() override {}
+  ~HandledClosure() override = default;
 
   blink::WebCoalescedInputEvent* taskAsEvent() override {
     NOTREACHED();
@@ -160,9 +158,9 @@ class HandledEventCallbackTracker {
   }
 
   void DidHandleEvent(size_t index,
-                      InputEventAckState ack_result,
+                      blink::mojom::InputEventResultState ack_result,
                       const ui::LatencyInfo& latency,
-                      std::unique_ptr<ui::DidOverscrollParams> params,
+                      blink::mojom::DidOverscrollParamsPtr params,
                       base::Optional<cc::TouchAction> touch_action) {
     callbacks_received_[index] = ReceivedCallback(
         handling_event_ ? CallbackReceivedState::kCalledWhileHandlingEvent
@@ -196,7 +194,8 @@ class MainThreadEventQueueTest : public testing::Test,
     queue_->set_use_raf_fallback_timer(false);
   }
 
-  void HandleEvent(WebInputEvent& event, InputEventAckState ack_result) {
+  void HandleEvent(WebInputEvent& event,
+                   blink::mojom::InputEventResultState ack_result) {
     base::AutoReset<bool> in_handle_event(&handler_callback_->handling_event_,
                                           true);
     queue_->HandleEvent(
@@ -227,10 +226,6 @@ class MainThreadEventQueueTest : public testing::Test,
     return queue_->last_touch_start_forced_nonblocking_due_to_fling_;
   }
 
-  void set_enable_fling_passive_listener_flag(bool enable_flag) {
-    queue_->enable_fling_passive_listener_flag_ = enable_flag;
-  }
-
   void RunPendingTasksWithSimulatedRaf() {
     while (needs_main_frame_ || main_task_runner_->HasPendingTask()) {
       main_task_runner_->RunUntilIdle();
@@ -250,14 +245,13 @@ class MainThreadEventQueueTest : public testing::Test,
 
   // MainThreadEventQueueClient overrides.
   bool HandleInputEvent(const blink::WebCoalescedInputEvent& event,
-                        const ui::LatencyInfo& latency,
                         HandledEventCallback callback) override {
     if (!handle_input_event_)
       return false;
     std::unique_ptr<HandledTask> handled_event(new HandledEvent(event));
     handled_tasks_.push_back(std::move(handled_event));
-    std::move(callback).Run(INPUT_EVENT_ACK_STATE_NOT_CONSUMED, latency,
-                            nullptr, base::nullopt);
+    std::move(callback).Run(blink::mojom::InputEventResultState::kNotConsumed,
+                            event.latency_info(), nullptr, base::nullopt);
     return true;
   }
   void SetNeedsMainFrame() override { needs_main_frame_ = true; }
@@ -303,7 +297,7 @@ TEST_F(MainThreadEventQueueTest, ClientDoesntHandleInputEvent) {
   event.MovePoint(0, 20, 20);
   WebMouseWheelEvent event2 = SyntheticWebMouseWheelEventBuilder::Build(
       10, 10, 0, 53, 0, ui::ScrollGranularity::kScrollByPixel);
-  HandleEvent(event2, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(event2, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
 
   std::vector<ReceivedCallback> received = GetAndResetCallbackResults();
@@ -340,7 +334,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
       .Times(0);
 
   for (WebMouseWheelEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -364,7 +358,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
     EXPECT_EQ(WebInputEvent::DispatchType::kListenersNonBlockingPassive,
               last_wheel_event->dispatch_type);
     WebMouseWheelEvent coalesced_event = kEvents[0];
-    ui::Coalesce(kEvents[1], &coalesced_event);
+    coalesced_event.Coalesce(kEvents[1]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_wheel_event));
@@ -372,17 +366,17 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
 
   {
     WebMouseWheelEvent coalesced_event = kEvents[0];
-    blink::WebVector<const WebInputEvent*> coalesced_events =
+    const auto& coalesced_events =
         handled_tasks_[0]->taskAsEvent()->GetCoalescedEventsPointers();
     const WebMouseWheelEvent* coalesced_wheel_event0 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[0]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[0].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event0));
 
     coalesced_event = kEvents[1];
     const WebMouseWheelEvent* coalesced_wheel_event1 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[1]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[1].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event1));
@@ -393,7 +387,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
         static_cast<const WebMouseWheelEvent*>(
             handled_tasks_.at(1)->taskAsEvent()->EventPointer());
     WebMouseWheelEvent coalesced_event = kEvents[2];
-    ui::Coalesce(kEvents[3], &coalesced_event);
+    coalesced_event.Coalesce(kEvents[3]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_wheel_event));
@@ -401,17 +395,17 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
 
   {
     WebMouseWheelEvent coalesced_event = kEvents[2];
-    blink::WebVector<const WebInputEvent*> coalesced_events =
+    const auto& coalesced_events =
         handled_tasks_[1]->taskAsEvent()->GetCoalescedEventsPointers();
     const WebMouseWheelEvent* coalesced_wheel_event0 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[0]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[0].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event0));
 
     coalesced_event = kEvents[3];
     const WebMouseWheelEvent* coalesced_wheel_event1 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[1]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[1].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event1));
@@ -434,7 +428,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   kEvents[3].MovePoint(0, 35, 35);
 
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -457,8 +451,10 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   {
     EXPECT_EQ(1u, handled_tasks_[0]->taskAsEvent()->CoalescedEventSize());
     const WebTouchEvent* coalesced_touch_event =
-        static_cast<const WebTouchEvent*>(
-            handled_tasks_[0]->taskAsEvent()->GetCoalescedEventsPointers()[0]);
+        static_cast<const WebTouchEvent*>(handled_tasks_[0]
+                                              ->taskAsEvent()
+                                              ->GetCoalescedEventsPointers()[0]
+                                              .get());
     EXPECT_TRUE(Equal(kEvents[0], *coalesced_touch_event));
   }
 
@@ -473,8 +469,10 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   {
     EXPECT_EQ(1u, handled_tasks_[1]->taskAsEvent()->CoalescedEventSize());
     const WebTouchEvent* coalesced_touch_event =
-        static_cast<const WebTouchEvent*>(
-            handled_tasks_[1]->taskAsEvent()->GetCoalescedEventsPointers()[0]);
+        static_cast<const WebTouchEvent*>(handled_tasks_[1]
+                                              ->taskAsEvent()
+                                              ->GetCoalescedEventsPointers()[0]
+                                              .get());
     EXPECT_TRUE(Equal(kEvents[1], *coalesced_touch_event));
   }
 
@@ -483,7 +481,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(2)->taskAsEvent()->EventPointer());
   WebTouchEvent coalesced_event = kEvents[2];
-  ui::Coalesce(kEvents[3], &coalesced_event);
+  coalesced_event.Coalesce(kEvents[3]);
   coalesced_event.dispatch_type =
       WebInputEvent::DispatchType::kListenersNonBlockingPassive;
   EXPECT_TRUE(Equal(coalesced_event, *last_touch_event));
@@ -491,17 +489,17 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   {
     EXPECT_EQ(2u, handled_tasks_[2]->taskAsEvent()->CoalescedEventSize());
     WebTouchEvent coalesced_event = kEvents[2];
-    blink::WebVector<const WebInputEvent*> coalesced_events =
+    const auto& coalesced_events =
         handled_tasks_[2]->taskAsEvent()->GetCoalescedEventsPointers();
     const WebTouchEvent* coalesced_touch_event0 =
-        static_cast<const WebTouchEvent*>(coalesced_events[0]);
+        static_cast<const WebTouchEvent*>(coalesced_events[0].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_touch_event0));
 
     coalesced_event = kEvents[3];
     const WebTouchEvent* coalesced_touch_event1 =
-        static_cast<const WebTouchEvent*>(coalesced_events[1]);
+        static_cast<const WebTouchEvent*>(coalesced_events[1].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_touch_event1));
@@ -523,10 +521,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouch) {
       .Times(3);
   {
     // Ensure that coalescing takes place.
-    HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-    HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-    HandleEvent(kEvents[2], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-    HandleEvent(kEvents[3], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(kEvents[0],
+                blink::mojom::InputEventResultState::kSetNonBlocking);
+    HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
+    HandleEvent(kEvents[2], blink::mojom::InputEventResultState::kNotConsumed);
+    HandleEvent(kEvents[3], blink::mojom::InputEventResultState::kNotConsumed);
 
     EXPECT_EQ(2u, event_queue().size());
     EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -551,9 +550,9 @@ TEST_F(MainThreadEventQueueTest, BlockingTouch) {
               last_touch_event->unique_touch_event_id);
   }
 
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[2], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[3], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[2], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[3], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -581,10 +580,14 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
 
-  HandleEvent(kWheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kTouchEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kWheelEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kTouchEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kWheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kTouchEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kWheelEvents[1],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kTouchEvents[1],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -604,7 +607,7 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
     EXPECT_EQ(WebInputEvent::DispatchType::kListenersNonBlockingPassive,
               last_wheel_event->dispatch_type);
     WebMouseWheelEvent coalesced_event = kWheelEvents[0];
-    ui::Coalesce(kWheelEvents[1], &coalesced_event);
+    coalesced_event.Coalesce(kWheelEvents[1]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_wheel_event));
@@ -615,7 +618,7 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
     const WebTouchEvent* last_touch_event = static_cast<const WebTouchEvent*>(
         handled_tasks_.at(1)->taskAsEvent()->EventPointer());
     WebTouchEvent coalesced_event = kTouchEvents[0];
-    ui::Coalesce(kTouchEvents[1], &coalesced_event);
+    coalesced_event.Coalesce(kTouchEvents[1]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_touch_event));
@@ -624,13 +627,13 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
 
 TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
   WebMouseEvent mouseDown = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseDown, 10, 10, 0);
+      WebInputEvent::Type::kMouseDown, 10, 10, 0);
 
   WebMouseEvent mouseMove = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
-  WebMouseEvent mouseUp =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseUp, 10, 10, 0);
+  WebMouseEvent mouseUp = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseUp, 10, 10, 0);
 
   WebMouseWheelEvent wheelEvents[3] = {
       SyntheticWebMouseWheelEventBuilder::Build(
@@ -652,11 +655,13 @@ TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
   // then a discrete event. The last discrete event should flush the
   // continuous events so the aren't aligned to rAF and are processed
   // immediately.
-  HandleEvent(mouseDown, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouseMove, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouseUp, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouseDown, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouseMove, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[1],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouseUp, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(4u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -670,8 +675,9 @@ TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
 
   // Simulate the rAF running before the PostTask occurs. The rAF
   // will consume everything.
-  HandleEvent(mouseDown, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouseDown, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   RunSimulatedRafOnce();
@@ -685,11 +691,14 @@ TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
   // Simulate event consumption but no rAF signal. The mouse wheel events
   // should still be in the queue.
   handled_tasks_.clear();
-  HandleEvent(mouseDown, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouseUp, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[2], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouseDown, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouseUp, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[2],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(5u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   main_task_runner_->RunUntilIdle();
@@ -725,7 +734,7 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
   // continuous events so the aren't aligned to rAF and are processed
   // immediately.
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -739,8 +748,8 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
 
   // Simulate the rAF running before the PostTask occurs. The rAF
   // will consume everything.
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   RunSimulatedRafOnce();
@@ -754,8 +763,8 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
   // Simulate event consumption but no rAF signal. The touch events
   // should still be in the queue.
   handled_tasks_.clear();
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   main_task_runner_->RunUntilIdle();
@@ -771,7 +780,7 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
   kEvents[1].touch_start_or_first_touch_move = true;
 
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(event, blink::mojom::InputEventResultState::kNotConsumed);
 
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -788,7 +797,7 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
   kEvents[0].MovePoint(0, 50, 50);
   kEvents[1].PressPoint(10, 10);
   kEvents[1].MovePoint(0, 20, 20);
-  kEvents[0].dispatch_type = WebInputEvent::kEventNonBlocking;
+  kEvents[0].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
 
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
@@ -800,11 +809,11 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
   {
     // Send a non-blocking input event and then blocking  event.
     // The events should coalesce together.
-    HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(1u, event_queue().size());
     EXPECT_FALSE(main_task_runner_->HasPendingTask());
     EXPECT_TRUE(needs_main_frame_);
-    HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(1u, event_queue().size());
     EXPECT_FALSE(main_task_runner_->HasPendingTask());
     EXPECT_TRUE(needs_main_frame_);
@@ -821,11 +830,11 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
 
   // Send a non-cancelable ack required event, and then a non-ack
   // required event they should be coalesced together.
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -837,11 +846,11 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
 
   // Send a non-ack required event, and then a non-cancelable ack
   // required event they should be coalesced together.
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -860,17 +869,17 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputThrottlingMoves) {
   SyntheticWebTouchEvent kEvents[2];
   kEvents[0].PressPoint(10, 10);
   kEvents[0].MovePoint(0, 50, 50);
-  kEvents[0].dispatch_type = WebInputEvent::kEventNonBlocking;
+  kEvents[0].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
   kEvents[1].PressPoint(10, 10);
   kEvents[1].MovePoint(0, 20, 20);
-  kEvents[1].dispatch_type = WebInputEvent::kEventNonBlocking;
+  kEvents[1].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
 
   // Send a non-cancelable touch move and then send it another one. The
   // second one shouldn't go out with the next rAF call and should be throttled.
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -878,8 +887,8 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputThrottlingMoves) {
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
                   CallbackReceivedState::kCalledWhileHandlingEvent, false)));
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -913,7 +922,7 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
       .Times(0);
 
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -926,12 +935,13 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
 
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   WebMouseWheelEvent mouse_wheel = SyntheticWebMouseWheelEventBuilder::Build(
       10, 10, 0, 53, 0, ui::ScrollGranularity::kScrollByPixel);
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouse_wheel, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouse_wheel,
+              blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -945,7 +955,7 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
   // Now turn off low latency mode.
   queue_->SetNeedsLowLatency(false);
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -957,8 +967,9 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
   EXPECT_EQ(0u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouse_wheel, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouse_wheel,
+              blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -974,14 +985,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   SyntheticWebTouchEvent kEvents;
   kEvents.PressPoint(10, 10);
   kEvents.touch_start_or_first_touch_move = true;
-  set_enable_fling_passive_listener_flag(true);
 
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(4);
 
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -994,12 +1005,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_TRUE(last_touch_start_forced_nonblocking_due_to_fling());
   const WebTouchEvent* last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(0)->taskAsEvent()->EventPointer());
-  kEvents.dispatch_type = WebInputEvent::kListenersForcedNonBlockingDueToFling;
+  kEvents.dispatch_type =
+      WebInputEvent::DispatchType::kListenersForcedNonBlockingDueToFling;
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.MovePoint(0, 30, 30);
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -1013,12 +1026,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_TRUE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(1)->taskAsEvent()->EventPointer());
-  kEvents.dispatch_type = WebInputEvent::kListenersForcedNonBlockingDueToFling;
+  kEvents.dispatch_type =
+      WebInputEvent::DispatchType::kListenersForcedNonBlockingDueToFling;
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.MovePoint(0, 50, 50);
   kEvents.touch_start_or_first_touch_move = false;
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1028,13 +1043,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_EQ(3u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(2)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(2)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.ReleasePoint(0);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1044,7 +1060,7 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_EQ(4u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(3)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(3)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
@@ -1054,13 +1070,12 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   SyntheticWebTouchEvent kEvents;
   kEvents.PressPoint(10, 10);
   kEvents.touch_start_or_first_touch_move = true;
-  set_enable_fling_passive_listener_flag(false);
 
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(4);
 
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1070,14 +1085,13 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(1u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(0)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   const WebTouchEvent* last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(0)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
-  set_enable_fling_passive_listener_flag(false);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1087,14 +1101,13 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(2u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(1)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(1)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
-  set_enable_fling_passive_listener_flag(true);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1104,14 +1117,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(3u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(2)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(2)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.MovePoint(0, 30, 30);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1121,7 +1134,7 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(4u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(3)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(3)->taskAsEvent()->EventPointer());
@@ -1132,13 +1145,12 @@ class MainThreadEventQueueInitializationTest
     : public testing::Test,
       public MainThreadEventQueueClient {
  public:
-  MainThreadEventQueueInitializationTest() {}
+  MainThreadEventQueueInitializationTest() = default;
 
   bool HandleInputEvent(const blink::WebCoalescedInputEvent& event,
-                        const ui::LatencyInfo& latency,
                         HandledEventCallback callback) override {
-    std::move(callback).Run(INPUT_EVENT_ACK_STATE_NOT_CONSUMED, latency,
-                            nullptr, base::nullopt);
+    std::move(callback).Run(blink::mojom::InputEventResultState::kNotConsumed,
+                            event.latency_info(), nullptr, base::nullopt);
     return true;
   }
 
@@ -1182,12 +1194,12 @@ TEST_F(MainThreadEventQueueTest, QueuingClosureWithRafEvent) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(2);
 
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   QueueClosure();
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
   EXPECT_FALSE(needs_main_frame_);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(4u, event_queue().size());
 
   EXPECT_TRUE(needs_main_frame_);
@@ -1226,10 +1238,10 @@ TEST_F(MainThreadEventQueueTest, QueuingClosuresBetweenEvents) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(2);
 
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   QueueClosure();
   QueueClosure();
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(4u, event_queue().size());
   EXPECT_FALSE(needs_main_frame_);
   main_task_runner_->RunUntilIdle();
@@ -1255,8 +1267,8 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveBecomesNonBlocking) {
   kEvents[1].SetModifiers(1);
   kEvents[1].PressPoint(10, 10);
   kEvents[1].MovePoint(0, 20, 30);
-  kEvents[1].dispatch_type = WebInputEvent::kEventNonBlocking;
-  WebTouchEvent scroll_start(WebInputEvent::kTouchScrollStarted,
+  kEvents[1].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
+  WebTouchEvent scroll_start(WebInputEvent::Type::kTouchScrollStarted,
                              WebInputEvent::kNoModifiers,
                              WebInputEvent::GetStaticTimeStampForTests());
 
@@ -1266,11 +1278,12 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveBecomesNonBlocking) {
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(3);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[0].dispatch_type);
-  EXPECT_EQ(WebInputEvent::kEventNonBlocking, kEvents[1].dispatch_type);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(scroll_start, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[0].dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kEventNonBlocking,
+            kEvents[1].dispatch_type);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(scroll_start, blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(3u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -1285,11 +1298,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveBecomesNonBlocking) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_FALSE(needs_main_frame_);
 
-  EXPECT_EQ(WebInputEvent::kEventNonBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kEventNonBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(0)->taskAsEvent()->Event())
                 .dispatch_type);
-  EXPECT_EQ(WebInputEvent::kEventNonBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kEventNonBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(1)->taskAsEvent()->Event())
                 .dispatch_type);
@@ -1301,7 +1314,7 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveWithTouchEnd) {
   kEvents[0].MovePoint(0, 20, 20);
   kEvents[1].PressPoint(10, 10);
   kEvents[1].ReleasePoint(0);
-  WebTouchEvent scroll_start(WebInputEvent::kTouchScrollStarted,
+  WebTouchEvent scroll_start(WebInputEvent::Type::kTouchScrollStarted,
                              WebInputEvent::kNoModifiers,
                              WebInputEvent::GetStaticTimeStampForTests());
 
@@ -1311,11 +1324,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveWithTouchEnd) {
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(3);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[0].dispatch_type);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[1].dispatch_type);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(scroll_start, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[0].dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[1].dispatch_type);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(scroll_start, blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(3u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -1325,11 +1338,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveWithTouchEnd) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_FALSE(needs_main_frame_);
 
-  EXPECT_EQ(WebInputEvent::kBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(0)->taskAsEvent()->Event())
                 .dispatch_type);
-  EXPECT_EQ(WebInputEvent::kBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(1)->taskAsEvent()->Event())
                 .dispatch_type);
@@ -1350,22 +1363,22 @@ TEST_F(MainThreadEventQueueTest, UnbufferedDispatchTouchEvent) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(3);
 
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[0].dispatch_type);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[1].dispatch_type);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[0].dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[1].dispatch_type);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(kEvents[2], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[2], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_FALSE(needs_low_latency_until_pointer_up());
@@ -1375,7 +1388,7 @@ TEST_F(MainThreadEventQueueTest, UnbufferedDispatchTouchEvent) {
 TEST_F(MainThreadEventQueueTest, PointerEventsCoalescing) {
   queue_->HasPointerRawUpdateEventHandlers(true);
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   SyntheticWebTouchEvent touch_move;
   touch_move.PressPoint(10, 10);
   touch_move.MovePoint(0, 50, 50);
@@ -1383,14 +1396,14 @@ TEST_F(MainThreadEventQueueTest, PointerEventsCoalescing) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(4u, event_queue().size());
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(4u, event_queue().size());
 
   main_task_runner_->RunUntilIdle();
@@ -1403,7 +1416,7 @@ TEST_F(MainThreadEventQueueTest, PointerEventsCoalescing) {
 
 TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
@@ -1412,14 +1425,14 @@ TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(0);
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
   EXPECT_FALSE(needs_main_frame_);
 
   queue_->HasPointerRawUpdateEventHandlers(true);
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
@@ -1429,14 +1442,14 @@ TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
   SyntheticWebTouchEvent touch_move;
   touch_move.PressPoint(10, 10);
   touch_move.MovePoint(0, 50, 50);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
   EXPECT_FALSE(needs_main_frame_);
 
   queue_->HasPointerRawUpdateEventHandlers(true);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
@@ -1445,11 +1458,11 @@ TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
 
 TEST_F(MainThreadEventQueueTest, UnbufferedDispatchMouseEvent) {
   WebMouseEvent mouse_down = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseDown, 10, 10, 0);
+      WebInputEvent::Type::kMouseDown, 10, 10, 0);
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
-  WebMouseEvent mouse_up =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseUp, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
+  WebMouseEvent mouse_up = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseUp, 10, 10, 0);
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
@@ -1458,21 +1471,21 @@ TEST_F(MainThreadEventQueueTest, UnbufferedDispatchMouseEvent) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(0);
 
-  HandleEvent(mouse_down, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_down, blink::mojom::InputEventResultState::kSetNonBlocking);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(mouse_up, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_up, blink::mojom::InputEventResultState::kSetNonBlocking);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
diff --git a/chromium/content/renderer/input/render_widget_input_handler.cc b/chromium/content/renderer/input/render_widget_input_handler.cc
index d62433920cf..a3ce13879aa 100644
--- a/chromium/content/renderer/input/render_widget_input_handler.cc
+++ b/chromium/content/renderer/input/render_widget_input_handler.cc
@@ -16,9 +16,7 @@
 #include "cc/paint/element_id.h"
 #include "cc/trees/latency_info_swap_promise_monitor.h"
 #include "components/viz/common/surfaces/frame_sink_id.h"
-#include "content/common/input/input_event_ack.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/render_widget_input_handler_delegate.h"
@@ -34,13 +32,13 @@
 #include "third_party/blink/public/common/input/web_mouse_wheel_event.h"
 #include "third_party/blink/public/common/input/web_pointer_event.h"
 #include "third_party/blink/public/common/input/web_touch_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 #include "third_party/blink/public/web/web_document.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_node.h"
 #include "ui/events/blink/blink_event_util.h"
-#include "ui/events/blink/event_with_callback.h"
 #include "ui/events/blink/web_input_event_traits.h"
 #include "ui/gfx/geometry/dip_util.h"
 #include "ui/gfx/geometry/point_conversions.h"
@@ -79,9 +77,7 @@ void LogInputEventLatencyUma(const WebInputEvent& event, base::TimeTicks now) {
 }
 
 void LogPassiveEventListenersUma(WebInputEventResult result,
-                                 WebInputEvent::DispatchType dispatch_type,
-                                 base::TimeTicks event_timestamp,
-                                 const ui::LatencyInfo& latency_info) {
+                                 WebInputEvent::DispatchType dispatch_type) {
   // This enum is backing a histogram. Do not remove or reorder members.
   enum ListenerEnum {
     PASSIVE_LISTENER_UMA_ENUM_PASSIVE,
@@ -96,16 +92,16 @@ void LogPassiveEventListenersUma(WebInputEventResult result,
 
   ListenerEnum enum_value;
   switch (dispatch_type) {
-    case WebInputEvent::kListenersForcedNonBlockingDueToFling:
+    case WebInputEvent::DispatchType::kListenersForcedNonBlockingDueToFling:
       enum_value = PASSIVE_LISTENER_UMA_ENUM_FORCED_NON_BLOCKING_DUE_TO_FLING;
       break;
-    case WebInputEvent::kListenersNonBlockingPassive:
+    case WebInputEvent::DispatchType::kListenersNonBlockingPassive:
       enum_value = PASSIVE_LISTENER_UMA_ENUM_PASSIVE;
       break;
-    case WebInputEvent::kEventNonBlocking:
+    case WebInputEvent::DispatchType::kEventNonBlocking:
       enum_value = PASSIVE_LISTENER_UMA_ENUM_UNCANCELABLE;
       break;
-    case WebInputEvent::kBlocking:
+    case WebInputEvent::DispatchType::kBlocking:
       if (result == WebInputEventResult::kHandledApplication)
         enum_value = PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED;
       else if (result == WebInputEventResult::kHandledSuppressed)
@@ -123,59 +119,60 @@ void LogPassiveEventListenersUma(WebInputEventResult result,
 }
 
 void LogAllPassiveEventListenersUma(const WebInputEvent& input_event,
-                                    WebInputEventResult result,
-                                    const ui::LatencyInfo& latency_info) {
+                                    WebInputEventResult result) {
   // TODO(dtapuska): Use the input_event.timeStampSeconds as the start
   // ideally this should be when the event was sent by the compositor to the
   // renderer. https://crbug.com/565348.
-  if (input_event.GetType() == WebInputEvent::kTouchStart ||
-      input_event.GetType() == WebInputEvent::kTouchMove ||
-      input_event.GetType() == WebInputEvent::kTouchEnd) {
+  if (input_event.GetType() == WebInputEvent::Type::kTouchStart ||
+      input_event.GetType() == WebInputEvent::Type::kTouchMove ||
+      input_event.GetType() == WebInputEvent::Type::kTouchEnd) {
     const WebTouchEvent& touch = static_cast<const WebTouchEvent&>(input_event);
 
-    LogPassiveEventListenersUma(result, touch.dispatch_type,
-                                input_event.TimeStamp(), latency_info);
-  } else if (input_event.GetType() == WebInputEvent::kMouseWheel) {
+    LogPassiveEventListenersUma(result, touch.dispatch_type);
+  } else if (input_event.GetType() == WebInputEvent::Type::kMouseWheel) {
     LogPassiveEventListenersUma(
         result,
-        static_cast<const WebMouseWheelEvent&>(input_event).dispatch_type,
-        input_event.TimeStamp(), latency_info);
+        static_cast<const WebMouseWheelEvent&>(input_event).dispatch_type);
   }
 }
 
 blink::WebCoalescedInputEvent GetCoalescedWebPointerEventForTouch(
     const WebPointerEvent& pointer_event,
-    blink::WebVector<const WebInputEvent*> coalesced_events,
-    blink::WebVector<const WebInputEvent*> predicted_events) {
-  blink::WebVector<WebPointerEvent> related_pointer_events;
-  for (const WebInputEvent* event : coalesced_events) {
+    const std::vector<std::unique_ptr<WebInputEvent>>& coalesced_events,
+    const std::vector<std::unique_ptr<WebInputEvent>>& predicted_events,
+    const ui::LatencyInfo& latency) {
+  std::vector<std::unique_ptr<WebInputEvent>> related_pointer_events;
+  for (const std::unique_ptr<WebInputEvent>& event : coalesced_events) {
     DCHECK(WebInputEvent::IsTouchEventType(event->GetType()));
     const WebTouchEvent& touch_event =
         static_cast<const WebTouchEvent&>(*event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
       if (touch_event.touches[i].id == pointer_event.id &&
-          touch_event.touches[i].state != WebTouchPoint::kStateStationary) {
-        related_pointer_events.emplace_back(
-            WebPointerEvent(touch_event, touch_event.touches[i]));
+          touch_event.touches[i].state !=
+              WebTouchPoint::State::kStateStationary) {
+        related_pointer_events.emplace_back(std::make_unique<WebPointerEvent>(
+            touch_event, touch_event.touches[i]));
       }
     }
   }
-  blink::WebVector<WebPointerEvent> predicted_pointer_events;
-  for (const WebInputEvent* event : predicted_events) {
+  std::vector<std::unique_ptr<WebInputEvent>> predicted_pointer_events;
+  for (const std::unique_ptr<WebInputEvent>& event : predicted_events) {
     DCHECK(WebInputEvent::IsTouchEventType(event->GetType()));
     const WebTouchEvent& touch_event =
         static_cast<const WebTouchEvent&>(*event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
       if (touch_event.touches[i].id == pointer_event.id &&
-          touch_event.touches[i].state != WebTouchPoint::kStateStationary) {
-        predicted_pointer_events.emplace_back(
-            WebPointerEvent(touch_event, touch_event.touches[i]));
+          touch_event.touches[i].state !=
+              WebTouchPoint::State::kStateStationary) {
+        predicted_pointer_events.emplace_back(std::make_unique<WebPointerEvent>(
+            touch_event, touch_event.touches[i]));
       }
     }
   }
 
-  return blink::WebCoalescedInputEvent(pointer_event, related_pointer_events,
-                                       predicted_pointer_events);
+  return blink::WebCoalescedInputEvent(
+      pointer_event.Clone(), std::move(related_pointer_events),
+      std::move(predicted_pointer_events), latency);
 }
 
 viz::FrameSinkId GetRemoteFrameSinkId(const blink::WebHitTestResult& result) {
@@ -192,10 +189,11 @@ viz::FrameSinkId GetRemoteFrameSinkId(const blink::WebHitTestResult& result) {
   return RenderFrameProxy::FromWebFrame(remote_frame)->frame_sink_id();
 }
 
-InputEventAckState GetAckResult(WebInputEventResult processed) {
+blink::mojom::InputEventResultState GetAckResult(
+    WebInputEventResult processed) {
   return processed == WebInputEventResult::kNotHandled
-             ? INPUT_EVENT_ACK_STATE_NOT_CONSUMED
-             : INPUT_EVENT_ACK_STATE_CONSUMED;
+             ? blink::mojom::InputEventResultState::kNotConsumed
+             : blink::mojom::InputEventResultState::kConsumed;
 }
 
 }  // namespace
@@ -228,7 +226,7 @@ class RenderWidgetInputHandler::HandlingState {
   // handled. If the event causes overscroll, the overscroll metadata can be
   // bundled in the event ack, saving an IPC.  Note that we must continue
   // supporting overscroll IPC notifications due to fling animation updates.
-  std::unique_ptr<ui::DidOverscrollParams> event_overscroll;
+  blink::mojom::DidOverscrollParamsPtr event_overscroll;
 
   base::Optional<cc::TouchAction> touch_action;
 
@@ -266,8 +264,7 @@ blink::WebHitTestResult RenderWidgetInputHandler::GetHitTestResultAtPoint(
     point_in_pixel = gfx::ConvertPointToPixel(
         widget_->GetOriginalScreenInfo().device_scale_factor, point_in_pixel);
   }
-  return widget_->GetWebWidget()->HitTestResultAt(
-      ToRoundedPoint(point_in_pixel));
+  return widget_->GetWebWidget()->HitTestResultAt(point_in_pixel);
 }
 
 viz::FrameSinkId RenderWidgetInputHandler::GetFrameSinkIdAtPoint(
@@ -306,26 +303,28 @@ WebInputEventResult RenderWidgetInputHandler::HandleTouchEvent(
     const blink::WebCoalescedInputEvent& coalesced_event) {
   const WebInputEvent& input_event = coalesced_event.Event();
 
-  if (input_event.GetType() == WebInputEvent::kTouchScrollStarted) {
+  if (input_event.GetType() == WebInputEvent::Type::kTouchScrollStarted) {
     WebPointerEvent pointer_event =
         WebPointerEvent::CreatePointerCausesUaActionEvent(
             blink::WebPointerProperties::PointerType::kUnknown,
             input_event.TimeStamp());
     return widget_->GetWebWidget()->HandleInputEvent(
-        blink::WebCoalescedInputEvent(pointer_event));
+        blink::WebCoalescedInputEvent(pointer_event,
+                                      coalesced_event.latency_info()));
   }
 
   const WebTouchEvent touch_event =
       static_cast<const WebTouchEvent&>(input_event);
   for (unsigned i = 0; i < touch_event.touches_length; ++i) {
     const WebTouchPoint& touch_point = touch_event.touches[i];
-    if (touch_point.state != blink::WebTouchPoint::kStateStationary) {
+    if (touch_point.state != blink::WebTouchPoint::State::kStateStationary) {
       const WebPointerEvent& pointer_event =
           WebPointerEvent(touch_event, touch_point);
       const blink::WebCoalescedInputEvent& coalesced_pointer_event =
           GetCoalescedWebPointerEventForTouch(
               pointer_event, coalesced_event.GetCoalescedEventsPointers(),
-              coalesced_event.GetPredictedEventsPointers());
+              coalesced_event.GetPredictedEventsPointers(),
+              coalesced_event.latency_info());
       widget_->GetWebWidget()->HandleInputEvent(coalesced_pointer_event);
     }
   }
@@ -334,7 +333,6 @@ WebInputEventResult RenderWidgetInputHandler::HandleTouchEvent(
 
 void RenderWidgetInputHandler::HandleInputEvent(
     const blink::WebCoalescedInputEvent& coalesced_event,
-    const ui::LatencyInfo& latency_info,
     HandledEventCallback callback) {
   const WebInputEvent& input_event = coalesced_event.Event();
 
@@ -355,14 +353,15 @@ void RenderWidgetInputHandler::HandleInputEvent(
   TRACE_EVENT1("renderer,benchmark,rail",
                "RenderWidgetInputHandler::OnHandleInputEvent", "event",
                WebInputEvent::GetName(input_event.GetType()));
+  int64_t trace_id = coalesced_event.latency_info().trace_id();
   TRACE_EVENT("input,benchmark", "LatencyInfo.Flow",
-              [&latency_info](perfetto::EventContext ctx) {
+              [trace_id](perfetto::EventContext ctx) {
                 ChromeLatencyInfo* info =
                     ctx.event()->set_chrome_latency_info();
-                info->set_trace_id(latency_info.trace_id());
+                info->set_trace_id(trace_id);
                 info->set_step(ChromeLatencyInfo::STEP_HANDLE_INPUT_EVENT_MAIN);
                 tracing::FillFlowEvent(ctx, TrackEvent::LegacyEvent::FLOW_INOUT,
-                                       latency_info.trace_id());
+                                       trace_id);
               });
 
   // If we don't have a high res timer, these metrics won't be accurate enough
@@ -370,7 +369,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
   if (!start_time.is_null())
     LogInputEventLatencyUma(input_event, start_time);
 
-  ui::LatencyInfo swap_latency_info(latency_info);
+  ui::LatencyInfo swap_latency_info(coalesced_event.latency_info());
   swap_latency_info.AddLatencyNumber(
       ui::LatencyComponentType::INPUT_EVENT_LATENCY_RENDERER_MAIN_COMPONENT);
   cc::LatencyInfoSwapPromiseMonitor swap_promise_monitor(
@@ -378,9 +377,9 @@ void RenderWidgetInputHandler::HandleInputEvent(
       nullptr);
   auto scoped_event_metrics_monitor =
       widget_->layer_tree_host()->GetScopedEventMetricsMonitor(
-          {ui::WebEventTypeToEventType(input_event.GetType()),
-           input_event.TimeStamp(),
-           ui::GetScrollInputTypeForEvent(input_event)});
+          cc::EventMetrics::Create(input_event.GetTypeAsUiEventType(),
+                                   input_event.TimeStamp(),
+                                   input_event.GetScrollInputType()));
 
   bool prevent_default = false;
   bool show_virtual_keyboard_for_mouse = false;
@@ -395,11 +394,11 @@ void RenderWidgetInputHandler::HandleInputEvent(
 
     // Reset the last known cursor if mouse has left this widget. So next
     // time that the mouse enters we always set the cursor accordingly.
-    if (mouse_event.GetType() == WebInputEvent::kMouseLeave)
+    if (mouse_event.GetType() == WebInputEvent::Type::kMouseLeave)
       current_cursor_.reset();
 
     if (mouse_event.button == WebPointerProperties::Button::kLeft &&
-        mouse_event.GetType() == WebInputEvent::kMouseUp) {
+        mouse_event.GetType() == WebInputEvent::Type::kMouseUp) {
       show_virtual_keyboard_for_mouse = true;
     }
   }
@@ -421,7 +420,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
         widget_->GetTextInputType() != ui::TEXT_INPUT_TYPE_NONE) {
       // Show the keyboard on keyup (not keydown) to match the behavior of
       // Android's TextView.
-      if (key_event.GetType() == WebInputEvent::kKeyUp)
+      if (key_event.GetType() == WebInputEvent::Type::kKeyUp)
         widget_->ShowVirtualKeyboardOnElementFocus();
       // Prevent default for both keydown and keyup (letting the keydown go
       // through to the web app would cause compatibility problems since
@@ -441,7 +440,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
   WebInputEventResult processed = prevent_default
                                       ? WebInputEventResult::kHandledSuppressed
                                       : WebInputEventResult::kNotHandled;
-  if (input_event.GetType() != WebInputEvent::kChar ||
+  if (input_event.GetType() != WebInputEvent::Type::kChar ||
       !suppress_next_char_events_) {
     suppress_next_char_events_ = false;
     if (processed == WebInputEventResult::kNotHandled &&
@@ -471,13 +470,13 @@ void RenderWidgetInputHandler::HandleInputEvent(
   // |input_event| to avoid nested monitors.
   scoped_event_metrics_monitor = nullptr;
 
-  LogAllPassiveEventListenersUma(input_event, processed, latency_info);
+  LogAllPassiveEventListenersUma(input_event, processed);
 
   // If this RawKeyDown event corresponds to a browser keyboard shortcut and
   // it's not processed by webkit, then we need to suppress the upcoming Char
   // events.
   bool is_keyboard_shortcut =
-      input_event.GetType() == WebInputEvent::kRawKeyDown &&
+      input_event.GetType() == WebInputEvent::Type::kRawKeyDown &&
       static_cast<const WebKeyboardEvent&>(input_event).is_browser_shortcut;
   if (processed == WebInputEventResult::kNotHandled && is_keyboard_shortcut)
     suppress_next_char_events_ = true;
@@ -490,17 +489,18 @@ void RenderWidgetInputHandler::HandleInputEvent(
       handling_state.injected_scroll_params->size()) {
     HandleInjectedScrollGestures(
         std::move(*handling_state.injected_scroll_params), input_event,
-        latency_info);
+        coalesced_event.latency_info());
   }
 
   // Send gesture scroll events and their dispositions to the compositor thread,
-  // so that they can be used to produce the elastic overscroll effect on Mac.
-  if (input_event.GetType() == WebInputEvent::kGestureScrollBegin ||
-      input_event.GetType() == WebInputEvent::kGestureScrollEnd ||
-      input_event.GetType() == WebInputEvent::kGestureScrollUpdate) {
+  // so that they can be used to produce the elastic overscroll effect.
+  if (input_event.GetType() == WebInputEvent::Type::kGestureScrollBegin ||
+      input_event.GetType() == WebInputEvent::Type::kGestureScrollEnd ||
+      input_event.GetType() == WebInputEvent::Type::kGestureScrollUpdate) {
     const WebGestureEvent& gesture_event =
         static_cast<const WebGestureEvent&>(input_event);
-    if (gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchpad) {
+    if (gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchpad ||
+        gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchscreen) {
       gfx::Vector2dF latest_overscroll_delta =
           handling_state.event_overscroll
               ? handling_state.event_overscroll->latest_overscroll_delta
@@ -527,7 +527,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
   // Show the virtual keyboard if enabled and a user gesture triggers a focus
   // change.
   if ((processed != WebInputEventResult::kNotHandled &&
-       input_event.GetType() == WebInputEvent::kTouchEnd) ||
+       input_event.GetType() == WebInputEvent::Type::kTouchEnd) ||
       show_virtual_keyboard_for_mouse) {
     delegate_->ShowVirtualKeyboard();
   }
@@ -541,8 +541,8 @@ void RenderWidgetInputHandler::HandleInputEvent(
 #if !defined(OS_ANDROID)
   // Virtual keyboard is not supported, so react to focus change immediately.
   if ((processed != WebInputEventResult::kNotHandled &&
-       input_event.GetType() == WebInputEvent::kMouseDown) ||
-      input_event.GetType() == WebInputEvent::kGestureTap) {
+       input_event.GetType() == WebInputEvent::Type::kMouseDown) ||
+      input_event.GetType() == WebInputEvent::Type::kGestureTap) {
     delegate_->FocusChangeComplete();
   }
 #endif
@@ -559,12 +559,9 @@ void RenderWidgetInputHandler::DidOverscrollFromBlink(
     const gfx::PointF& position,
     const gfx::Vector2dF& velocity,
     const cc::OverscrollBehavior& behavior) {
-  std::unique_ptr<DidOverscrollParams> params(new DidOverscrollParams());
-  params->accumulated_overscroll = accumulatedOverscroll;
-  params->latest_overscroll_delta = overscrollDelta;
-  params->current_fling_velocity = velocity;
-  params->causal_event_viewport_point = position;
-  params->overscroll_behavior = behavior;
+  blink::mojom::DidOverscrollParamsPtr params =
+      blink::mojom::DidOverscrollParams::New(
+          accumulatedOverscroll, overscrollDelta, velocity, position, behavior);
 
   // If we're currently handling an event, stash the overscroll data such that
   // it can be bundled in the event ack.
@@ -573,7 +570,7 @@ void RenderWidgetInputHandler::DidOverscrollFromBlink(
     return;
   }
 
-  delegate_->OnDidOverscroll(*params);
+  delegate_->OnDidOverscroll(std::move(params));
 }
 
 void RenderWidgetInputHandler::InjectGestureScrollEvent(
@@ -609,7 +606,7 @@ void RenderWidgetInputHandler::InjectGestureScrollEvent(
   } else {
     base::TimeTicks now = base::TimeTicks::Now();
     std::unique_ptr<WebGestureEvent> gesture_event =
-        ui::GenerateInjectedScrollGesture(
+        WebGestureEvent::GenerateInjectedScrollGesture(
             injected_type, now, device, gfx::PointF(0, 0), delta, granularity);
     if (injected_type == WebInputEvent::Type::kGestureScrollBegin) {
       gesture_event->data.scroll_begin.scrollable_area_element_id =
@@ -624,8 +621,9 @@ void RenderWidgetInputHandler::InjectGestureScrollEvent(
 
     widget_->GetInputEventQueue()->HandleEvent(
         std::move(web_scoped_gesture_event), latency_info,
-        DISPATCH_TYPE_NON_BLOCKING, INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
-        attribution, HandledEventCallback());
+        DISPATCH_TYPE_NON_BLOCKING,
+        blink::mojom::InputEventResultState::kNotConsumed, attribution,
+        HandledEventCallback());
   }
 }
 
@@ -683,7 +681,7 @@ void RenderWidgetInputHandler::HandleInjectedScrollGestures(
     }
 
     std::unique_ptr<WebGestureEvent> gesture_event =
-        ui::GenerateInjectedScrollGesture(
+        WebGestureEvent::GenerateInjectedScrollGesture(
             params.type, input_event.TimeStamp(), params.device, position,
             params.scroll_delta, params.granularity);
     if (params.type == WebInputEvent::Type::kGestureScrollBegin) {
@@ -700,16 +698,16 @@ void RenderWidgetInputHandler::HandleInjectedScrollGestures(
           widget_->layer_tree_host()->GetSwapPromiseManager(), nullptr);
       auto scoped_event_metrics_monitor =
           widget_->layer_tree_host()->GetScopedEventMetricsMonitor(
-              {ui::WebEventTypeToEventType(gesture_event->GetType()),
-               gesture_event->TimeStamp(),
-               ui::GetScrollInputTypeForEvent(*gesture_event)});
-      widget_->GetWebWidget()->HandleInputEvent(
-          blink::WebCoalescedInputEvent(*gesture_event));
+              cc::EventMetrics::Create(gesture_event->GetTypeAsUiEventType(),
+                                       gesture_event->TimeStamp(),
+                                       gesture_event->GetScrollInputType()));
+      widget_->GetWebWidget()->HandleInputEvent(blink::WebCoalescedInputEvent(
+          *gesture_event, scrollbar_latency_info));
     }
   }
 }
 
-bool RenderWidgetInputHandler::DidChangeCursor(const WebCursor& cursor) {
+bool RenderWidgetInputHandler::DidChangeCursor(const ui::Cursor& cursor) {
   if (current_cursor_.has_value() && current_cursor_.value() == cursor)
     return false;
   current_cursor_ = cursor;
@@ -722,7 +720,7 @@ bool RenderWidgetInputHandler::ProcessTouchAction(
     return false;
   // Ignore setTouchAction calls that result from synthetic touch events (eg.
   // when blink is emulating touch with mouse).
-  if (handling_input_state_->event_type != WebInputEvent::kTouchStart)
+  if (handling_input_state_->event_type != WebInputEvent::Type::kTouchStart)
     return false;
 
   handling_input_state_->touch_action = touch_action;
diff --git a/chromium/content/renderer/input/render_widget_input_handler.h b/chromium/content/renderer/input/render_widget_input_handler.h
index 9fe496450e9..289cb9ccc0a 100644
--- a/chromium/content/renderer/input/render_widget_input_handler.h
+++ b/chromium/content/renderer/input/render_widget_input_handler.h
@@ -9,13 +9,14 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/time/time.h"
-#include "content/common/cursors/webcursor.h"
-#include "content/common/input/input_event_ack.h"
 #include "content/common/input/input_event_dispatch_type.h"
 #include "content/renderer/input/main_thread_event_queue.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/web/web_hit_test_result.h"
+#include "ui/base/cursor/cursor.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/events/blink/did_overscroll_params.h"
 #include "ui/events/types/scroll_types.h"
@@ -55,7 +56,6 @@ class CONTENT_EXPORT RenderWidgetInputHandler {
   // Handle input events from the input event provider.
   virtual void HandleInputEvent(
       const blink::WebCoalescedInputEvent& coalesced_event,
-      const ui::LatencyInfo& latency_info,
       HandledEventCallback callback);
 
   // Handle overscroll from Blink.
@@ -82,7 +82,7 @@ class CONTENT_EXPORT RenderWidgetInputHandler {
 
   // Process the new cursor and returns true if it has changed from the last
   // cursor.
-  bool DidChangeCursor(const WebCursor& cursor);
+  bool DidChangeCursor(const ui::Cursor& cursor);
 
   // Do a hit test for a given point in viewport coordinate.
   blink::WebHitTestResult GetHitTestResultAtPoint(const gfx::PointF& point);
@@ -118,7 +118,7 @@ class CONTENT_EXPORT RenderWidgetInputHandler {
 
   // We store the current cursor object so we can avoid spamming SetCursor
   // messages.
-  base::Optional<WebCursor> current_cursor_;
+  base::Optional<ui::Cursor> current_cursor_;
 
   // Indicates if the next sequence of Char events should be suppressed or not.
   bool suppress_next_char_events_ = false;
diff --git a/chromium/content/renderer/input/render_widget_input_handler_delegate.h b/chromium/content/renderer/input/render_widget_input_handler_delegate.h
index 4491717c56e..69686ad2cf4 100644
--- a/chromium/content/renderer/input/render_widget_input_handler_delegate.h
+++ b/chromium/content/renderer/input/render_widget_input_handler_delegate.h
@@ -8,7 +8,7 @@
 #include <memory>
 
 #include "content/common/content_export.h"
-#include "content/common/input/input_event_ack.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom.h"
 #include "third_party/blink/public/platform/web_input_event_result.h"
 
 namespace blink {
@@ -43,7 +43,7 @@ class CONTENT_EXPORT RenderWidgetInputHandlerDelegate {
   virtual void OnDidHandleKeyEvent() = 0;
 
   // Notifies that an overscroll was completed from Blink.
-  virtual void OnDidOverscroll(const ui::DidOverscrollParams& params) = 0;
+  virtual void OnDidOverscroll(blink::mojom::DidOverscrollParamsPtr params) = 0;
 
   // Notifies the delegate of the |input_handler| managing it.
   virtual void SetInputHandler(RenderWidgetInputHandler* input_handler) = 0;
diff --git a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.cc b/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.cc
deleted file mode 100644
index 6968fa959cd..00000000000
--- a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.cc
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/input/scoped_web_input_event_with_latency_info.h"
-
-using blink::WebInputEvent;
-
-namespace content {
-
-ScopedWebInputEventWithLatencyInfo::ScopedWebInputEventWithLatencyInfo(
-    ui::WebScopedInputEvent event,
-    const ui::LatencyInfo& latency_info)
-    : event_(new blink::WebCoalescedInputEvent(*(event.get()))),
-      latency_(latency_info) {}
-
-ScopedWebInputEventWithLatencyInfo::~ScopedWebInputEventWithLatencyInfo() {}
-
-bool ScopedWebInputEventWithLatencyInfo::CanCoalesceWith(
-    const ScopedWebInputEventWithLatencyInfo& other) const {
-  return ui::CanCoalesce(other.event(), event());
-}
-
-void ScopedWebInputEventWithLatencyInfo::CoalesceWith(
-    const ScopedWebInputEventWithLatencyInfo& other) {
-  // |other| should be a newer event than |this|.
-  if (other.latency_.trace_id() >= 0 && latency_.trace_id() >= 0)
-    DCHECK_GT(other.latency_.trace_id(), latency_.trace_id());
-
-  // New events get coalesced into older events, and the newer timestamp
-  // should always be preserved.
-  const base::TimeTicks time_stamp = other.event().TimeStamp();
-  ui::Coalesce(other.event(), event_->EventPointer());
-  event_->EventPointer()->SetTimeStamp(time_stamp);
-  event_->AddCoalescedEvent(other.event());
-
-  // When coalescing two input events, we keep the oldest LatencyInfo
-  // since it will represent the longest latency. If it's a GestureScrollUpdate
-  // event, update the old event's last timestamp and scroll delta using the
-  // newer event's latency info.
-  if (event().GetType() == WebInputEvent::kGestureScrollUpdate)
-    latency_.CoalesceScrollUpdateWith(other.latency_);
-  other.latency_ = latency_;
-  other.latency_.set_coalesced();
-}
-
-const blink::WebInputEvent& ScopedWebInputEventWithLatencyInfo::event() const {
-  return event_->Event();
-}
-
-blink::WebInputEvent& ScopedWebInputEventWithLatencyInfo::event() {
-  return *event_->EventPointer();
-}
-
-const blink::WebCoalescedInputEvent&
-ScopedWebInputEventWithLatencyInfo::coalesced_event() const {
-  return *event_;
-}
-
-blink::WebCoalescedInputEvent&
-ScopedWebInputEventWithLatencyInfo::coalesced_event() {
-  return *event_;
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.h b/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.h
deleted file mode 100644
index a1dc3b00e09..00000000000
--- a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_SCOPED_WEB_INPUT_EVENT_WITH_LATENCY_INFO_H_
-#define CONTENT_RENDERER_SCOPED_WEB_INPUT_EVENT_WITH_LATENCY_INFO_H_
-
-#include "base/compiler_specific.h"
-#include "base/logging.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/common/input/web_gesture_event.h"
-#include "third_party/blink/public/common/input/web_mouse_wheel_event.h"
-#include "third_party/blink/public/common/input/web_touch_event.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
-#include "ui/events/blink/blink_event_util.h"
-#include "ui/events/blink/web_input_event_traits.h"
-#include "ui/latency/latency_info.h"
-
-namespace content {
-
-class ScopedWebInputEventWithLatencyInfo {
- public:
-  ScopedWebInputEventWithLatencyInfo(ui::WebScopedInputEvent,
-                                     const ui::LatencyInfo&);
-
-  ~ScopedWebInputEventWithLatencyInfo();
-
-  bool CanCoalesceWith(const ScopedWebInputEventWithLatencyInfo& other) const
-      WARN_UNUSED_RESULT;
-
-  const blink::WebInputEvent& event() const;
-  const blink::WebCoalescedInputEvent& coalesced_event() const;
-  blink::WebInputEvent& event();
-  blink::WebCoalescedInputEvent& coalesced_event();
-  const ui::LatencyInfo latencyInfo() const { return latency_; }
-
-  void CoalesceWith(const ScopedWebInputEventWithLatencyInfo& other);
-
- private:
-  blink::WebScopedCoalescedInputEvent event_;
-  mutable ui::LatencyInfo latency_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_SCOPED_WEB_INPUT_EVENT_WITH_LATENCY_INFO_H_
diff --git a/chromium/content/renderer/input/synchronous_compositor_proxy.cc b/chromium/content/renderer/input/synchronous_compositor_proxy.cc
index 83a490ff7b2..d95fa790edb 100644
--- a/chromium/content/renderer/input/synchronous_compositor_proxy.cc
+++ b/chromium/content/renderer/input/synchronous_compositor_proxy.cc
@@ -10,7 +10,6 @@
 #include "base/memory/shared_memory_mapping.h"
 #include "components/viz/common/features.h"
 #include "content/common/android/sync_compositor_statics.h"
-#include "content/common/input/sync_compositor_messages.h"
 #include "content/public/common/content_switches.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_sender.h"
@@ -23,7 +22,7 @@
 namespace content {
 
 SynchronousCompositorProxy::SynchronousCompositorProxy(
-    ui::SynchronousInputHandlerProxy* input_handler_proxy)
+    blink::SynchronousInputHandlerProxy* input_handler_proxy)
     : input_handler_proxy_(input_handler_proxy),
       use_in_process_zero_copy_software_draw_(
           base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -99,8 +98,10 @@ void SynchronousCompositorProxy::DidActivatePendingTree() {
   SendAsyncRendererStateIfNeeded();
 }
 
-void SynchronousCompositorProxy::PopulateCommonParams(
-    SyncCompositorCommonRendererParams* params) {
+mojom::SyncCompositorCommonRendererParamsPtr
+SynchronousCompositorProxy::PopulateNewCommonParams() {
+  mojom::SyncCompositorCommonRendererParamsPtr params =
+      mojom::SyncCompositorCommonRendererParams::New();
   params->version = ++version_;
   params->total_scroll_offset = total_scroll_offset_;
   params->max_scroll_offset = max_scroll_offset_;
@@ -111,36 +112,35 @@ void SynchronousCompositorProxy::PopulateCommonParams(
   params->need_invalidate_count = need_invalidate_count_;
   params->invalidate_needs_draw = invalidate_needs_draw_;
   params->did_activate_pending_tree_count = did_activate_pending_tree_count_;
+  return params;
 }
 
 void SynchronousCompositorProxy::DemandDrawHwAsync(
-    const SyncCompositorDemandDrawHwParams& params) {
+    mojom::SyncCompositorDemandDrawHwParamsPtr params) {
   DemandDrawHw(
-      params,
+      std::move(params),
       base::BindOnce(&SynchronousCompositorProxy::SendDemandDrawHwAsyncReply,
                      base::Unretained(this)));
 }
 
 void SynchronousCompositorProxy::DemandDrawHw(
-    const SyncCompositorDemandDrawHwParams& params,
+    mojom::SyncCompositorDemandDrawHwParamsPtr params,
     DemandDrawHwCallback callback) {
   invalidate_needs_draw_ = false;
   hardware_draw_reply_ = std::move(callback);
 
   if (layer_tree_frame_sink_) {
-    layer_tree_frame_sink_->DemandDrawHw(params.viewport_size,
-                                         params.viewport_rect_for_tile_priority,
-                                         params.transform_for_tile_priority);
+    layer_tree_frame_sink_->DemandDrawHw(
+        params->viewport_size, params->viewport_rect_for_tile_priority,
+        params->transform_for_tile_priority);
   }
 
   // Ensure that a response is always sent even if the reply hasn't
   // generated a compostior frame.
   if (hardware_draw_reply_) {
-    SyncCompositorCommonRendererParams common_renderer_params;
-    PopulateCommonParams(&common_renderer_params);
     // Did not swap.
     std::move(hardware_draw_reply_)
-        .Run(common_renderer_params, 0u, 0u, base::nullopt, base::nullopt);
+        .Run(PopulateNewCommonParams(), 0u, 0u, base::nullopt, base::nullopt);
   }
 }
 
@@ -173,7 +173,7 @@ void SynchronousCompositorProxy::ZeroSharedMemory() {
 }
 
 void SynchronousCompositorProxy::DemandDrawSw(
-    const SyncCompositorDemandDrawSwParams& params,
+    mojom::SyncCompositorDemandDrawSwParamsPtr params,
     DemandDrawSwCallback callback) {
   invalidate_needs_draw_ = false;
   software_draw_reply_ = std::move(callback);
@@ -184,29 +184,27 @@ void SynchronousCompositorProxy::DemandDrawSw(
       layer_tree_frame_sink_->DemandDrawSw(sk_canvas_for_draw);
     } else {
       DCHECK(!sk_canvas_for_draw);
-      DoDemandDrawSw(params);
+      DoDemandDrawSw(std::move(params));
     }
   }
 
   // Ensure that a response is always sent even if the reply hasn't
   // generated a compostior frame.
   if (software_draw_reply_) {
-    SyncCompositorCommonRendererParams common_renderer_params;
-    PopulateCommonParams(&common_renderer_params);
     // Did not swap.
     std::move(software_draw_reply_)
-        .Run(common_renderer_params, 0u, base::nullopt);
+        .Run(PopulateNewCommonParams(), 0u, base::nullopt);
   }
 }
 
 void SynchronousCompositorProxy::DoDemandDrawSw(
-    const SyncCompositorDemandDrawSwParams& params) {
+    mojom::SyncCompositorDemandDrawSwParamsPtr params) {
   DCHECK(layer_tree_frame_sink_);
   DCHECK(software_draw_shm_->zeroed);
   software_draw_shm_->zeroed = false;
 
   SkImageInfo info =
-      SkImageInfo::MakeN32Premul(params.size.width(), params.size.height());
+      SkImageInfo::MakeN32Premul(params->size.width(), params->size.height());
   size_t stride = info.minRowBytes();
   size_t buffer_size = info.computeByteSize(stride);
   DCHECK_EQ(software_draw_shm_->buffer_size, buffer_size);
@@ -217,8 +215,8 @@ void SynchronousCompositorProxy::DoDemandDrawSw(
     return;
   }
   SkCanvas canvas(bitmap);
-  canvas.clipRect(gfx::RectToSkRect(params.clip));
-  canvas.concat(SkMatrix(params.transform.matrix()));
+  canvas.clipRect(gfx::RectToSkRect(params->clip));
+  canvas.concat(SkMatrix(params->transform.matrix()));
 
   layer_tree_frame_sink_->DemandDrawSw(&canvas);
 }
@@ -229,20 +227,20 @@ void SynchronousCompositorProxy::SubmitCompositorFrame(
     base::Optional<viz::HitTestRegionList> hit_test_region_list) {
   // Verify that exactly one of these is true.
   DCHECK(hardware_draw_reply_.is_null() ^ software_draw_reply_.is_null());
-  SyncCompositorCommonRendererParams common_renderer_params;
-  PopulateCommonParams(&common_renderer_params);
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params =
+      PopulateNewCommonParams();
 
   if (hardware_draw_reply_) {
     // For viz the CF was submitted directly via CompositorFrameSink
     DCHECK(frame || viz_frame_submission_enabled_);
     std::move(hardware_draw_reply_)
-        .Run(common_renderer_params, layer_tree_frame_sink_id,
+        .Run(std::move(common_renderer_params), layer_tree_frame_sink_id,
              NextMetadataVersion(), std::move(frame),
              std::move(hit_test_region_list));
   } else if (software_draw_reply_) {
     DCHECK(frame);
     std::move(software_draw_reply_)
-        .Run(common_renderer_params, NextMetadataVersion(),
+        .Run(std::move(common_renderer_params), NextMetadataVersion(),
              std::move(frame->metadata));
   } else {
     NOTREACHED();
@@ -277,9 +275,7 @@ void SynchronousCompositorProxy::BeginFrame(
       layer_tree_frame_sink_->BeginFrame(args);
   }
 
-  SyncCompositorCommonRendererParams param;
-  PopulateCommonParams(&param);
-  SendBeginFrameResponse(param);
+  SendBeginFrameResponse(PopulateNewCommonParams());
 }
 
 void SynchronousCompositorProxy::SetScroll(
@@ -308,17 +304,20 @@ void SynchronousCompositorProxy::SetSharedMemory(
     base::WritableSharedMemoryRegion shm_region,
     SetSharedMemoryCallback callback) {
   bool success = false;
-  SyncCompositorCommonRendererParams common_renderer_params;
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params;
   if (shm_region.IsValid()) {
     base::WritableSharedMemoryMapping shm_mapping = shm_region.Map();
     if (shm_mapping.IsValid()) {
       software_draw_shm_ = std::make_unique<SharedMemoryWithSize>(
           std::move(shm_mapping), shm_mapping.size());
-      PopulateCommonParams(&common_renderer_params);
+      common_renderer_params = PopulateNewCommonParams();
       success = true;
     }
   }
-  std::move(callback).Run(success, common_renderer_params);
+  if (!common_renderer_params) {
+    common_renderer_params = mojom::SyncCompositorCommonRendererParams::New();
+  }
+  std::move(callback).Run(success, std::move(common_renderer_params));
 }
 
 void SynchronousCompositorProxy::ZoomBy(float zoom_delta,
@@ -326,9 +325,7 @@ void SynchronousCompositorProxy::ZoomBy(float zoom_delta,
                                         ZoomByCallback callback) {
   zoom_by_reply_ = std::move(callback);
   input_handler_proxy_->SynchronouslyZoomBy(zoom_delta, anchor);
-  SyncCompositorCommonRendererParams common_renderer_params;
-  PopulateCommonParams(&common_renderer_params);
-  std::move(zoom_by_reply_).Run(common_renderer_params);
+  std::move(zoom_by_reply_).Run(PopulateNewCommonParams());
 }
 
 uint32_t SynchronousCompositorProxy::NextMetadataVersion() {
@@ -336,7 +333,7 @@ uint32_t SynchronousCompositorProxy::NextMetadataVersion() {
 }
 
 void SynchronousCompositorProxy::SendDemandDrawHwAsyncReply(
-    const content::SyncCompositorCommonRendererParams&,
+    mojom::SyncCompositorCommonRendererParamsPtr,
     uint32_t layer_tree_frame_sink_id,
     uint32_t metadata_version,
     base::Optional<viz::CompositorFrame> frame,
@@ -346,17 +343,15 @@ void SynchronousCompositorProxy::SendDemandDrawHwAsyncReply(
 }
 
 void SynchronousCompositorProxy::SendBeginFrameResponse(
-    const content::SyncCompositorCommonRendererParams& param) {
-  control_host_->BeginFrameResponse(param);
+    mojom::SyncCompositorCommonRendererParamsPtr param) {
+  control_host_->BeginFrameResponse(std::move(param));
 }
 
 void SynchronousCompositorProxy::SendAsyncRendererStateIfNeeded() {
   if (hardware_draw_reply_ || software_draw_reply_ || zoom_by_reply_ || !host_)
     return;
 
-  SyncCompositorCommonRendererParams params;
-  PopulateCommonParams(&params);
-  host_->UpdateState(params);
+  host_->UpdateState(PopulateNewCommonParams());
 }
 
 void SynchronousCompositorProxy::LayerTreeFrameSinkCreated() {
diff --git a/chromium/content/renderer/input/synchronous_compositor_proxy.h b/chromium/content/renderer/input/synchronous_compositor_proxy.h
index 5dbf7cc0b00..703fb153e96 100644
--- a/chromium/content/renderer/input/synchronous_compositor_proxy.h
+++ b/chromium/content/renderer/input/synchronous_compositor_proxy.h
@@ -14,12 +14,12 @@
 #include "base/optional.h"
 #include "components/viz/common/frame_timing_details_map.h"
 #include "content/common/input/synchronous_compositor.mojom.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/renderer/android/synchronous_layer_tree_frame_sink.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "ui/events/blink/synchronous_input_handler_proxy.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
+#include "third_party/blink/public/platform/input/synchronous_input_handler_proxy.h"
 #include "ui/gfx/geometry/scroll_offset.h"
 #include "ui/gfx/geometry/size_f.h"
 
@@ -30,16 +30,13 @@ class CompositorFrame;
 namespace content {
 
 class SynchronousLayerTreeFrameSink;
-struct SyncCompositorCommonRendererParams;
-struct SyncCompositorDemandDrawHwParams;
-struct SyncCompositorDemandDrawSwParams;
 
-class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
+class SynchronousCompositorProxy : public blink::SynchronousInputHandler,
                                    public SynchronousLayerTreeFrameSinkClient,
                                    public mojom::SynchronousCompositor {
  public:
   SynchronousCompositorProxy(
-      ui::SynchronousInputHandlerProxy* input_handler_proxy);
+      blink::SynchronousInputHandlerProxy* input_handler_proxy);
   ~SynchronousCompositorProxy() override;
 
   void Init();
@@ -49,7 +46,7 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
       mojo::PendingAssociatedReceiver<mojom::SynchronousCompositor>
           compositor_request);
 
-  // ui::SynchronousInputHandler overrides.
+  // blink::SynchronousInputHandler overrides.
   void UpdateRootLayerState(const gfx::ScrollOffset& total_scroll_offset,
                             const gfx::ScrollOffset& max_scroll_offset,
                             const gfx::SizeF& scrollable_size,
@@ -69,16 +66,17 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
 
   void SetLayerTreeFrameSink(
       SynchronousLayerTreeFrameSink* layer_tree_frame_sink);
-  void PopulateCommonParams(SyncCompositorCommonRendererParams* params);
+
+  mojom::SyncCompositorCommonRendererParamsPtr PopulateNewCommonParams();
 
   // mojom::SynchronousCompositor overrides.
   void DemandDrawHwAsync(
-      const SyncCompositorDemandDrawHwParams& draw_params) final;
-  void DemandDrawHw(const SyncCompositorDemandDrawHwParams& params,
+      mojom::SyncCompositorDemandDrawHwParamsPtr draw_params) final;
+  void DemandDrawHw(mojom::SyncCompositorDemandDrawHwParamsPtr params,
                     DemandDrawHwCallback callback) final;
   void SetSharedMemory(base::WritableSharedMemoryRegion shm_region,
                        SetSharedMemoryCallback callback) final;
-  void DemandDrawSw(const SyncCompositorDemandDrawSwParams& params,
+  void DemandDrawSw(mojom::SyncCompositorDemandDrawSwParamsPtr params,
                     DemandDrawSwCallback callback) final;
   void WillSkipDraw() final;
   void ZeroSharedMemory() final;
@@ -95,10 +93,9 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
  protected:
   void SendAsyncRendererStateIfNeeded();
   void LayerTreeFrameSinkCreated();
-  void SendBeginFrameResponse(
-      const content::SyncCompositorCommonRendererParams&);
+  void SendBeginFrameResponse(mojom::SyncCompositorCommonRendererParamsPtr);
   void SendDemandDrawHwAsyncReply(
-      const content::SyncCompositorCommonRendererParams&,
+      mojom::SyncCompositorCommonRendererParamsPtr,
       uint32_t layer_tree_frame_sink_id,
       uint32_t metadata_version,
       base::Optional<viz::CompositorFrame>,
@@ -111,13 +108,13 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
   bool begin_frame_paused_ = false;
 
  private:
-  void DoDemandDrawSw(const SyncCompositorDemandDrawSwParams& params);
+  void DoDemandDrawSw(mojom::SyncCompositorDemandDrawSwParamsPtr params);
   uint32_t NextMetadataVersion();
   void HostDisconnected();
 
   struct SharedMemoryWithSize;
 
-  ui::SynchronousInputHandlerProxy* const input_handler_proxy_;
+  blink::SynchronousInputHandlerProxy* const input_handler_proxy_;
   mojo::Remote<mojom::SynchronousCompositorControlHost> control_host_;
   mojo::AssociatedRemote<mojom::SynchronousCompositorHost> host_;
   mojo::AssociatedReceiver<mojom::SynchronousCompositor> receiver_{this};
diff --git a/chromium/content/renderer/input/widget_input_handler_impl.cc b/chromium/content/renderer/input/widget_input_handler_impl.cc
index d4c6e39f25b..d27b93ea269 100644
--- a/chromium/content/renderer/input/widget_input_handler_impl.cc
+++ b/chromium/content/renderer/input/widget_input_handler_impl.cc
@@ -7,17 +7,17 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/input/ime_text_span_conversions.h"
 #include "content/common/input_messages.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/widget_input_handler_manager.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_widget.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/web/web_ime_text_span.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 
@@ -85,16 +85,11 @@ void WidgetInputHandlerImpl::MouseCaptureLost() {
       base::BindOnce(&RenderWidget::OnMouseCaptureLost, render_widget_));
 }
 
-void WidgetInputHandlerImpl::MouseLockLost() {
-  RunOnMainThread(
-      base::BindOnce(&RenderWidget::PointerLockLost, render_widget_));
-}
-
 void WidgetInputHandlerImpl::SetEditCommandsForNextKeyEvent(
-    const std::vector<EditCommand>& commands) {
+    std::vector<blink::mojom::EditCommandPtr> commands) {
   RunOnMainThread(
       base::BindOnce(&RenderWidget::OnSetEditCommandsForNextKeyEvent,
-                     render_widget_, commands));
+                     render_widget_, std::move(commands)));
 }
 
 void WidgetInputHandlerImpl::CursorVisibilityChanged(bool visible) {
@@ -102,11 +97,6 @@ void WidgetInputHandlerImpl::CursorVisibilityChanged(bool visible) {
                                  render_widget_, visible));
 }
 
-void WidgetInputHandlerImpl::FallbackCursorModeToggled(bool is_on) {
-  RunOnMainThread(base::BindOnce(&RenderWidget::OnFallbackCursorModeToggled,
-                                 render_widget_, is_on));
-}
-
 void WidgetInputHandlerImpl::ImeSetComposition(
     const base::string16& text,
     const std::vector<ui::ImeTextSpan>& ime_text_spans,
diff --git a/chromium/content/renderer/input/widget_input_handler_impl.h b/chromium/content/renderer/input/widget_input_handler_impl.h
index dd982798a5a..86d288b5967 100644
--- a/chromium/content/renderer/input/widget_input_handler_impl.h
+++ b/chromium/content/renderer/input/widget_input_handler_impl.h
@@ -37,11 +37,9 @@ class WidgetInputHandlerImpl : public mojom::WidgetInputHandler {
 
   void SetFocus(bool focused) override;
   void MouseCaptureLost() override;
-  void MouseLockLost() override;
   void SetEditCommandsForNextKeyEvent(
-      const std::vector<EditCommand>& commands) override;
+      std::vector<blink::mojom::EditCommandPtr> commands) override;
   void CursorVisibilityChanged(bool visible) override;
-  void FallbackCursorModeToggled(bool is_on) override;
   void ImeSetComposition(const base::string16& text,
                          const std::vector<ui::ImeTextSpan>& ime_text_spans,
                          const gfx::Range& range,
diff --git a/chromium/content/renderer/input/widget_input_handler_manager.cc b/chromium/content/renderer/input/widget_input_handler_manager.cc
index d06f3a92645..4c606edf453 100644
--- a/chromium/content/renderer/input/widget_input_handler_manager.cc
+++ b/chromium/content/renderer/input/widget_input_handler_manager.cc
@@ -7,20 +7,24 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "content/common/input_messages.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/widget_input_handler_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_widget.h"
+#include "services/tracing/public/cpp/perfetto/flow_event_utils.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_input_event_attribution.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "ui/events/base_event_utils.h"
+#include "ui/events/blink/blink_event_util.h"
+#include "ui/events/blink/did_overscroll_params.h"
 
 #if defined(OS_ANDROID)
 #include "content/public/common/content_client.h"
@@ -29,38 +33,57 @@
 #endif
 
 namespace content {
+
+using ::perfetto::protos::pbzero::ChromeLatencyInfo;
+using ::perfetto::protos::pbzero::TrackEvent;
+
 namespace {
+
+blink::mojom::DidOverscrollParamsPtr ToDidOverscrollParams(
+    const blink::InputHandlerProxy::DidOverscrollParams* overscroll_params) {
+  if (!overscroll_params)
+    return nullptr;
+  return blink::mojom::DidOverscrollParams::New(
+      overscroll_params->accumulated_overscroll,
+      overscroll_params->latest_overscroll_delta,
+      overscroll_params->current_fling_velocity,
+      overscroll_params->causal_event_viewport_point,
+      overscroll_params->overscroll_behavior);
+}
+
 void CallCallback(mojom::WidgetInputHandler::DispatchEventCallback callback,
-                  InputEventAckState ack_state,
+                  blink::mojom::InputEventResultState result_state,
                   const ui::LatencyInfo& latency_info,
-                  std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+                  blink::mojom::DidOverscrollParamsPtr overscroll_params,
                   base::Optional<cc::TouchAction> touch_action) {
+  ui::LatencyInfo::TraceIntermediateFlowEvents(
+      {latency_info}, ChromeLatencyInfo::STEP_HANDLED_INPUT_EVENT_IMPL);
   std::move(callback).Run(
-      InputEventAckSource::MAIN_THREAD, latency_info, ack_state,
-      overscroll_params
-          ? base::Optional<ui::DidOverscrollParams>(*overscroll_params)
-          : base::nullopt,
-      touch_action);
+      blink::mojom::InputEventResultSource::kMainThread, latency_info,
+      result_state, std::move(overscroll_params),
+      touch_action
+          ? blink::mojom::TouchActionOptional::New(touch_action.value())
+          : nullptr);
 }
 
-InputEventAckState InputEventDispositionToAck(
-    ui::InputHandlerProxy::EventDisposition disposition) {
+blink::mojom::InputEventResultState InputEventDispositionToAck(
+    blink::InputHandlerProxy::EventDisposition disposition) {
   switch (disposition) {
-    case ui::InputHandlerProxy::DID_HANDLE:
-      return INPUT_EVENT_ACK_STATE_CONSUMED;
-    case ui::InputHandlerProxy::DID_NOT_HANDLE:
-      return INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
-    case ui::InputHandlerProxy::DID_NOT_HANDLE_NON_BLOCKING_DUE_TO_FLING:
-      return INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING;
-    case ui::InputHandlerProxy::DROP_EVENT:
-      return INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
-    case ui::InputHandlerProxy::DID_HANDLE_NON_BLOCKING:
-      return INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING;
-    case ui::InputHandlerProxy::DID_HANDLE_SHOULD_BUBBLE:
-      return INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE;
+    case blink::InputHandlerProxy::DID_HANDLE:
+      return blink::mojom::InputEventResultState::kConsumed;
+    case blink::InputHandlerProxy::DID_NOT_HANDLE:
+      return blink::mojom::InputEventResultState::kNotConsumed;
+    case blink::InputHandlerProxy::DID_NOT_HANDLE_NON_BLOCKING_DUE_TO_FLING:
+      return blink::mojom::InputEventResultState::kSetNonBlockingDueToFling;
+    case blink::InputHandlerProxy::DROP_EVENT:
+      return blink::mojom::InputEventResultState::kNoConsumerExists;
+    case blink::InputHandlerProxy::DID_HANDLE_NON_BLOCKING:
+      return blink::mojom::InputEventResultState::kSetNonBlocking;
+    case blink::InputHandlerProxy::DID_HANDLE_SHOULD_BUBBLE:
+      return blink::mojom::InputEventResultState::kConsumedShouldBubble;
   }
   NOTREACHED();
-  return INPUT_EVENT_ACK_STATE_UNKNOWN;
+  return blink::mojom::InputEventResultState::kUnknown;
 }
 
 }  // namespace
@@ -79,7 +102,7 @@ class SynchronousCompositorProxyRegistry
     DCHECK(!proxy_);
   }
 
-  void CreateProxy(ui::SynchronousInputHandlerProxy* handler) {
+  void CreateProxy(blink::SynchronousInputHandlerProxy* handler) {
     DCHECK(compositor_task_runner_->BelongsToCurrentThread());
     proxy_ = std::make_unique<SynchronousCompositorProxy>(handler);
     proxy_->Init();
@@ -133,6 +156,12 @@ scoped_refptr<WidgetInputHandlerManager> WidgetInputHandlerManager::Create(
   if (uses_input_handler)
     manager->InitInputHandler();
 
+  // A compositor thread implies we're using an input handler.
+  DCHECK(!manager->compositor_task_runner_ || uses_input_handler);
+  // Conversely, if we don't use an input handler we must not have a compositor
+  // thread.
+  DCHECK(uses_input_handler || !manager->compositor_task_runner_);
+
   return manager;
 }
 
@@ -218,10 +247,10 @@ void WidgetInputHandlerManager::DispatchNonBlockingEventToMainThread(
     const ui::LatencyInfo& latency_info,
     const blink::WebInputEventAttribution& attribution) {
   DCHECK(input_event_queue_);
-  input_event_queue_->HandleEvent(std::move(event), latency_info,
-                                  DISPATCH_TYPE_NON_BLOCKING,
-                                  INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
-                                  attribution, HandledEventCallback());
+  input_event_queue_->HandleEvent(
+      std::move(event), latency_info, DISPATCH_TYPE_NON_BLOCKING,
+      blink::mojom::InputEventResultState::kSetNonBlocking, attribution,
+      HandledEventCallback());
 }
 
 void WidgetInputHandlerManager::FindScrollTargetOnMainThread(
@@ -236,24 +265,6 @@ void WidgetInputHandlerManager::FindScrollTargetOnMainThread(
       FROM_HERE, base::BindOnce(std::move(callback), element_id));
 }
 
-void WidgetInputHandlerManager::DidOverscroll(
-    const gfx::Vector2dF& accumulated_overscroll,
-    const gfx::Vector2dF& latest_overscroll_delta,
-    const gfx::Vector2dF& current_fling_velocity,
-    const gfx::PointF& causal_event_viewport_point,
-    const cc::OverscrollBehavior& overscroll_behavior) {
-  mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost();
-  if (!host)
-    return;
-  ui::DidOverscrollParams params;
-  params.accumulated_overscroll = accumulated_overscroll;
-  params.latest_overscroll_delta = latest_overscroll_delta;
-  params.current_fling_velocity = current_fling_velocity;
-  params.causal_event_viewport_point = causal_event_viewport_point;
-  params.overscroll_behavior = overscroll_behavior;
-  host->DidOverscroll(params);
-}
-
 void WidgetInputHandlerManager::DidAnimateForInput() {
   main_thread_scheduler_->DidAnimateForInputOnCompositorThread();
 }
@@ -268,7 +279,8 @@ void WidgetInputHandlerManager::DidStartScrollingViewport() {
 void WidgetInputHandlerManager::GenerateScrollBeginAndSendToMainThread(
     const blink::WebGestureEvent& update_event,
     const blink::WebInputEventAttribution& attribution) {
-  DCHECK_EQ(update_event.GetType(), blink::WebInputEvent::kGestureScrollUpdate);
+  DCHECK_EQ(update_event.GetType(),
+            blink::WebInputEvent::Type::kGestureScrollUpdate);
   blink::WebGestureEvent scroll_begin =
       ui::ScrollBeginFromScrollUpdate(update_event);
 
@@ -279,17 +291,8 @@ void WidgetInputHandlerManager::GenerateScrollBeginAndSendToMainThread(
 void WidgetInputHandlerManager::SetWhiteListedTouchAction(
     cc::TouchAction touch_action,
     uint32_t unique_touch_event_id,
-    ui::InputHandlerProxy::EventDisposition event_disposition) {
-  if (base::FeatureList::IsEnabled(features::kCompositorTouchAction)) {
-    white_listed_touch_action_ = touch_action;
-    return;
-  }
-  mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost();
-  if (!host)
-    return;
-  InputEventAckState ack_state = InputEventDispositionToAck(event_disposition);
-  host->SetWhiteListedTouchAction(touch_action, unique_touch_event_id,
-                                  ack_state);
+    blink::InputHandlerProxy::EventDisposition event_disposition) {
+  white_listed_touch_action_ = touch_action;
 }
 
 void WidgetInputHandlerManager::ProcessTouchAction(
@@ -357,8 +360,8 @@ void WidgetInputHandlerManager::DispatchEvent(
     // handled.
     if (callback) {
       std::move(callback).Run(
-          InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-          INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt, base::nullopt);
+          blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+          blink::mojom::InputEventResultState::kNotConsumed, nullptr, nullptr);
     }
     return;
   }
@@ -381,8 +384,8 @@ void WidgetInputHandlerManager::DispatchEvent(
   if (renderer_deferral_state_ && !allow_pre_commit_input_ && !event_is_move) {
     if (callback) {
       std::move(callback).Run(
-          InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-          INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt, base::nullopt);
+          blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+          blink::mojom::InputEventResultState::kNotConsumed, nullptr, nullptr);
     }
     return;
   }
@@ -399,19 +402,29 @@ void WidgetInputHandlerManager::DispatchEvent(
     if (!input_handler_proxy_) {
       if (callback) {
         std::move(callback).Run(
-            InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-            INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt, base::nullopt);
+            blink::mojom::InputEventResultSource::kMainThread,
+            ui::LatencyInfo(),
+            blink::mojom::InputEventResultState::kNotConsumed, nullptr,
+            nullptr);
       }
       return;
     }
+
+    // The InputHandlerProxy will be the first to try handing the event on the
+    // compositor thread. It will respond to this class by calling
+    // DidHandleInputEventSentToCompositor with the result of its attempt. Based
+    // on the resulting disposition, DidHandleInputEventSentToCompositor will
+    // either ACK the event as handled to the browser or forward it to the main
+    // thread.
     input_handler_proxy_->HandleInputEventWithLatencyInfo(
         std::move(event->web_event), event->latency_info,
         base::BindOnce(
-            &WidgetInputHandlerManager::DidHandleInputEventAndOverscroll, this,
-            std::move(callback)));
+            &WidgetInputHandlerManager::DidHandleInputEventSentToCompositor,
+            this, std::move(callback)));
   } else {
-    HandleInputEvent(std::move(event->web_event), event->latency_info,
-                     std::move(callback));
+    DCHECK(!input_handler_proxy_);
+    DispatchDirectlyToWidget(std::move(event->web_event), event->latency_info,
+                             std::move(callback));
   }
 }
 
@@ -485,24 +498,6 @@ void WidgetInputHandlerManager::WaitForInputProcessed(
       base::BindOnce(&WaitForInputProcessedFromMain, render_widget_));
 }
 
-void WidgetInputHandlerManager::FallbackCursorModeLockCursor(bool left,
-                                                             bool right,
-                                                             bool up,
-                                                             bool down) {
-#if defined(OS_ANDROID)
-  if (mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost())
-    host->FallbackCursorModeLockCursor(left, right, up, down);
-#endif
-}
-
-void WidgetInputHandlerManager::FallbackCursorModeSetCursorVisibility(
-    bool visible) {
-#if defined(OS_ANDROID)
-  if (mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost())
-    host->FallbackCursorModeSetCursorVisibility(visible);
-#endif
-}
-
 void WidgetInputHandlerManager::DidNavigate() {
   renderer_deferral_state_ = 0;
   have_emitted_uma_ = false;
@@ -532,6 +527,7 @@ void WidgetInputHandlerManager::InitOnInputHandlingThread(
     const base::WeakPtr<cc::InputHandler>& input_handler,
     bool sync_compositing) {
   DCHECK(InputThreadTaskRunner()->BelongsToCurrentThread());
+  DCHECK(uses_input_handler_);
 
   // It is possible that the input_handle has already been destroyed before this
   // Init() call was invoked. If so, early out.
@@ -542,7 +538,7 @@ void WidgetInputHandlerManager::InitOnInputHandlingThread(
   // to go through the main thread.
   bool force_input_handling_on_main = !compositor_task_runner_;
 
-  input_handler_proxy_ = std::make_unique<ui::InputHandlerProxy>(
+  input_handler_proxy_ = std::make_unique<blink::InputHandlerProxy>(
       input_handler.get(), this, force_input_handling_on_main);
 
 #if defined(OS_ANDROID)
@@ -577,41 +573,53 @@ void WidgetInputHandlerManager::BindChannel(
   handler->SetReceiver(std::move(receiver));
 }
 
-void WidgetInputHandlerManager::HandleInputEvent(
+void WidgetInputHandlerManager::DispatchDirectlyToWidget(
     const ui::WebScopedInputEvent& event,
     const ui::LatencyInfo& latency,
     mojom::WidgetInputHandler::DispatchEventCallback callback) {
+  // This path should only be taken by non-frame RenderWidgets that don't use a
+  // compositor (e.g. popups, plugins). Events bounds for a frame RenderWidget
+  // must be passed through the InputHandlerProxy first.
+  DCHECK(!uses_input_handler_);
+
   // Input messages must not be processed if the RenderWidget was destroyed or
   // was just recreated for a provisional frame.
   if (!render_widget_ || render_widget_->IsForProvisionalFrame()) {
     if (callback) {
-      std::move(callback).Run(InputEventAckSource::MAIN_THREAD, latency,
-                              INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt,
-                              base::nullopt);
+      std::move(callback).Run(
+          blink::mojom::InputEventResultSource::kMainThread, latency,
+          blink::mojom::InputEventResultState::kNotConsumed, nullptr, nullptr);
     }
     return;
   }
-  auto send_callback = base::BindOnce(
-      &WidgetInputHandlerManager::HandledInputEvent, this, std::move(callback));
 
-  blink::WebCoalescedInputEvent coalesced_event(*event);
-  render_widget_->HandleInputEvent(coalesced_event, latency,
-                                   std::move(send_callback));
+  auto send_callback =
+      base::BindOnce(&WidgetInputHandlerManager::DidHandleInputEventSentToMain,
+                     this, std::move(callback));
+
+  blink::WebCoalescedInputEvent coalesced_event(*event, latency);
+  render_widget_->HandleInputEvent(coalesced_event, std::move(send_callback));
 }
 
-void WidgetInputHandlerManager::DidHandleInputEventAndOverscroll(
+void WidgetInputHandlerManager::DidHandleInputEventSentToCompositor(
     mojom::WidgetInputHandler::DispatchEventCallback callback,
-    ui::InputHandlerProxy::EventDisposition event_disposition,
+    blink::InputHandlerProxy::EventDisposition event_disposition,
     ui::WebScopedInputEvent input_event,
     const ui::LatencyInfo& latency_info,
-    std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+    std::unique_ptr<blink::InputHandlerProxy::DidOverscrollParams>
+        overscroll_params,
     const blink::WebInputEventAttribution& attribution) {
   TRACE_EVENT1("input",
-               "WidgetInputHandlerManager::DidHandleInputEventAndOverscroll",
+               "WidgetInputHandlerManager::DidHandleInputEventSentToCompositor",
                "Disposition", event_disposition);
+  DCHECK(InputThreadTaskRunner()->BelongsToCurrentThread());
+
+  ui::LatencyInfo::TraceIntermediateFlowEvents(
+      {latency_info}, ChromeLatencyInfo::STEP_DID_HANDLE_INPUT_AND_OVERSCROLL);
 
-  InputEventAckState ack_state = InputEventDispositionToAck(event_disposition);
-  if (ack_state == INPUT_EVENT_ACK_STATE_CONSUMED) {
+  blink::mojom::InputEventResultState ack_state =
+      InputEventDispositionToAck(event_disposition);
+  if (ack_state == blink::mojom::InputEventResultState::kConsumed) {
     main_thread_scheduler_->DidHandleInputEventOnCompositorThread(
         *input_event, blink::scheduler::WebThreadScheduler::InputEventState::
                           EVENT_CONSUMED_BY_COMPOSITOR);
@@ -621,17 +629,18 @@ void WidgetInputHandlerManager::DidHandleInputEventAndOverscroll(
                           EVENT_FORWARDED_TO_MAIN_THREAD);
   }
 
-  if (ack_state == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING ||
-      ack_state == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING ||
-      ack_state == INPUT_EVENT_ACK_STATE_NOT_CONSUMED) {
+  if (ack_state == blink::mojom::InputEventResultState::kSetNonBlocking ||
+      ack_state ==
+          blink::mojom::InputEventResultState::kSetNonBlockingDueToFling ||
+      ack_state == blink::mojom::InputEventResultState::kNotConsumed) {
     DCHECK(!overscroll_params);
     DCHECK(!latency_info.coalesced());
     InputEventDispatchType dispatch_type = callback.is_null()
                                                ? DISPATCH_TYPE_NON_BLOCKING
                                                : DISPATCH_TYPE_BLOCKING;
-    HandledEventCallback handled_event =
-        base::BindOnce(&WidgetInputHandlerManager::HandledInputEvent, this,
-                       std::move(callback));
+    HandledEventCallback handled_event = base::BindOnce(
+        &WidgetInputHandlerManager::DidHandleInputEventSentToMain, this,
+        std::move(callback));
     input_event_queue_->HandleEvent(std::move(input_event), latency_info,
                                     dispatch_type, ack_state, attribution,
                                     std::move(handled_event));
@@ -639,27 +648,29 @@ void WidgetInputHandlerManager::DidHandleInputEventAndOverscroll(
   }
   if (callback) {
     std::move(callback).Run(
-        InputEventAckSource::COMPOSITOR_THREAD, latency_info, ack_state,
-        overscroll_params
-            ? base::Optional<ui::DidOverscrollParams>(*overscroll_params)
-            : base::nullopt,
-        base::nullopt);
+        blink::mojom::InputEventResultSource::kCompositorThread, latency_info,
+        ack_state, ToDidOverscrollParams(overscroll_params.get()), nullptr);
   }
 }
 
-void WidgetInputHandlerManager::HandledInputEvent(
+void WidgetInputHandlerManager::DidHandleInputEventSentToMain(
     mojom::WidgetInputHandler::DispatchEventCallback callback,
-    InputEventAckState ack_state,
+    blink::mojom::InputEventResultState ack_state,
     const ui::LatencyInfo& latency_info,
-    std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+    blink::mojom::DidOverscrollParamsPtr overscroll_params,
     base::Optional<cc::TouchAction> touch_action) {
   if (!callback)
     return;
 
-  TRACE_EVENT1("input", "WidgetInputHandlerManager::HandledInputEvent",
+  TRACE_EVENT1("input",
+               "WidgetInputHandlerManager::DidHandleInputEventSentToMain",
                "ack_state", ack_state);
+  ui::LatencyInfo::TraceIntermediateFlowEvents(
+      {latency_info}, ChromeLatencyInfo::STEP_HANDLED_INPUT_EVENT_MAIN_OR_IMPL);
 
   if (!touch_action.has_value()) {
+    TRACE_EVENT_INSTANT0("input", "Using white_listed_touch_action",
+                         TRACE_EVENT_SCOPE_THREAD);
     touch_action = white_listed_touch_action_;
     white_listed_touch_action_.reset();
   }
@@ -679,13 +690,13 @@ void WidgetInputHandlerManager::HandledInputEvent(
   } else {
     // Otherwise call the callback immediately.
     std::move(callback).Run(
-        is_compositor_thread ? InputEventAckSource::COMPOSITOR_THREAD
-                             : InputEventAckSource::MAIN_THREAD,
-        latency_info, ack_state,
-        overscroll_params
-            ? base::Optional<ui::DidOverscrollParams>(*overscroll_params)
-            : base::nullopt,
-        touch_action);
+        is_compositor_thread
+            ? blink::mojom::InputEventResultSource::kCompositorThread
+            : blink::mojom::InputEventResultSource::kMainThread,
+        latency_info, ack_state, std::move(overscroll_params),
+        touch_action
+            ? blink::mojom::TouchActionOptional::New(touch_action.value())
+            : nullptr);
   }
 }
 
@@ -694,8 +705,8 @@ void WidgetInputHandlerManager::ObserveGestureEventOnInputHandlingThread(
     const cc::InputHandlerScrollResult& scroll_result) {
   if (!input_handler_proxy_)
     return;
-  DCHECK(input_handler_proxy_->scroll_elasticity_controller());
-  input_handler_proxy_->scroll_elasticity_controller()
+  DCHECK(input_handler_proxy_->elastic_overscroll_controller());
+  input_handler_proxy_->elastic_overscroll_controller()
       ->ObserveGestureEventAndResult(gesture_event, scroll_result);
 }
 
diff --git a/chromium/content/renderer/input/widget_input_handler_manager.h b/chromium/content/renderer/input/widget_input_handler_manager.h
index dc109d9a1be..d5d95972da8 100644
--- a/chromium/content/renderer/input/widget_input_handler_manager.h
+++ b/chromium/content/renderer/input/widget_input_handler_manager.h
@@ -14,8 +14,8 @@
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/shared_remote.h"
-#include "ui/events/blink/input_handler_proxy.h"
-#include "ui/events/blink/input_handler_proxy_client.h"
+#include "third_party/blink/public/platform/input/input_handler_proxy.h"
+#include "third_party/blink/public/platform/input/input_handler_proxy_client.h"
 
 namespace blink {
 class WebInputEventAttribution;
@@ -38,7 +38,7 @@ class SynchronousCompositorProxyRegistry;
 // The lifecycle of this object matches that of the RenderWidget.
 class CONTENT_EXPORT WidgetInputHandlerManager final
     : public base::RefCountedThreadSafe<WidgetInputHandlerManager>,
-      public ui::InputHandlerProxyClient,
+      public blink::InputHandlerProxyClient,
       public base::SupportsWeakPtr<WidgetInputHandlerManager> {
   // Used in UMA metrics reporting. Do not re-order, and rename the metric if
   // additional states are required.
@@ -81,12 +81,6 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
       const ui::LatencyInfo& latency_info,
       const blink::WebInputEventAttribution& attribution) override;
 
-  void DidOverscroll(
-      const gfx::Vector2dF& accumulated_overscroll,
-      const gfx::Vector2dF& latest_overscroll_delta,
-      const gfx::Vector2dF& current_fling_velocity,
-      const gfx::PointF& causal_event_viewport_point,
-      const cc::OverscrollBehavior& overscroll_behavior) override;
   void DidAnimateForInput() override;
   void DidStartScrollingViewport() override;
   void GenerateScrollBeginAndSendToMainThread(
@@ -95,7 +89,7 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   void SetWhiteListedTouchAction(
       cc::TouchAction touch_action,
       uint32_t unique_touch_event_id,
-      ui::InputHandlerProxy::EventDisposition event_disposition) override;
+      blink::InputHandlerProxy::EventDisposition event_disposition) override;
 
   void ObserveGestureEventOnMainThread(
       const blink::WebGestureEvent& gesture_event,
@@ -122,9 +116,6 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   void InputWasProcessed(const gfx::PresentationFeedback& feedback);
   void WaitForInputProcessed(base::OnceClosure callback);
 
-  void FallbackCursorModeLockCursor(bool left, bool right, bool up, bool down);
-  void FallbackCursorModeSetCursorVisibility(bool visible);
-
   // Called when the RenderWidget is notified of a navigation. Resets
   // the renderer pipeline deferral status, and resets the UMA recorder for
   // time of first input.
@@ -165,23 +156,45 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   void BindAssociatedChannel(
       mojo::PendingAssociatedReceiver<mojom::WidgetInputHandler> receiver);
   void BindChannel(mojo::PendingReceiver<mojom::WidgetInputHandler> receiver);
-  void HandleInputEvent(
+
+  // This method skips the input handler proxy and sends the event directly to
+  // the RenderWidget (main thread). Should only be used by non-frame
+  // RenderWidgets that don't use a compositor (e.g. popups, plugins). Events
+  // for a frame RenderWidget should always be passed through the
+  // InputHandlerProxy by calling DispatchEvent which will re-route to the main
+  // thread if needed.
+  void DispatchDirectlyToWidget(
       const ui::WebScopedInputEvent& event,
       const ui::LatencyInfo& latency,
       mojom::WidgetInputHandler::DispatchEventCallback callback);
-  void DidHandleInputEventAndOverscroll(
+
+  // This method is the callback used by the compositor input handler to
+  // communicate back whether the event was successfully handled on the
+  // compositor thread or whether it needs to forwarded to the main thread.
+  // This method is responsible for passing the event on to the main thread or
+  // replying to the browser that the event was handled. This is always called
+  // on the input handling thread (i.e. if a compositor thread exists, it'll be
+  // called from it).
+  void DidHandleInputEventSentToCompositor(
       mojom::WidgetInputHandler::DispatchEventCallback callback,
-      ui::InputHandlerProxy::EventDisposition event_disposition,
+      blink::InputHandlerProxy::EventDisposition event_disposition,
       ui::WebScopedInputEvent input_event,
       const ui::LatencyInfo& latency_info,
-      std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+      std::unique_ptr<blink::InputHandlerProxy::DidOverscrollParams>
+          overscroll_params,
       const blink::WebInputEventAttribution& attribution);
-  void HandledInputEvent(
+
+  // Similar to the above; this is used by the main thread input handler to
+  // communicate back the result of handling the event. Note: this may be
+  // called on either thread as non-blocking events sent to the main thread
+  // will be ACKed immediately when added to the main thread event queue.
+  void DidHandleInputEventSentToMain(
       mojom::WidgetInputHandler::DispatchEventCallback callback,
-      InputEventAckState ack_state,
+      blink::mojom::InputEventResultState ack_state,
       const ui::LatencyInfo& latency_info,
-      std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+      blink::mojom::DidOverscrollParamsPtr overscroll_params,
       base::Optional<cc::TouchAction> touch_action);
+
   void ObserveGestureEventOnInputHandlingThread(
       const blink::WebGestureEvent& gesture_event,
       const cc::InputHandlerScrollResult& scroll_result);
@@ -199,7 +212,7 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
 
   // InputHandlerProxy is only interacted with on the compositor
   // thread.
-  std::unique_ptr<ui::InputHandlerProxy> input_handler_proxy_;
+  std::unique_ptr<blink::InputHandlerProxy> input_handler_proxy_;
 
   // The WidgetInputHandlerHost is bound on the compositor task runner
   // but class can be called on the compositor and main thread.
@@ -222,7 +235,10 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   base::OnceClosure input_processed_callback_;
 
   // Whether this widget uses an InputHandler or forwards all input to the
-  // WebWidget (Popups, Plugins).
+  // WebWidget (Popups, Plugins). This is always true if we have a compositor
+  // thread; however, we can use an input handler if we don't have a compositor
+  // thread (e.g. in tests). Conversely, if we're not using an input handler,
+  // we definitely don't have a compositor thread.
   bool uses_input_handler_ = false;
 
   // State tracking which parts of the rendering pipeline are currently
@@ -246,8 +262,10 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
 
   // Control of UMA. We emit one UMA metric per navigation telling us
   // whether any non-move input arrived before we starting updating the page or
-  // displaying content to the user.
-  bool have_emitted_uma_ = false;
+  // displaying content to the user. It must be atomic because navigation can
+  // occur on the renderer thread (resetting this) coincident with the UMA
+  // being sent on the compositor thread.
+  std::atomic<bool> have_emitted_uma_{false};
 
 #if defined(OS_ANDROID)
   std::unique_ptr<SynchronousCompositorProxyRegistry>
diff --git a/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc b/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
index d4250987af2..efbe934eedb 100644
--- a/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
+++ b/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
@@ -9,7 +9,7 @@
 #include <utility>
 #include <vector>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
 #include "url/gurl.h"
@@ -31,18 +31,21 @@ class URLLoaderRelay : public network::mojom::URLLoaderClient,
         client_sink_(std::move(client_sink)) {}
 
   // network::mojom::URLLoader implementation:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_request_headers,
-                      const base::Optional<GURL>& new_url) override {
-    DCHECK(removed_headers.empty() && modified_request_headers.IsEmpty())
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_request_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_request_headers,
+      const base::Optional<GURL>& new_url) override {
+    DCHECK(removed_headers.empty() && modified_request_headers.IsEmpty() &&
+           modified_cors_exempt_request_headers.IsEmpty())
         << "Redirect with removed or modified headers was not supported yet. "
            "crbug.com/845683";
     DCHECK(!new_url.has_value())
         << "Redirect with modified URL was not supported yet. "
            "crbug.com/845683";
-    loader_sink_->FollowRedirect({} /* removed_headers */,
-                                 {} /* modified_headers */,
-                                 base::nullopt /* new_url */);
+    loader_sink_->FollowRedirect(
+        {} /* removed_headers */, {} /* modified_headers */,
+        {} /* modified_cors_exempt_headers */, base::nullopt /* new_url */);
   }
 
   void SetPriority(net::RequestPriority priority,
diff --git a/chromium/content/renderer/loader/request_extra_data.cc b/chromium/content/renderer/loader/request_extra_data.cc
index 690d8e9915e..90e0f6bc6a6 100644
--- a/chromium/content/renderer/loader/request_extra_data.cc
+++ b/chromium/content/renderer/loader/request_extra_data.cc
@@ -21,7 +21,7 @@ void RequestExtraData::CopyToResourceRequest(
   request->transition_type = transition_type_;
   request->originated_from_service_worker = originated_from_service_worker_;
 
-  request->attach_same_site_cookies = attach_same_site_cookies_;
+  request->force_ignore_site_for_cookies = force_ignore_site_for_cookies_;
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/loader/resource_dispatcher.cc b/chromium/content/renderer/loader/resource_dispatcher.cc
index 1e145c72e95..4f6b3a9ce1c 100644
--- a/chromium/content/renderer/loader/resource_dispatcher.cc
+++ b/chromium/content/renderer/loader/resource_dispatcher.cc
@@ -43,6 +43,7 @@
 #include "services/network/public/cpp/url_loader_completion_status.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
+#include "third_party/blink/public/common/client_hints/client_hints.h"
 #include "third_party/blink/public/common/loader/resource_type_util.h"
 #include "third_party/blink/public/common/loader/throttling_url_loader.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
@@ -221,13 +222,18 @@ void ResourceDispatcher::OnReceivedRedirect(
                                     redirect_info.new_url);
 
   ToLocalURLResponseHead(*request_info, *response_head);
-  if (request_info->peer->OnReceivedRedirect(redirect_info,
-                                             response_head.Clone())) {
+  std::vector<std::string> removed_headers;
+  if (request_info->peer->OnReceivedRedirect(
+          redirect_info, response_head.Clone(), &removed_headers)) {
     // Double-check if the request is still around. The call above could
     // potentially remove it.
     request_info = GetPendingRequestInfo(request_id);
     if (!request_info)
       return;
+    // TODO(yoav): If request_info doesn't change above, we could avoid this
+    // copy.
+    request_info->removed_headers = removed_headers;
+
     request_info->response_url = redirect_info.new_url;
     request_info->has_pending_redirect = true;
     NotifyResourceRedirectReceived(request_info->render_frame_id,
@@ -252,8 +258,9 @@ void ResourceDispatcher::FollowPendingRedirect(
     if (request_info->redirect_requires_loader_restart) {
       request_info->url_loader->FollowRedirectForcingRestart();
     } else {
-      request_info->url_loader->FollowRedirect({} /* removed_headers */,
-                                               {} /* modified_headers */);
+      request_info->url_loader->FollowRedirect(
+          request_info->removed_headers, {} /* modified_headers */,
+          {} /* modified_cors_exempt_headers */);
     }
   }
 }
@@ -468,8 +475,9 @@ void ResourceDispatcher::StartSync(
 
   while (response->context_for_redirect) {
     DCHECK(response->redirect_info);
-    bool follow_redirect = peer->OnReceivedRedirect(*response->redirect_info,
-                                                    response->head.Clone());
+    bool follow_redirect = peer->OnReceivedRedirect(
+        *response->redirect_info, response->head.Clone(),
+        nullptr /* removed_headers */);
     redirect_or_response_event.Reset();
     if (follow_redirect) {
       task_runner->PostTask(
diff --git a/chromium/content/renderer/loader/resource_dispatcher.h b/chromium/content/renderer/loader/resource_dispatcher.h
index 1158c63433c..949cc1ecdfa 100644
--- a/chromium/content/renderer/loader/resource_dispatcher.h
+++ b/chromium/content/renderer/loader/resource_dispatcher.h
@@ -213,6 +213,9 @@ class CONTENT_EXPORT ResourceDispatcher {
     // For mojo loading.
     std::unique_ptr<blink::ThrottlingURLLoader> url_loader;
     std::unique_ptr<URLLoaderClientImpl> url_loader_client;
+
+    // The Client Hints headers that need to be removed from a redirect.
+    std::vector<std::string> removed_headers;
   };
   using PendingRequestMap = std::map<int, std::unique_ptr<PendingRequestInfo>>;
 
diff --git a/chromium/content/renderer/loader/resource_dispatcher_unittest.cc b/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
index eb5e8f042a5..12b48703417 100644
--- a/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
+++ b/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
@@ -200,7 +200,8 @@ class TestResourceDispatcherDelegate : public ResourceDispatcherDelegate {
     void OnUploadProgress(uint64_t position, uint64_t size) override {}
 
     bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                            network::mojom::URLResponseHeadPtr head) override {
+                            network::mojom::URLResponseHeadPtr head,
+                            std::vector<std::string>*) override {
       return false;
     }
 
diff --git a/chromium/content/renderer/loader/sync_load_context.cc b/chromium/content/renderer/loader/sync_load_context.cc
index 3145b378699..ba16da6106d 100644
--- a/chromium/content/renderer/loader/sync_load_context.cc
+++ b/chromium/content/renderer/loader/sync_load_context.cc
@@ -7,7 +7,7 @@
 #include <string>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/memory/ptr_util.h"
 #include "base/optional.h"
 #include "base/synchronization/waitable_event.h"
@@ -18,6 +18,7 @@
 #include "net/url_request/redirect_info.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
+#include "third_party/blink/public/common/client_hints/client_hints.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 
 namespace content {
@@ -149,8 +150,16 @@ void SyncLoadContext::OnUploadProgress(uint64_t position, uint64_t size) {}
 
 bool SyncLoadContext::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>* removed_headers) {
   DCHECK(!Completed());
+  if (removed_headers) {
+    // TODO(yoav): Get the actual FeaturePolicy here to support selective
+    // removal for sync XHR.
+    blink::FindClientHintsToRemove(nullptr /* feature_policy */,
+                                   redirect_info.new_url, removed_headers);
+  }
+
   response_->url = redirect_info.new_url;
   response_->head = std::move(head);
   response_->redirect_info = redirect_info;
diff --git a/chromium/content/renderer/loader/sync_load_context.h b/chromium/content/renderer/loader/sync_load_context.h
index 0c82bdaf485..f7565e5dab0 100644
--- a/chromium/content/renderer/loader/sync_load_context.h
+++ b/chromium/content/renderer/loader/sync_load_context.h
@@ -90,7 +90,8 @@ class CONTENT_EXPORT SyncLoadContext : public RequestPeer {
   // RequestPeer implementation:
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override;
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>*) override;
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
diff --git a/chromium/content/renderer/loader/test_request_peer.cc b/chromium/content/renderer/loader/test_request_peer.cc
index f345a4b32ec..d453d676626 100644
--- a/chromium/content/renderer/loader/test_request_peer.cc
+++ b/chromium/content/renderer/loader/test_request_peer.cc
@@ -24,7 +24,8 @@ void TestRequestPeer::OnUploadProgress(uint64_t position, uint64_t size) {
 
 bool TestRequestPeer::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>*) {
   EXPECT_FALSE(context_->cancelled);
   EXPECT_FALSE(context_->complete);
   ++context_->seen_redirects;
diff --git a/chromium/content/renderer/loader/test_request_peer.h b/chromium/content/renderer/loader/test_request_peer.h
index d61c1e8554c..f9a4f14488e 100644
--- a/chromium/content/renderer/loader/test_request_peer.h
+++ b/chromium/content/renderer/loader/test_request_peer.h
@@ -33,7 +33,8 @@ class TestRequestPeer : public RequestPeer {
 
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override;
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>*) override;
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
diff --git a/chromium/content/renderer/loader/url_loader_client_impl.cc b/chromium/content/renderer/loader/url_loader_client_impl.cc
index 44fe52b2a8e..795d7d70312 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl.cc
+++ b/chromium/content/renderer/loader/url_loader_client_impl.cc
@@ -9,6 +9,7 @@
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/feature_list.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/single_thread_task_runner.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/renderer/content_renderer_client.h"
@@ -237,7 +238,12 @@ void URLLoaderClientImpl::Bind(
 
 void URLLoaderClientImpl::OnReceiveResponse(
     network::mojom::URLResponseHeadPtr response_head) {
+  TRACE_EVENT1("loading", "URLLoaderClientImpl::OnReceiveResponse", "url",
+               last_loaded_url_.possibly_invalid_spec());
+
   has_received_response_head_ = true;
+  on_receive_response_time_ = base::TimeTicks::Now();
+
   if (NeedsStoringMessage()) {
     StoreAndDispatch(
         std::make_unique<DeferredOnReceiveResponse>(std::move(response_head)));
@@ -309,6 +315,12 @@ void URLLoaderClientImpl::OnStartLoadingResponseBody(
   DCHECK(!has_received_response_body_);
   has_received_response_body_ = true;
 
+  if (!on_receive_response_time_.is_null()) {
+    UMA_HISTOGRAM_TIMES(
+        "Renderer.OnReceiveResponseToOnStartLoadingResponseBody",
+        base::TimeTicks::Now() - on_receive_response_time_);
+  }
+
   if (NeedsStoringMessage()) {
     StoreAndDispatch(
         std::make_unique<DeferredOnStartLoadingResponseBody>(std::move(body)));
diff --git a/chromium/content/renderer/loader/url_loader_client_impl.h b/chromium/content/renderer/loader/url_loader_client_impl.h
index b8498e181a6..6a3c19ce8a5 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl.h
+++ b/chromium/content/renderer/loader/url_loader_client_impl.h
@@ -7,9 +7,11 @@
 
 #include <stdint.h>
 #include <vector>
+
 #include "base/callback_forward.h"
-#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
+#include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -99,6 +101,9 @@ class CONTENT_EXPORT URLLoaderClientImpl final
   bool bypass_redirect_checks_ = false;
   GURL last_loaded_url_;
 
+  // For UMA.
+  base::TimeTicks on_receive_response_time_;
+
   mojo::Remote<network::mojom::URLLoader> url_loader_;
   mojo::Receiver<network::mojom::URLLoaderClient> url_loader_client_receiver_{
       this};
diff --git a/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc b/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
index c14c92f7f70..0569dc79ee9 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
+++ b/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
@@ -52,13 +52,8 @@ class URLLoaderClientImplTest : public ::testing::Test,
  protected:
   URLLoaderClientImplTest() : dispatcher_(new ResourceDispatcher()) {
     auto request = std::make_unique<network::ResourceRequest>();
-    // Set request context type to fetch so that ResourceDispatcher doesn't
-    // install MimeSniffingThrottle, which makes URLLoaderThrottleLoader
-    // defer the request.
-    request->fetch_request_context_type =
-        static_cast<int>(blink::mojom::RequestContextType::FETCH);
     request_id_ = dispatcher_->StartAsync(
-        std::move(request), 0,
+        std::move(request), 0 /* loader_option */,
         blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
         TRAFFIC_ANNOTATION_FOR_TESTS, false,
         std::make_unique<TestRequestPeer>(dispatcher_.get(),
diff --git a/chromium/content/renderer/loader/web_url_loader_impl.cc b/chromium/content/renderer/loader/web_url_loader_impl.cc
index b5a203b4b20..a506772220c 100644
--- a/chromium/content/renderer/loader/web_url_loader_impl.cc
+++ b/chromium/content/renderer/loader/web_url_loader_impl.cc
@@ -15,11 +15,12 @@
 #include "base/auto_reset.h"
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "base/optional.h"
 #include "base/sequence_checker.h"
 #include "base/single_thread_task_runner.h"
@@ -61,6 +62,7 @@
 #include "net/ssl/ssl_info.h"
 #include "services/network/public/cpp/http_raw_request_response_info.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/trust_tokens.mojom-shared.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/features.h"
@@ -304,7 +306,8 @@ bool IsBannedCrossSiteAuth(network::ResourceRequest* resource_request,
         extra_data->allow_cross_origin_auth_prompt();
   }
 
-  if (first_party.IsFirstParty(request_url)) {
+  if (first_party.IsFirstPartyWithSchemefulMode(
+          request_url, /*compute_schemefully=*/false)) {
     // If the first party is secure but the subresource is not, this is
     // mixed-content. Do not allow the image.
     if (!allow_cross_origin_auth_prompt &&
@@ -379,7 +382,8 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context> {
 
   void OnUploadProgress(uint64_t position, uint64_t size);
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head);
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>* removed_headers);
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head);
   void OnStartLoadingResponseBody(mojo::ScopedDataPipeConsumerHandle body);
   void OnTransferSizeUpdated(int transfer_size_diff);
@@ -443,7 +447,8 @@ class WebURLLoaderImpl::RequestPeerImpl : public RequestPeer {
   // RequestPeer methods:
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override;
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>* removed_headers) override;
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
@@ -472,7 +477,8 @@ class WebURLLoaderImpl::SinkPeer : public RequestPeer {
   // RequestPeer implementation:
   void OnUploadProgress(uint64_t position, uint64_t size) override {}
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override {
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>*) override {
     return true;
   }
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override {}
@@ -721,7 +727,8 @@ void WebURLLoaderImpl::Context::OnUploadProgress(uint64_t position,
 
 bool WebURLLoaderImpl::Context::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>* removed_headers) {
   if (!client_)
     return false;
 
@@ -739,7 +746,7 @@ bool WebURLLoaderImpl::Context::OnReceivedRedirect(
       Referrer::NetReferrerPolicyToBlinkReferrerPolicy(
           redirect_info.new_referrer_policy),
       WebString::FromUTF8(redirect_info.new_method), response,
-      report_raw_headers_);
+      report_raw_headers_, removed_headers);
 }
 
 void WebURLLoaderImpl::Context::OnReceivedResponse(
@@ -772,6 +779,10 @@ void WebURLLoaderImpl::Context::OnStartLoadingResponseBody(
     mojo::ScopedDataPipeConsumerHandle body) {
   if (client_)
     client_->DidStartLoadingResponseBody(std::move(body));
+
+  TRACE_EVENT_WITH_FLOW0(
+      "loading", "WebURLLoaderImpl::Context::OnStartLoadingResponseBody", this,
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
 }
 
 void WebURLLoaderImpl::Context::OnTransferSizeUpdated(int transfer_size_diff) {
@@ -840,8 +851,10 @@ void WebURLLoaderImpl::RequestPeerImpl::OnUploadProgress(uint64_t position,
 
 bool WebURLLoaderImpl::RequestPeerImpl::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
-  return context_->OnReceivedRedirect(redirect_info, std::move(head));
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>* removed_headers) {
+  return context_->OnReceivedRedirect(redirect_info, std::move(head),
+                                      removed_headers);
 }
 
 void WebURLLoaderImpl::RequestPeerImpl::OnReceivedResponse(
@@ -1021,6 +1034,19 @@ WebURLError WebURLLoaderImpl::PopulateURLError(
     return WebURLError(*status.blocked_by_response_reason,
                        status.resolve_error_info, has_copy_in_cache, url);
   }
+
+  if (status.trust_token_operation_status !=
+      network::mojom::TrustTokenOperationStatus::kOk) {
+    DCHECK(status.error_code == net::ERR_TRUST_TOKEN_OPERATION_CACHE_HIT ||
+           status.error_code == net::ERR_TRUST_TOKEN_OPERATION_FAILED)
+        << "Unexpected error code on Trust Token operation failure (or cache "
+           "hit): "
+        << status.error_code;
+
+    return WebURLError(status.error_code, status.trust_token_operation_status,
+                       url);
+  }
+
   return WebURLError(status.error_code, status.extended_error_code,
                      status.resolve_error_info, has_copy_in_cache,
                      WebURLError::IsWebSecurityViolation::kFalse, url);
diff --git a/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc b/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
index 30a489e52c7..738a24488cb 100644
--- a/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
+++ b/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
@@ -195,7 +195,8 @@ class TestWebURLLoaderClient : public blink::WebURLLoaderClient {
                           network::mojom::ReferrerPolicy new_referrer_policy,
                           const blink::WebString& new_method,
                           const blink::WebURLResponse& passed_redirect_response,
-                          bool& report_raw_headers) override {
+                          bool& report_raw_headers,
+                          std::vector<std::string>*) override {
     EXPECT_TRUE(loader_);
 
     // No test currently simulates mutiple redirects.
@@ -326,8 +327,10 @@ class WebURLLoaderImplTest : public testing::Test {
     redirect_info.new_url = GURL(kTestURL);
     redirect_info.new_site_for_cookies =
         net::SiteForCookies::FromUrl(GURL(kTestURL));
+    std::vector<std::string> removed_headers;
     peer()->OnReceivedRedirect(redirect_info,
-                               network::mojom::URLResponseHead::New());
+                               network::mojom::URLResponseHead::New(),
+                               &removed_headers);
     EXPECT_TRUE(client()->did_receive_redirect());
   }
 
@@ -340,7 +343,7 @@ class WebURLLoaderImplTest : public testing::Test {
     redirect_info.new_site_for_cookies =
         net::SiteForCookies::FromUrl(GURL(kTestHTTPSURL));
     peer()->OnReceivedRedirect(redirect_info,
-                               network::mojom::URLResponseHead::New());
+                               network::mojom::URLResponseHead::New(), nullptr);
     EXPECT_TRUE(client()->did_receive_redirect());
   }
 
diff --git a/chromium/content/renderer/loader/web_url_request_util.cc b/chromium/content/renderer/loader/web_url_request_util.cc
index 828286ed859..3c58401723c 100644
--- a/chromium/content/renderer/loader/web_url_request_util.cc
+++ b/chromium/content/renderer/loader/web_url_request_util.cc
@@ -9,7 +9,8 @@
 
 #include <limits>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 #include "base/task/post_task.h"
 #include "content/child/child_thread_impl.h"
diff --git a/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc b/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
index 99607546cca..5e7b8b3b7e8 100644
--- a/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
+++ b/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
@@ -574,10 +574,6 @@ void WebWorkerFetchContextImpl::set_top_frame_origin(
   top_frame_origin_ = top_frame_origin;
 }
 
-void WebWorkerFetchContextImpl::set_origin_url(const GURL& origin_url) {
-  origin_url_ = origin_url;
-}
-
 void WebWorkerFetchContextImpl::set_client_id(const std::string& client_id) {
   client_id_ = client_id;
 }
diff --git a/chromium/content/renderer/loader/web_worker_fetch_context_impl.h b/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
index 3638f058d27..6d08e2d5be3 100644
--- a/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
+++ b/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
@@ -8,6 +8,7 @@
 #include <memory>
 #include <string>
 
+#include "base/strings/string_piece.h"
 #include "base/synchronization/waitable_event.h"
 #include "content/common/child_process.mojom.h"
 #include "content/common/content_export.h"
@@ -162,9 +163,6 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   void set_site_for_cookies(const net::SiteForCookies& site_for_cookies);
   void set_top_frame_origin(const blink::WebSecurityOrigin& top_frame_origin);
 
-  // Sets whether the worker context is a secure context.
-  // https://w3c.github.io/webappsec-secure-contexts/
-  void set_origin_url(const GURL& origin_url);
   void set_client_id(const std::string& client_id);
 
   // PlzWorker with off-the-main-thread worker script fetch:
@@ -172,7 +170,7 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   void SetResponseOverrideForMainScript(
       std::unique_ptr<NavigationResponseOverrideParameters> response_override);
 
-  using RewriteURLFunction = blink::WebURL (*)(const std::string&, bool);
+  using RewriteURLFunction = blink::WebURL (*)(base::StringPiece, bool);
   static void InstallRewriteURLFunction(RewriteURLFunction rewrite_url);
 
   blink::WebString GetAcceptLanguages() const override;
@@ -334,7 +332,6 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   scoped_refptr<FrameRequestBlocker> frame_request_blocker_;
   net::SiteForCookies site_for_cookies_;
   base::Optional<url::Origin> top_frame_origin_;
-  GURL origin_url_;
 
   blink::mojom::RendererPreferences renderer_preferences_;
 
diff --git a/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc b/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc
index 9a8609f919c..748ae92ffae 100644
--- a/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc
+++ b/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc
@@ -8,7 +8,7 @@
 #include <string>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/media/android/flinging_renderer_client.h"
 #include "media/mojo/clients/mojo_renderer.h"
 #include "media/mojo/clients/mojo_renderer_factory.h"
diff --git a/chromium/content/renderer/media/android/media_player_renderer_client.cc b/chromium/content/renderer/media/android/media_player_renderer_client.cc
index 4e59230f922..fc95fdf46cc 100644
--- a/chromium/content/renderer/media/android/media_player_renderer_client.cc
+++ b/chromium/content/renderer/media/android/media_player_renderer_client.cc
@@ -55,17 +55,13 @@ void MediaPlayerRendererClient::Initialize(
   client_ = client;
   init_cb_ = std::move(init_cb);
 
-  // Initialize the StreamTexture using a 1x1 texture because we do not have
-  // any size information from the MediaPlayer yet.
-  // The size will be automatically updated in OnVideoNaturalSizeChange() once
-  // we parse the media's metadata.
   // Unretained is safe here because |stream_texture_wrapper_| resets the
   // Closure it has before destroying itself on |compositor_task_runner_|,
   // and |this| is garanteed to live until the Closure has been reset.
   stream_texture_wrapper_->Initialize(
       base::BindRepeating(&MediaPlayerRendererClient::OnFrameAvailable,
                           base::Unretained(this)),
-      gfx::Size(1, 1), compositor_task_runner_,
+      compositor_task_runner_,
       base::BindOnce(
           &MediaPlayerRendererClient::OnStreamTextureWrapperInitialized,
           weak_factory_.GetWeakPtr(), media_resource));
diff --git a/chromium/content/renderer/media/android/stream_texture_factory.cc b/chromium/content/renderer/media/android/stream_texture_factory.cc
index 4612a3c21cb..e180ab95ee9 100644
--- a/chromium/content/renderer/media/android/stream_texture_factory.cc
+++ b/chromium/content/renderer/media/android/stream_texture_factory.cc
@@ -23,12 +23,12 @@ void StreamTextureProxy::Release() {
   ClearReceivedFrameCB();
 
   // |this| can be deleted by the |task_runner_| on the compositor thread by
-  // posting task to that thread. So we need to clear the |set_ycbcr_info_cb_|
-  // here first so that its not called on the compositor thread before |this| is
-  // deleted. The problem is that |set_ycbcr_info_cb_| is provided by the owner
-  // of StreamTextureProxy, which is being destroyed and is releasing
-  // StreamTextureProxy.
-  ClearSetYcbcrInfoCB();
+  // posting task to that thread. So we need to clear the
+  // |create_video_frame_cb_| here first so that its not called on the
+  // compositor thread before |this| is deleted. The problem is that
+  // |create_video_frame_cb_| is provided by the owner of StreamTextureProxy,
+  // which is being destroyed and is releasing StreamTextureProxy.
+  ClearCreateVideoFrameCB();
 
   // Release is analogous to the destructor, so there should be no more external
   // calls to this object in Release. Therefore there is no need to acquire the
@@ -44,14 +44,14 @@ void StreamTextureProxy::ClearReceivedFrameCB() {
   received_frame_cb_.Reset();
 }
 
-void StreamTextureProxy::ClearSetYcbcrInfoCB() {
+void StreamTextureProxy::ClearCreateVideoFrameCB() {
   base::AutoLock lock(lock_);
-  set_ycbcr_info_cb_.Reset();
+  create_video_frame_cb_.Reset();
 }
 
 void StreamTextureProxy::BindToTaskRunner(
     const base::RepeatingClosure& received_frame_cb,
-    SetYcbcrInfoCb set_ycbcr_info_cb,
+    const CreateVideoFrameCB& create_video_frame_cb,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
   DCHECK(task_runner.get());
 
@@ -60,7 +60,7 @@ void StreamTextureProxy::BindToTaskRunner(
     DCHECK(!task_runner_.get() || (task_runner.get() == task_runner_.get()));
     task_runner_ = task_runner;
     received_frame_cb_ = received_frame_cb;
-    set_ycbcr_info_cb_ = std::move(set_ycbcr_info_cb);
+    create_video_frame_cb_ = create_video_frame_cb;
   }
 
   if (task_runner->BelongsToCurrentThread()) {
@@ -84,13 +84,16 @@ void StreamTextureProxy::OnFrameAvailable() {
     received_frame_cb_.Run();
 }
 
-void StreamTextureProxy::OnFrameWithYcbcrInfoAvailable(
-    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
+void StreamTextureProxy::OnFrameWithInfoAvailable(
+    const gpu::Mailbox& mailbox,
+    const gfx::Size& coded_size,
+    const gfx::Rect& visible_rect,
+    const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) {
   base::AutoLock lock(lock_);
   // Set the ycbcr info before running the received frame callback so that the
   // first frame has it.
-  if (!set_ycbcr_info_cb_.is_null())
-    std::move(set_ycbcr_info_cb_).Run(std::move(ycbcr_info));
+  if (!create_video_frame_cb_.is_null())
+    create_video_frame_cb_.Run(mailbox, coded_size, visible_rect, ycbcr_info);
   if (!received_frame_cb_.is_null())
     received_frame_cb_.Run();
 }
@@ -100,14 +103,8 @@ void StreamTextureProxy::ForwardStreamTextureForSurfaceRequest(
   host_->ForwardStreamTextureForSurfaceRequest(request_token);
 }
 
-void StreamTextureProxy::CreateSharedImage(
-    const gfx::Size& size,
-    gpu::Mailbox* mailbox,
-    gpu::SyncToken* unverified_sync_token) {
-  *mailbox = host_->CreateSharedImage(size);
-  if (mailbox->IsZero())
-    return;
-  *unverified_sync_token = host_->GenUnverifiedSyncToken();
+void StreamTextureProxy::UpdateRotatedVisibleSize(const gfx::Size& size) {
+  host_->UpdateRotatedVisibleSize(size);
 }
 
 // static
diff --git a/chromium/content/renderer/media/android/stream_texture_factory.h b/chromium/content/renderer/media/android/stream_texture_factory.h
index c2f1b0a534a..28bffd74185 100644
--- a/chromium/content/renderer/media/android/stream_texture_factory.h
+++ b/chromium/content/renderer/media/android/stream_texture_factory.h
@@ -17,13 +17,13 @@
 #include "content/common/content_export.h"
 #include "content/renderer/stream_texture_host_android.h"
 #include "gpu/command_buffer/common/mailbox.h"
+#include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace gpu {
 class ClientSharedImageInterface;
 class GpuChannelHost;
 class SharedImageInterface;
-struct SyncToken;
 struct VulkanYCbCrInfo;
 }  // namespace gpu
 
@@ -35,8 +35,11 @@ class StreamTextureFactory;
 // when a new video frame is available.
 class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
  public:
-  using SetYcbcrInfoCb =
-      base::OnceCallback<void(base::Optional<gpu::VulkanYCbCrInfo>)>;
+  using CreateVideoFrameCB = base::RepeatingCallback<void(
+      const gpu::Mailbox& mailbox,
+      const gfx::Size& coded_size,
+      const gfx::Rect& visible_rect,
+      const base::Optional<gpu::VulkanYCbCrInfo>&)>;
 
   ~StreamTextureProxy() override;
 
@@ -45,13 +48,16 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   // must be called with the same |task_runner| every time.
   void BindToTaskRunner(
       const base::RepeatingClosure& received_frame_cb,
-      SetYcbcrInfoCb set_ycbcr_info_cb,
+      const CreateVideoFrameCB& create_video_frame_cb,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   // StreamTextureHost::Listener implementation:
   void OnFrameAvailable() override;
-  void OnFrameWithYcbcrInfoAvailable(
-      base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) override;
+  void OnFrameWithInfoAvailable(
+      const gpu::Mailbox& mailbox,
+      const gfx::Size& coded_size,
+      const gfx::Rect& visible_rect,
+      const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) override;
 
   // Sends an IPC to the GPU process.
   // Asks the StreamTexture to forward its SurfaceTexture to the
@@ -59,14 +65,9 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   void ForwardStreamTextureForSurfaceRequest(
       const base::UnguessableToken& request_token);
 
-  // Creates a SharedImage for the provided texture size. Returns the
-  // |mailbox| for the SharedImage, as well as an |unverified_sync_token|
-  // representing SharedImage creation.
-  // If creation fails, returns an empty |mailbox| and does not modify
-  // |unverified_sync_token|.
-  void CreateSharedImage(const gfx::Size& size,
-                         gpu::Mailbox* mailbox,
-                         gpu::SyncToken* unverified_sync_token);
+  // Notifies StreamTexture that video size has been changed and so it can
+  // recreate shared image.
+  void UpdateRotatedVisibleSize(const gfx::Size& size);
 
   // Clears |received_frame_cb_| in a thread safe way.
   void ClearReceivedFrameCB();
@@ -82,15 +83,15 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   void BindOnThread();
   void Release();
 
-  // Clears |set_ycbcr_info_cb_| in a thread safe way.
-  void ClearSetYcbcrInfoCB();
+  // Clears |create_video_frame_cb_| in a thread safe way.
+  void ClearCreateVideoFrameCB();
 
   const std::unique_ptr<StreamTextureHost> host_;
 
   // Protects access to |received_frame_cb_| and |task_runner_|.
   base::Lock lock_;
   base::RepeatingClosure received_frame_cb_;
-  SetYcbcrInfoCb set_ycbcr_info_cb_;
+  CreateVideoFrameCB create_video_frame_cb_;
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(StreamTextureProxy);
@@ -101,7 +102,7 @@ typedef std::unique_ptr<StreamTextureProxy, StreamTextureProxy::Deleter>
 
 // Factory class for managing stream textures.
 class CONTENT_EXPORT StreamTextureFactory
-    : public base::RefCounted<StreamTextureFactory> {
+    : public base::RefCountedThreadSafe<StreamTextureFactory> {
  public:
   static scoped_refptr<StreamTextureFactory> Create(
       scoped_refptr<gpu::GpuChannelHost> channel);
@@ -118,7 +119,7 @@ class CONTENT_EXPORT StreamTextureFactory
   gpu::SharedImageInterface* SharedImageInterface();
 
  private:
-  friend class base::RefCounted<StreamTextureFactory>;
+  friend class base::RefCountedThreadSafe<StreamTextureFactory>;
   StreamTextureFactory(scoped_refptr<gpu::GpuChannelHost> channel);
   ~StreamTextureFactory();
   // Creates a gpu::StreamTexture and returns its id.
diff --git a/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc b/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc
index b6cb3b4cc6f..74e03d6f4d2 100644
--- a/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc
+++ b/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc
@@ -63,18 +63,17 @@ class StreamTextureProxyTest : public testing::Test {
   scoped_refptr<TestGpuChannelHost> channel_;
 };
 
-// This test is to make sure CreateSharedImage() do not crash even if
+// This test is to make sure UpdateRotatedVisibleSize() do not crash even if
 // StreamTextureHost's |channel_| is null.
 TEST_F(StreamTextureProxyTest,
-       CreateSharedImageDoesNotCrashWithNullGpuChannelHost) {
+       UpdateRotatedVisibleSizeDoesNotCrashWithNullGpuChannelHost) {
   auto proxy = CreateProxyWithNullGpuChannelHost();
   gpu::Mailbox mailbox;
   gpu::SyncToken texture_mailbox_sync_token;
 
   // This method should not crash even if the StreamTextureHost's |channel_| is
   // null.
-  proxy->CreateSharedImage(gfx::Size(1, 1), &mailbox,
-                           &texture_mailbox_sync_token);
+  proxy->UpdateRotatedVisibleSize(gfx::Size(1, 1));
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
index 781a32571bc..a02c70aac50 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
@@ -51,17 +51,16 @@ scoped_refptr<media::VideoFrame> StreamTextureWrapperImpl::GetCurrentFrame() {
   return current_frame_;
 }
 
-void StreamTextureWrapperImpl::ReallocateVideoFrame() {
-  DVLOG(2) << __func__;
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-
-  gpu::Mailbox mailbox;
-  gpu::SyncToken texture_mailbox_sync_token;
-  stream_texture_proxy_->CreateSharedImage(natural_size_, &mailbox,
-                                           &texture_mailbox_sync_token);
+void StreamTextureWrapperImpl::CreateVideoFrame(
+    const gpu::Mailbox& mailbox,
+    const gfx::Size& coded_size,
+    const gfx::Rect& visible_rect,
+    const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) {
+  // This message comes from GPU process when the SharedImage is already
+  // created, so we don't need to wait on any synctoken, mailbox is ready to
+  // use.
   gpu::MailboxHolder holders[media::VideoFrame::kMaxPlanes] = {
-      gpu::MailboxHolder(mailbox, texture_mailbox_sync_token,
-                         GL_TEXTURE_EXTERNAL_OES)};
+      gpu::MailboxHolder(mailbox, gpu::SyncToken(), GL_TEXTURE_EXTERNAL_OES)};
 
   // The pixel format doesn't matter here as long as it's valid for texture
   // frames. But SkiaRenderer wants to ensure that the format of the resource
@@ -73,11 +72,11 @@ void StreamTextureWrapperImpl::ReallocateVideoFrame() {
   scoped_refptr<media::VideoFrame> new_frame =
       media::VideoFrame::WrapNativeTextures(
           media::PIXEL_FORMAT_ABGR, holders,
-          media::BindToCurrentLoop(
+          media::BindToLoop(
+              main_task_runner_,
               base::BindOnce(&OnReleaseVideoFrame, factory_, mailbox)),
-          natural_size_, gfx::Rect(natural_size_), natural_size_,
-          base::TimeDelta());
-  new_frame->set_ycbcr_info(ycbcr_info_);
+          coded_size, visible_rect, visible_rect.size(), base::TimeDelta());
+  new_frame->set_ycbcr_info(ycbcr_info);
 
   if (enable_texture_copy_) {
     new_frame->metadata()->SetBoolean(media::VideoFrameMetadata::COPY_REQUIRED,
@@ -104,14 +103,6 @@ void StreamTextureWrapperImpl::SetCurrentFrameInternal(
   current_frame_ = std::move(video_frame);
 }
 
-void StreamTextureWrapperImpl::SetYcbcrInfo(
-    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
-  DCHECK(!ycbcr_info_);
-
-  current_frame_->set_ycbcr_info(ycbcr_info);
-  ycbcr_info_ = std::move(ycbcr_info);
-}
-
 void StreamTextureWrapperImpl::UpdateTextureSize(const gfx::Size& new_size) {
   DVLOG(2) << __func__;
 
@@ -126,22 +117,20 @@ void StreamTextureWrapperImpl::UpdateTextureSize(const gfx::Size& new_size) {
   if (!stream_texture_proxy_)
     return;
 
-  if (natural_size_ == new_size)
+  if (rotated_visible_size_ == new_size)
     return;
 
-  natural_size_ = new_size;
-  ReallocateVideoFrame();
+  rotated_visible_size_ = new_size;
+  stream_texture_proxy_->UpdateRotatedVisibleSize(rotated_visible_size_);
 }
 
 void StreamTextureWrapperImpl::Initialize(
     const base::RepeatingClosure& received_frame_cb,
-    const gfx::Size& natural_size,
     scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner,
     StreamTextureWrapperInitCB init_cb) {
   DVLOG(2) << __func__;
 
   compositor_task_runner_ = compositor_task_runner;
-  natural_size_ = natural_size;
 
   main_task_runner_->PostTask(
       FROM_HERE,
@@ -169,15 +158,13 @@ void StreamTextureWrapperImpl::InitializeOnMainThread(
     return;
   }
 
-  ReallocateVideoFrame();
-
   // Unretained is safe here since |stream_texture_proxy_| is a scoped member of
   // the this StreamTextureWrapperImpl class which clears/resets this callback
   // before |this| is destroyed.
   stream_texture_proxy_->BindToTaskRunner(
       received_frame_cb,
-      base::BindOnce(&StreamTextureWrapperImpl::SetYcbcrInfo,
-                     base::Unretained(this)),
+      base::BindRepeating(&StreamTextureWrapperImpl::CreateVideoFrame,
+                          base::Unretained(this)),
       compositor_task_runner_);
 
   std::move(init_cb).Run(true);
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
index f200d9ff094..87735abffa4 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
@@ -63,13 +63,12 @@ class CONTENT_EXPORT StreamTextureWrapperImpl
   //     DidReceiveFrame() method.
   void Initialize(
       const base::RepeatingClosure& received_frame_cb,
-      const gfx::Size& natural_size,
       scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner,
       StreamTextureWrapperInitCB init_cb) override;
 
   // Should be called when the Video size changes.
   // Can be called from any thread, but runs on |main_task_runner_|.
-  void UpdateTextureSize(const gfx::Size& natural_size) override;
+  void UpdateTextureSize(const gfx::Size& rotated_visible_size) override;
 
   // Returns the latest frame.
   // N.B: We create a single VideoFrame at initialization time (and update it
@@ -101,30 +100,26 @@ class CONTENT_EXPORT StreamTextureWrapperImpl
   void InitializeOnMainThread(const base::RepeatingClosure& received_frame_cb,
                               StreamTextureWrapperInitCB init_cb);
 
-  void ReallocateVideoFrame();
+  void CreateVideoFrame(const gpu::Mailbox& mailbox,
+                        const gfx::Size& coded_size,
+                        const gfx::Rect& visible_rect,
+                        const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info);
 
   void SetCurrentFrameInternal(scoped_refptr<media::VideoFrame> video_frame);
 
-  // Sets the ycbcr_info on the |current_frame_|. This is called before the
-  // first frame becomes available, at which point no frames are in use, so
-  // modification of the frame is safe. The same info is re-used for all future
-  // frames.
-  void SetYcbcrInfo(base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info);
-
   bool enable_texture_copy_;
 
   // Object for calling back the compositor thread to repaint the video when a
   // frame is available. It should be bound to |compositor_task_runner_|.
   ScopedStreamTextureProxy stream_texture_proxy_;
 
-  // Size of the video frames.
-  gfx::Size natural_size_;
+  // Visible size of the video with rotation applied.
+  gfx::Size rotated_visible_size_;
 
   scoped_refptr<StreamTextureFactory> factory_;
 
   base::Lock current_frame_lock_;
   scoped_refptr<media::VideoFrame> current_frame_;
-  base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info_;
 
   scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner_;
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc b/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc
index 8cb8fc07646..398974fd01d 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc
@@ -35,9 +35,9 @@ TEST_F(StreamTextureWrapperImplTest, ConstructionDestruction_ShouldSucceed) {
   // we try to initialize it.
   int result = 0;
   stream_texture_wrapper->Initialize(
-      base::DoNothing(), gfx::Size(0, 0),
+      base::DoNothing(),
       blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
-      base::BindRepeating(
+      base::BindOnce(
           [](int* result_out, bool result) { *result_out = result ? 1 : 2; },
           &result));
   base::RunLoop().RunUntilIdle();
diff --git a/chromium/content/renderer/media/audio/audio_device_factory.cc b/chromium/content/renderer/media/audio/audio_device_factory.cc
index be4148045ef..2a5d45c9e1f 100644
--- a/chromium/content/renderer/media/audio/audio_device_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_device_factory.cc
@@ -7,9 +7,10 @@
 #include <algorithm>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
+#include "base/notreached.h"
 #include "base/task/post_task.h"
 #include "base/task/thread_pool.h"
 #include "base/threading/platform_thread.h"
diff --git a/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc b/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
index 4b49ebecb60..f5cc6d7f1b4 100644
--- a/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
@@ -8,7 +8,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/sequenced_task_runner.h"
 #include "base/single_thread_task_runner.h"
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
@@ -16,7 +16,6 @@
 #include "content/renderer/render_frame_impl.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 
 namespace content {
@@ -27,22 +26,14 @@ void CreateMojoAudioInputStreamOnMainThread(
     int frame_id,
     const media::AudioSourceParameters& source_params,
     mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
-    mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-        controls_receiver,
     const media::AudioParameters& params,
     bool automatic_gain_control,
     uint32_t total_segments) {
   RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(frame_id);
   if (frame) {
-    audio::mojom::AudioProcessingConfigPtr processing_config;
-    if (source_params.processing) {
-      processing_config = audio::mojom::AudioProcessingConfig::New(
-          std::move(controls_receiver), source_params.processing->id,
-          source_params.processing->settings);
-    }
     frame->GetAudioInputStreamFactory()->CreateStream(
         std::move(client), source_params.session_id, params,
-        automatic_gain_control, total_segments, std::move(processing_config));
+        automatic_gain_control, total_segments);
   }
 }
 
@@ -51,16 +42,14 @@ void CreateMojoAudioInputStream(
     int frame_id,
     const media::AudioSourceParameters& source_params,
     mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
-    mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-        controls_receiver,
     const media::AudioParameters& params,
     bool automatic_gain_control,
     uint32_t total_segments) {
   main_task_runner->PostTask(
-      FROM_HERE, base::BindOnce(&CreateMojoAudioInputStreamOnMainThread,
-                                frame_id, source_params, std::move(client),
-                                std::move(controls_receiver), params,
-                                automatic_gain_control, total_segments));
+      FROM_HERE,
+      base::BindOnce(&CreateMojoAudioInputStreamOnMainThread, frame_id,
+                     source_params, std::move(client), params,
+                     automatic_gain_control, total_segments));
 }
 
 void AssociateInputAndOutputForAec(
diff --git a/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc b/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
index 3db25eea212..072201d3761 100644
--- a/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/single_thread_task_runner.h"
 #include "content/renderer/media/audio/mojo_audio_output_ipc.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
diff --git a/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc b/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc
index 0a2874ca7ef..e419f90b3ba 100644
--- a/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc
+++ b/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc
@@ -8,9 +8,9 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
 #include "media/audio/audio_device_description.h"
diff --git a/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc b/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc
index 15a735b3e15..f2e459ff715 100644
--- a/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc
+++ b/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/test/task_environment.h"
 #include "base/threading/thread.h"
 #include "media/audio/audio_device_description.h"
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
index ec5afced2f4..450acb418f5 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
@@ -44,12 +44,7 @@ void MojoAudioInputIPC::CreateStream(media::AudioInputIPCDelegate* delegate,
   factory_client_receiver_.set_disconnect_handler(base::BindOnce(
       &media::AudioInputIPCDelegate::OnError, base::Unretained(delegate_)));
 
-  stream_creation_start_time_ = base::TimeTicks::Now();
-  mojo::PendingReceiver<audio::mojom::AudioProcessorControls> controls_receiver;
-  if (source_params_.processing.has_value())
-    controls_receiver = processor_controls_.BindNewPipeAndPassReceiver();
-  stream_creator_.Run(source_params_, std::move(client),
-                      std::move(controls_receiver), params,
+  stream_creator_.Run(source_params_, std::move(client), params,
                       automatic_gain_control, total_segments);
 }
 
@@ -74,35 +69,12 @@ void MojoAudioInputIPC::SetOutputDeviceForAec(
     stream_associator_.Run(*stream_id_, output_device_id);
 }
 
-media::AudioProcessorControls* MojoAudioInputIPC::GetProcessorControls() {
-  return processor_controls_ ? this : nullptr;
-}
-
 void MojoAudioInputIPC::CloseStream() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   delegate_ = nullptr;
   factory_client_receiver_.reset();
   stream_client_receiver_.reset();
   stream_.reset();
-  processor_controls_.reset();
-}
-
-void MojoAudioInputIPC::GetStats(GetStatsCB callback) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (processor_controls_)
-    processor_controls_->GetStats(std::move(callback));
-}
-
-void MojoAudioInputIPC::StartEchoCancellationDump(base::File file) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (processor_controls_)
-    processor_controls_->StartEchoCancellationDump(std::move(file));
-}
-
-void MojoAudioInputIPC::StopEchoCancellationDump() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (processor_controls_)
-    processor_controls_->StopEchoCancellationDump();
 }
 
 void MojoAudioInputIPC::StreamCreated(
@@ -117,9 +89,6 @@ void MojoAudioInputIPC::StreamCreated(
   DCHECK(!stream_);
   DCHECK(!stream_client_receiver_.is_bound());
 
-  UMA_HISTOGRAM_TIMES("Media.Audio.Render.InputDeviceStreamCreationTime",
-                      base::TimeTicks::Now() - stream_creation_start_time_);
-
   stream_.Bind(std::move(stream));
   stream_client_receiver_.Bind(std::move(stream_client_receiver));
 
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
index b55a073beec..58efe08d0bc 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
@@ -22,7 +22,6 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 
 namespace content {
 
@@ -31,7 +30,6 @@ namespace content {
 // thread.
 class CONTENT_EXPORT MojoAudioInputIPC
     : public media::AudioInputIPC,
-      public media::AudioProcessorControls,
       public mojom::RendererAudioInputStreamFactoryClient,
       public media::mojom::AudioInputStreamClient {
  public:
@@ -41,8 +39,6 @@ class CONTENT_EXPORT MojoAudioInputIPC
   using StreamCreatorCB = base::RepeatingCallback<void(
       const media::AudioSourceParameters& source_params,
       mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
-      mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-          controls_receiver,
       const media::AudioParameters& params,
       bool automatic_gain_control,
       uint32_t total_segments)>;
@@ -65,14 +61,8 @@ class CONTENT_EXPORT MojoAudioInputIPC
   void RecordStream() override;
   void SetVolume(double volume) override;
   void SetOutputDeviceForAec(const std::string& output_device_id) override;
-  AudioProcessorControls* GetProcessorControls() override;
   void CloseStream() override;
 
-  // AudioProcessorControls implementation
-  void GetStats(GetStatsCB callback) override;
-  void StartEchoCancellationDump(base::File file) override;
-  void StopEchoCancellationDump() override;
-
  private:
   void StreamCreated(
       mojo::PendingRemote<media::mojom::AudioInputStream> stream,
@@ -92,7 +82,6 @@ class CONTENT_EXPORT MojoAudioInputIPC
   StreamAssociatorCB stream_associator_;
 
   mojo::Remote<media::mojom::AudioInputStream> stream_;
-  mojo::Remote<audio::mojom::AudioProcessorControls> processor_controls_;
   // Initialized on StreamCreated.
   base::Optional<base::UnguessableToken> stream_id_;
   mojo::Receiver<AudioInputStreamClient> stream_client_receiver_{this};
@@ -100,8 +89,6 @@ class CONTENT_EXPORT MojoAudioInputIPC
       factory_client_receiver_{this};
   media::AudioInputIPCDelegate* delegate_ = nullptr;
 
-  base::TimeTicks stream_creation_start_time_;
-
   base::WeakPtrFactory<MojoAudioInputIPC> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(MojoAudioInputIPC);
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc b/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
index cdceed092f6..22681946813 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
@@ -85,8 +85,6 @@ class FakeStreamCreator {
   void Create(const media::AudioSourceParameters& source_params,
               mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
                   factory_client,
-              mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-                  controls_receiver,
               const media::AudioParameters& params,
               bool automatic_gain_control,
               uint32_t total_segments) {
@@ -173,8 +171,6 @@ TEST(MojoAudioInputIPC, FactoryDisconnected_SendsError) {
           [](const media::AudioSourceParameters&,
              mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
                  factory_client,
-             mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-                 controls_receiver,
              const media::AudioParameters& params, bool automatic_gain_control,
              uint32_t total_segments) {}),
       base::BindRepeating(&AssociateOutputForAec));
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
index fe1e35db5eb..73611d345aa 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
@@ -83,7 +83,6 @@ void MojoAudioOutputIPC::CreateStream(
   DCHECK_EQ(delegate_, delegate);
   // Since the creation callback won't fire if the provider receiver is gone
   // and |this| owns |stream_provider_|, unretained is safe.
-  stream_creation_start_time_ = base::TimeTicks::Now();
   mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
       client_remote;
   receiver_.Bind(client_remote.InitWithNewPipeAndPassReceiver());
@@ -91,7 +90,7 @@ void MojoAudioOutputIPC::CreateStream(
   receiver_.set_disconnect_with_reason_handler(
       base::BindOnce(&MojoAudioOutputIPC::ProviderClientBindingDisconnected,
                      base::Unretained(this)));
-  stream_provider_->Acquire(params, std::move(client_remote), processing_id);
+  stream_provider_->Acquire(params, std::move(client_remote));
 }
 
 void MojoAudioOutputIPC::PlayStream() {
@@ -231,8 +230,6 @@ void MojoAudioOutputIPC::Created(
   DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate_);
 
-  UMA_HISTOGRAM_TIMES("Media.Audio.Render.OutputDeviceStreamCreationTime",
-                      base::TimeTicks::Now() - stream_creation_start_time_);
   stream_.reset();
   stream_.Bind(std::move(pending_stream));
 
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
index 6a957c553f4..52fb420b9eb 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
@@ -101,8 +101,6 @@ class CONTENT_EXPORT MojoAudioOutputIPC
   media::AudioOutputIPCDelegate* delegate_ = nullptr;
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
 
-  base::TimeTicks stream_creation_start_time_;
-
   // To make sure we don't send an "authorization completed" callback for a
   // stream after it's closed, we use this weak factory.
   base::WeakPtrFactory<MojoAudioOutputIPC> weak_factory_{this};
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc b/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
index 796eb40dd38..4c08247893b 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
@@ -63,8 +63,7 @@ class TestStreamProvider : public media::mojom::AudioOutputStreamProvider {
   void Acquire(
       const media::AudioParameters& params,
       mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
-          pending_provider_client,
-      const base::Optional<base::UnguessableToken>& processing_id) override {
+          pending_provider_client) override {
     EXPECT_EQ(receiver_, base::nullopt);
     EXPECT_NE(stream_, nullptr);
     provider_client_.reset();
diff --git a/chromium/content/renderer/media/audio_decoder.cc b/chromium/content/renderer/media/audio_decoder.cc
index bb90a36a243..077d1b5e0fc 100644
--- a/chromium/content/renderer/media/audio_decoder.cc
+++ b/chromium/content/renderer/media/audio_decoder.cc
@@ -8,6 +8,7 @@
 
 #include <vector>
 
+#include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
 #include "media/base/audio_bus.h"
diff --git a/chromium/content/renderer/media/batching_media_log.cc b/chromium/content/renderer/media/batching_media_log.cc
index eadbd33807b..a1a101687cc 100644
--- a/chromium/content/renderer/media/batching_media_log.cc
+++ b/chromium/content/renderer/media/batching_media_log.cc
@@ -53,10 +53,10 @@ namespace content {
 BatchingMediaLog::BatchingMediaLog(
     const GURL& security_origin,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
-    std::unique_ptr<EventHandler> event_handler)
+    std::vector<std::unique_ptr<EventHandler>> event_handlers)
     : security_origin_(security_origin),
       task_runner_(std::move(task_runner)),
-      event_handler_(std::move(event_handler)),
+      event_handlers_(std::move(event_handlers)),
       tick_clock_(base::DefaultTickClock::GetInstance()),
       last_ipc_send_time_(tick_clock_->NowTicks()),
       ipc_send_pending_(false) {
@@ -81,7 +81,8 @@ BatchingMediaLog::~BatchingMediaLog() {
 }
 
 void BatchingMediaLog::OnWebMediaPlayerDestroyedLocked() {
-  event_handler_->OnWebMediaPlayerDestroyed();
+  for (const auto& handler : event_handlers_)
+    handler->OnWebMediaPlayerDestroyed();
 }
 
 void BatchingMediaLog::AddLogRecordLocked(
@@ -182,7 +183,7 @@ std::string BatchingMediaLog::MediaEventToMessageString(
           static_cast<media::PipelineStatus>(error_code));
     }
     case media::MediaLogRecord::Type::kMessage: {
-      std::string result = "";
+      std::string result;
       if (event.params.GetString(
               MediaLogMessageLevelToString(media::MediaLogMessageLevel::kERROR),
               &result)) {
@@ -217,7 +218,8 @@ void BatchingMediaLog::SendQueuedMediaEvents() {
   if (events_to_send.empty())
     return;
 
-  event_handler_->SendQueuedMediaEvents(std::move(events_to_send));
+  for (const auto& handler : event_handlers_)
+    handler->SendQueuedMediaEvents(events_to_send);
 }
 
 void BatchingMediaLog::SetTickClockForTesting(
diff --git a/chromium/content/renderer/media/batching_media_log.h b/chromium/content/renderer/media/batching_media_log.h
index 57a226c86b5..32e2bbb87ec 100644
--- a/chromium/content/renderer/media/batching_media_log.h
+++ b/chromium/content/renderer/media/batching_media_log.h
@@ -40,7 +40,7 @@ class CONTENT_EXPORT BatchingMediaLog : public media::MediaLog {
 
   BatchingMediaLog(const GURL& security_origin,
                    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
-                   std::unique_ptr<EventHandler> impl);
+                   std::vector<std::unique_ptr<EventHandler>> impl);
   ~BatchingMediaLog() override;
 
   // Will reset |last_ipc_send_time_| with the value of NowTicks().
@@ -66,7 +66,7 @@ class CONTENT_EXPORT BatchingMediaLog : public media::MediaLog {
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   // impl for sending queued events.
-  std::unique_ptr<EventHandler> event_handler_;
+  std::vector<std::unique_ptr<EventHandler>> event_handlers_;
 
   // |lock_| protects access to all of the following member variables.  It
   // allows any render process thread to AddEvent(), while preserving their
diff --git a/chromium/content/renderer/media/batching_media_log_unittest.cc b/chromium/content/renderer/media/batching_media_log_unittest.cc
index 52bf499f90f..ccd285a3c04 100644
--- a/chromium/content/renderer/media/batching_media_log_unittest.cc
+++ b/chromium/content/renderer/media/batching_media_log_unittest.cc
@@ -25,6 +25,13 @@ class TestEventHandler : public BatchingMediaLog::EventHandler {
       std::vector<media::MediaLogRecord> events) override;
   void OnWebMediaPlayerDestroyed() override;
 
+  static std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> Create(
+      BatchingMediaLogTest* ptr) {
+    std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> move_me;
+    move_me.push_back(std::make_unique<TestEventHandler>(ptr));
+    return move_me;
+  }
+
  private:
   BatchingMediaLogTest* test_cls_;
 };
@@ -35,7 +42,7 @@ class BatchingMediaLogTest : public testing::Test {
       : task_runner_(new base::TestMockTimeTaskRunner()),
         log_(GURL("http://foo.com"),
              task_runner_,
-             std::make_unique<TestEventHandler>(this)) {
+             TestEventHandler::Create(this)) {
     log_.SetTickClockForTesting(&tick_clock_);
   }
 
diff --git a/chromium/content/renderer/media/inspector_media_event_handler.cc b/chromium/content/renderer/media/inspector_media_event_handler.cc
index d9bffa83193..1d3a59348a4 100644
--- a/chromium/content/renderer/media/inspector_media_event_handler.cc
+++ b/chromium/content/renderer/media/inspector_media_event_handler.cc
@@ -22,6 +22,21 @@ blink::WebString ToString(const base::Value& value) {
   return blink::WebString::FromUTF8(output_str);
 }
 
+// TODO(tmathmeyer) stop using a string here eventually. This means rewriting
+// the MediaLogRecord mojom interface.
+blink::InspectorPlayerMessage::Level LevelFromString(const std::string& level) {
+  if (level == "error")
+    return blink::InspectorPlayerMessage::Level::kError;
+  if (level == "warning")
+    return blink::InspectorPlayerMessage::Level::kWarning;
+  if (level == "info")
+    return blink::InspectorPlayerMessage::Level::kInfo;
+  if (level == "debug")
+    return blink::InspectorPlayerMessage::Level::kDebug;
+  NOTREACHED();
+  return blink::InspectorPlayerMessage::Level::kError;
+}
+
 }  // namespace
 
 InspectorMediaEventHandler::InspectorMediaEventHandler(
@@ -38,17 +53,19 @@ void InspectorMediaEventHandler::SendQueuedMediaEvents(
   if (video_player_destroyed_)
     return;
 
-  blink::InspectorPlayerEvents events;
   blink::InspectorPlayerProperties properties;
+  blink::InspectorPlayerMessages messages;
+  blink::InspectorPlayerEvents events;
+  blink::InspectorPlayerErrors errors;
 
   for (media::MediaLogRecord event : events_to_send) {
     switch (event.type) {
       case media::MediaLogRecord::Type::kMessage: {
         for (auto&& itr : event.params.DictItems()) {
-          blink::InspectorPlayerEvent ev = {
-              blink::InspectorPlayerEvent::MESSAGE_EVENT, event.time,
-              blink::WebString::FromUTF8(itr.first), ToString(itr.second)};
-          events.emplace_back(std::move(ev));
+          blink::InspectorPlayerMessage msg = {
+              LevelFromString(itr.first),
+              blink::WebString::FromUTF8(itr.second.GetString())};
+          messages.emplace_back(std::move(msg));
         }
         break;
       }
@@ -61,28 +78,32 @@ void InspectorMediaEventHandler::SendQueuedMediaEvents(
         break;
       }
       case media::MediaLogRecord::Type::kMediaEventTriggered: {
-        blink::InspectorPlayerEvent ev = {
-            blink::InspectorPlayerEvent::TRIGGERED_EVENT, event.time,
-            blink::WebString::FromUTF8("event"), ToString(event.params)};
+        blink::InspectorPlayerEvent ev = {event.time, ToString(event.params)};
         events.emplace_back(std::move(ev));
         break;
       }
       case media::MediaLogRecord::Type::kMediaStatus: {
-        // TODO(tmathmeyer) Make a new type in the browser protocol instead
-        // of overloading InspectorPlayerEvent.
-        blink::InspectorPlayerEvent ev = {
-            blink::InspectorPlayerEvent::ERROR_EVENT, event.time,
-            blink::WebString::FromUTF8("error"), ToString(event.params)};
-        events.emplace_back(std::move(ev));
+        base::Value* code = event.params.FindKey(media::MediaLog::kStatusText);
+        DCHECK_NE(code, nullptr);
+        blink::InspectorPlayerError error = {
+            blink::InspectorPlayerError::Type::kPipelineError, ToString(*code)};
+        errors.emplace_back(std::move(error));
         break;
       }
     }
   }
+
   if (!events.empty())
-    inspector_context_->NotifyPlayerEvents(player_id_, events);
+    inspector_context_->NotifyPlayerEvents(player_id_, std::move(events));
 
   if (!properties.empty())
-    inspector_context_->SetPlayerProperties(player_id_, properties);
+    inspector_context_->SetPlayerProperties(player_id_, std::move(properties));
+
+  if (!messages.empty())
+    inspector_context_->NotifyPlayerMessages(player_id_, std::move(messages));
+
+  if (!errors.empty())
+    inspector_context_->NotifyPlayerErrors(player_id_, std::move(errors));
 }
 
 void InspectorMediaEventHandler::OnWebMediaPlayerDestroyed() {
diff --git a/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc b/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
index c24700d9fb4..f647f469c88 100644
--- a/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
+++ b/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
@@ -23,17 +23,31 @@ class MockMediaInspectorContext : public blink::MediaInspectorContext {
   blink::WebString CreatePlayer() override { return "TestPlayer"; }
 
   void NotifyPlayerEvents(blink::WebString id,
-                          blink::InspectorPlayerEvents events) override {
+                          const blink::InspectorPlayerEvents& events) override {
     MockNotifyPlayerEvents(events);
   }
 
-  void SetPlayerProperties(blink::WebString id,
-                           blink::InspectorPlayerProperties props) override {
+  void SetPlayerProperties(
+      blink::WebString id,
+      const blink::InspectorPlayerProperties& props) override {
     MockSetPlayerProperties(props);
   }
 
+  void NotifyPlayerErrors(blink::WebString id,
+                          const blink::InspectorPlayerErrors& errors) override {
+    MockNotifyPlayerErrors(errors);
+  }
+
+  void NotifyPlayerMessages(
+      blink::WebString id,
+      const blink::InspectorPlayerMessages& messages) override {
+    MockNotifyPlayerMessages(messages);
+  }
+
   MOCK_METHOD1(MockNotifyPlayerEvents, void(blink::InspectorPlayerEvents));
   MOCK_METHOD1(MockSetPlayerProperties, void(blink::InspectorPlayerProperties));
+  MOCK_METHOD1(MockNotifyPlayerErrors, void(blink::InspectorPlayerErrors));
+  MOCK_METHOD1(MockNotifyPlayerMessages, void(blink::InspectorPlayerMessages));
 };
 
 class InspectorMediaEventHandlerTest : public testing::Test {
@@ -59,7 +73,7 @@ class InspectorMediaEventHandlerTest : public testing::Test {
     return event;
   }
 
-  media::MediaLogRecord CreatePropChangeEvent(
+  media::MediaLogRecord CreatePropChange(
       std::vector<std::pair<std::string, std::string>> props) {
     media::MediaLogRecord event;
     event.id = 0;
@@ -71,7 +85,7 @@ class InspectorMediaEventHandlerTest : public testing::Test {
     return event;
   }
 
-  media::MediaLogRecord CreateLogEvent(std::string msg) {
+  media::MediaLogRecord CreateMessage(std::string msg) {
     media::MediaLogRecord event;
     event.id = 0;
     event.type = media::MediaLogRecord::Type::kMessage;
@@ -80,6 +94,15 @@ class InspectorMediaEventHandlerTest : public testing::Test {
     return event;
   }
 
+  media::MediaLogRecord CreateError(int errorcode) {
+    media::MediaLogRecord error;
+    error.id = 0;
+    error.type = media::MediaLogRecord::Type::kMediaStatus;
+    error.time = base::TimeTicks();
+    error.params.SetIntPath(media::MediaLog::kStatusText, errorcode);
+    return error;
+  }
+
   DISALLOW_COPY_AND_ASSIGN(InspectorMediaEventHandlerTest);
 };
 
@@ -95,8 +118,7 @@ bool operator!=(const blink::InspectorPlayerProperty& lhs,
 
 bool operator==(const blink::InspectorPlayerEvent& lhs,
                 const blink::InspectorPlayerEvent& rhs) {
-  return lhs.type == rhs.type && lhs.timestamp == rhs.timestamp &&
-         lhs.key == rhs.key && lhs.value == rhs.value;
+  return lhs.timestamp == rhs.timestamp && lhs.value == rhs.value;
 }
 
 bool operator!=(const blink::InspectorPlayerEvent& lhs,
@@ -104,6 +126,26 @@ bool operator!=(const blink::InspectorPlayerEvent& lhs,
   return !(lhs == rhs);
 }
 
+bool operator==(const blink::InspectorPlayerMessage& lhs,
+                const blink::InspectorPlayerMessage& rhs) {
+  return lhs.level == rhs.level && lhs.message == rhs.message;
+}
+
+bool operator!=(const blink::InspectorPlayerMessage& lhs,
+                const blink::InspectorPlayerMessage& rhs) {
+  return !(lhs == rhs);
+}
+
+bool operator==(const blink::InspectorPlayerError& lhs,
+                const blink::InspectorPlayerError& rhs) {
+  return lhs.errorCode == rhs.errorCode;
+}
+
+bool operator!=(const blink::InspectorPlayerError& lhs,
+                const blink::InspectorPlayerError& rhs) {
+  return !(lhs == rhs);
+}
+
 MATCHER_P(PropertiesEqualTo, props, "") {
   if (props.size() != arg.size())
     return false;
@@ -122,9 +164,27 @@ MATCHER_P(EventsEqualTo, events, "") {
   return true;
 }
 
+MATCHER_P(MessagesEqualTo, messages, "") {
+  if (messages.size() != arg.size())
+    return false;
+  for (size_t i = 0; i < messages.size(); i++)
+    if (messages[i] != arg[i])
+      return false;
+  return true;
+}
+
+MATCHER_P(ErrorsEqualTo, errors, "") {
+  if (errors.size() != arg.size())
+    return false;
+  for (size_t i = 0; i < errors.size(); i++)
+    if (errors[i] != arg[i])
+      return false;
+  return true;
+}
+
 TEST_F(InspectorMediaEventHandlerTest, ConvertsProperties) {
   std::vector<media::MediaLogRecord> events = {
-      CreatePropChangeEvent({{"test_key", "test_value"}})};
+      CreatePropChange({{"test_key", "test_value"}})};
 
   blink::InspectorPlayerProperties expected;
   blink::InspectorPlayerProperty prop = {
@@ -141,7 +201,7 @@ TEST_F(InspectorMediaEventHandlerTest, ConvertsProperties) {
 
 TEST_F(InspectorMediaEventHandlerTest, SplitsDoubleProperties) {
   std::vector<media::MediaLogRecord> events = {
-      CreatePropChangeEvent({{"test_key", "test_value"}, {"foo", "bar"}})};
+      CreatePropChange({{"test_key", "test_value"}, {"foo", "bar"}})};
 
   blink::InspectorPlayerProperties expected;
   blink::InspectorPlayerProperty prop_test = {
@@ -161,19 +221,19 @@ TEST_F(InspectorMediaEventHandlerTest, SplitsDoubleProperties) {
 
 TEST_F(InspectorMediaEventHandlerTest, ConvertsMessageEvent) {
   std::vector<media::MediaLogRecord> events = {
-      CreateLogEvent("Has Anyone Really Been Far Even as Decided to Use Even "
-                     "Go Want to do Look More Like?")};
+      CreateMessage("Has Anyone Really Been Far Even as Decided to Use Even "
+                    "Go Want to do Look More Like?")};
 
-  blink::InspectorPlayerEvents expected;
-  blink::InspectorPlayerEvent e = {
-      blink::InspectorPlayerEvent::MESSAGE_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("warning"),
+  blink::InspectorPlayerMessages expected;
+  blink::InspectorPlayerMessage e = {
+      blink::InspectorPlayerMessage::Level::kWarning,
       blink::WebString::FromUTF8("Has Anyone Really Been Far Even as Decided "
                                  "to Use Even Go Want to do Look More Like?")};
   expected.emplace_back(e);
 
   EXPECT_CALL(*mock_context_, MockSetPlayerProperties(_)).Times(0);
-  EXPECT_CALL(*mock_context_, MockNotifyPlayerEvents(EventsEqualTo(expected)))
+  EXPECT_CALL(*mock_context_,
+              MockNotifyPlayerMessages(MessagesEqualTo(expected)))
       .Times(1);
 
   handler_->SendQueuedMediaEvents(events);
@@ -181,16 +241,15 @@ TEST_F(InspectorMediaEventHandlerTest, ConvertsMessageEvent) {
 
 TEST_F(InspectorMediaEventHandlerTest, ConvertsEventsAndProperties) {
   std::vector<media::MediaLogRecord> events = {
-      CreateLogEvent("100% medically accurate"),
-      CreatePropChangeEvent(
+      CreateMessage("100% medically accurate"),
+      CreatePropChange(
           {{"free_puppies", "all_taken"}, {"illuminati", "confirmed"}})};
 
-  blink::InspectorPlayerEvents expected_events;
-  blink::InspectorPlayerEvent e = {
-      blink::InspectorPlayerEvent::MESSAGE_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("warning"),
+  blink::InspectorPlayerMessages expected_messages;
+  blink::InspectorPlayerMessage e = {
+      blink::InspectorPlayerMessage::Level::kWarning,
       blink::WebString::FromUTF8("100% medically accurate")};
-  expected_events.emplace_back(e);
+  expected_messages.emplace_back(e);
 
   blink::InspectorPlayerProperties expected_properties;
   blink::InspectorPlayerProperty puppies = {
@@ -206,7 +265,7 @@ TEST_F(InspectorMediaEventHandlerTest, ConvertsEventsAndProperties) {
               MockSetPlayerProperties(PropertiesEqualTo(expected_properties)))
       .Times(1);
   EXPECT_CALL(*mock_context_,
-              MockNotifyPlayerEvents(EventsEqualTo(expected_events)))
+              MockNotifyPlayerMessages(MessagesEqualTo(expected_messages)))
       .Times(1);
 
   handler_->SendQueuedMediaEvents(events);
@@ -219,13 +278,9 @@ TEST_F(InspectorMediaEventHandlerTest, PassesPlayAndPauseEvents) {
 
   blink::InspectorPlayerEvents expected_events;
   blink::InspectorPlayerEvent play = {
-      blink::InspectorPlayerEvent::TRIGGERED_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("event"),
-      blink::WebString::FromUTF8("{\"event\":\"kPlay\"}")};
+      base::TimeTicks(), blink::WebString::FromUTF8("{\"event\":\"kPlay\"}")};
   blink::InspectorPlayerEvent pause = {
-      blink::InspectorPlayerEvent::TRIGGERED_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("event"),
-      blink::WebString::FromUTF8("{\"event\":\"kPause\"}")};
+      base::TimeTicks(), blink::WebString::FromUTF8("{\"event\":\"kPause\"}")};
   expected_events.emplace_back(play);
   expected_events.emplace_back(pause);
 
@@ -236,4 +291,24 @@ TEST_F(InspectorMediaEventHandlerTest, PassesPlayAndPauseEvents) {
   handler_->SendQueuedMediaEvents(events);
 }
 
+TEST_F(InspectorMediaEventHandlerTest, PassesErrorEvents) {
+  std::vector<media::MediaLogRecord> errors = {CreateError(5), CreateError(7)};
+
+  blink::InspectorPlayerErrors expected_errors;
+  blink::InspectorPlayerError first = {
+      blink::InspectorPlayerError::Type::kPipelineError,
+      blink::WebString::FromUTF8("5")};
+  blink::InspectorPlayerError second = {
+      blink::InspectorPlayerError::Type::kPipelineError,
+      blink::WebString::FromUTF8("7")};
+  expected_errors.emplace_back(first);
+  expected_errors.emplace_back(second);
+
+  EXPECT_CALL(*mock_context_,
+              MockNotifyPlayerErrors(ErrorsEqualTo(expected_errors)))
+      .Times(1);
+
+  handler_->SendQueuedMediaEvents(errors);
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/media/media_factory.cc b/chromium/content/renderer/media/media_factory.cc
index 9c8d0b0adec..a1c33d76de6 100644
--- a/chromium/content/renderer/media/media_factory.cc
+++ b/chromium/content/renderer/media/media_factory.cc
@@ -21,6 +21,7 @@
 #include "content/renderer/media/audio/audio_device_factory.h"
 #include "content/renderer/media/batching_media_log.h"
 #include "content/renderer/media/inspector_media_event_handler.h"
+#include "content/renderer/media/media_interface_factory.h"
 #include "content/renderer/media/power_status_helper_impl.h"
 #include "content/renderer/media/render_media_event_handler.h"
 #include "content/renderer/media/renderer_webmediaplayer_delegate.h"
@@ -30,6 +31,7 @@
 #include "media/base/bind_to_current_loop.h"
 #include "media/base/cdm_factory.h"
 #include "media/base/decoder_factory.h"
+#include "media/base/demuxer.h"
 #include "media/base/media_switches.h"
 #include "media/base/renderer_factory_selector.h"
 #include "media/blink/remote_playback_client_wrapper_impl.h"
@@ -71,10 +73,6 @@
 #include "content/renderer/media/cast_renderer_client_factory.h"
 #endif
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
-#include "content/renderer/media/media_interface_factory.h"
-#endif
-
 #if defined(OS_FUCHSIA)
 #include "content/renderer/media/fuchsia_renderer_factory.h"
 #include "media/fuchsia/cdm/client/fuchsia_cdm_util.h"
@@ -147,9 +145,16 @@ void PostContextProviderToCallback(
                      unwanted_context_provider));
 }
 
-void LogRoughness(int size, base::TimeDelta duration, double roughness) {
+void LogRoughness(media::MediaLog* media_log,
+                  int size,
+                  base::TimeDelta duration,
+                  double roughness) {
+  // This function can be called from any thread. Don't do anything that assumes
+  // a certain task runner.
   double fps = size / duration.InSecondsF();
-  DVLOG(1) << "Video playback roughness: " << roughness << " FPS: " << fps;
+  media_log->SetProperty<media::MediaLogProperty::kVideoPlaybackRoughness>(
+      roughness);
+  media_log->SetProperty<media::MediaLogProperty::kFramerate>(fps);
 }
 
 }  // namespace
@@ -230,7 +235,8 @@ bool UseMediaPlayerRenderer(const GURL& url) {
 std::unique_ptr<blink::WebVideoFrameSubmitter> MediaFactory::CreateSubmitter(
     scoped_refptr<base::SingleThreadTaskRunner>*
         video_frame_compositor_task_runner,
-    const cc::LayerTreeSettings& settings) {
+    const cc::LayerTreeSettings& settings,
+    media::MediaLog* media_log) {
   blink::WebMediaPlayer::SurfaceLayerMode use_surface_layer_for_video =
       GetVideoSurfaceLayerMode();
   content::RenderThreadImpl* render_thread =
@@ -267,11 +273,14 @@ std::unique_ptr<blink::WebVideoFrameSubmitter> MediaFactory::CreateSubmitter(
 
   if (use_surface_layer_for_video !=
       blink::WebMediaPlayer::SurfaceLayerMode::kNever) {
+    auto log_roughness_cb =
+        base::BindRepeating(LogRoughness, base::Owned(media_log->Clone()));
+    auto post_to_context_provider_cb = base::BindRepeating(
+        &PostContextProviderToCallback,
+        RenderThreadImpl::current()->GetCompositorMainThreadTaskRunner());
     submitter = blink::WebVideoFrameSubmitter::Create(
-        base::BindRepeating(
-            &PostContextProviderToCallback,
-            RenderThreadImpl::current()->GetCompositorMainThreadTaskRunner()),
-        base::BindRepeating(LogRoughness), settings, use_sync_primitives);
+        std::move(post_to_context_provider_cb), std::move(log_roughness_cb),
+        settings, use_sync_primitives);
   }
 
   DCHECK(*video_frame_compositor_task_runner);
@@ -334,12 +343,12 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
           media::kMemoryPressureBasedSourceBufferGC,
           "enable_instant_source_buffer_gc", false);
 
-  std::unique_ptr<BatchingMediaLog::EventHandler> event_handler;
+  std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> handlers;
+  handlers.push_back(std::make_unique<RenderMediaEventHandler>());
+
   if (base::FeatureList::IsEnabled(media::kMediaInspectorLogging)) {
-    event_handler =
-        std::make_unique<InspectorMediaEventHandler>(inspector_context);
-  } else {
-    event_handler = std::make_unique<RenderMediaEventHandler>();
+    handlers.push_back(
+        std::make_unique<InspectorMediaEventHandler>(inspector_context));
   }
 
   // This must be created for every new WebMediaPlayer, each instance generates
@@ -347,7 +356,7 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
   auto media_log = std::make_unique<BatchingMediaLog>(
       url::Origin(security_origin).GetURL(),
       render_frame_->GetTaskRunner(blink::TaskType::kInternalMedia),
-      std::move(event_handler));
+      std::move(handlers));
 
   base::WeakPtr<media::MediaObserver> media_observer;
   auto factory_selector = CreateRendererFactorySelector(
@@ -396,8 +405,8 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
 
   scoped_refptr<base::SingleThreadTaskRunner>
       video_frame_compositor_task_runner;
-  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter =
-      CreateSubmitter(&video_frame_compositor_task_runner, settings);
+  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter = CreateSubmitter(
+      &video_frame_compositor_task_runner, settings, media_log.get());
 
   scoped_refptr<base::SingleThreadTaskRunner> media_task_runner =
       render_thread->GetMediaThreadTaskRunner();
@@ -427,7 +436,8 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
           enable_instant_source_buffer_gc, embedded_media_experience_enabled,
           std::move(metrics_provider),
           base::BindOnce(&blink::WebSurfaceLayerBridge::Create,
-                         parent_frame_sink_id),
+                         parent_frame_sink_id,
+                         blink::WebSurfaceLayerBridge::ContainsVideo::kYes),
           RenderThreadImpl::current()->SharedMainThreadContextProvider(),
           GetVideoSurfaceLayerMode(),
           render_frame_->GetRenderFrameMediaPlaybackOptions()
@@ -438,6 +448,8 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
               .is_background_video_track_optimization_supported,
           render_frame_->GetRenderFrameMediaPlaybackOptions()
               .is_remoting_renderer_enabled(),
+          GetContentClient()->renderer()->OverrideDemuxerForUrl(
+              render_frame_, url, media_task_runner),
           std::move(power_status_helper)));
 
   std::unique_ptr<media::VideoFrameCompositor> vfc =
@@ -542,27 +554,31 @@ MediaFactory::CreateRendererFactorySelector(
 #endif  // BUILDFLAG(ENABLE_MOJO_RENDERER)
 
 #if defined(OS_FUCHSIA)
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableFuchsiaAudioConsumer)) {
-    use_default_renderer_factory = false;
-    factory_selector->AddBaseFactory(
-        FactoryType::kFuchsia,
-        std::make_unique<FuchsiaRendererFactory>(
-            media_log, decoder_factory,
-            base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
-                                base::Unretained(render_thread)),
-            render_frame_->GetBrowserInterfaceBroker()));
-  }
+  use_default_renderer_factory = false;
+  factory_selector->AddBaseFactory(
+      FactoryType::kFuchsia,
+      std::make_unique<FuchsiaRendererFactory>(
+          media_log, decoder_factory,
+          base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
+                              base::Unretained(render_thread)),
+          render_frame_->GetBrowserInterfaceBroker()));
 #endif  // defined(OS_FUCHSIA)
 
   if (use_default_renderer_factory) {
-    factory_selector->AddBaseFactory(
-        FactoryType::kDefault,
-        std::make_unique<media::DefaultRendererFactory>(
-            media_log, decoder_factory,
-            base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
-                                base::Unretained(render_thread)),
-            render_frame_->CreateSpeechRecognitionClient()));
+#if defined(OS_ANDROID)
+    auto default_factory = std::make_unique<media::DefaultRendererFactory>(
+        media_log, decoder_factory,
+        base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
+                            base::Unretained(render_thread)));
+#else
+    auto default_factory = std::make_unique<media::DefaultRendererFactory>(
+        media_log, decoder_factory,
+        base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
+                            base::Unretained(render_thread)),
+        render_frame_->CreateSpeechRecognitionClient());
+#endif
+    factory_selector->AddBaseFactory(FactoryType::kDefault,
+                                     std::move(default_factory));
   }
 
 #if BUILDFLAG(ENABLE_MEDIA_REMOTING)
@@ -605,15 +621,13 @@ blink::WebMediaPlayer* MediaFactory::CreateWebMediaPlayerForMediaStream(
 
   scoped_refptr<base::SingleThreadTaskRunner>
       video_frame_compositor_task_runner;
-  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter =
-      CreateSubmitter(&video_frame_compositor_task_runner, settings);
 
-  std::unique_ptr<BatchingMediaLog::EventHandler> event_handler;
+  std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> handlers;
+  handlers.push_back(std::make_unique<RenderMediaEventHandler>());
+
   if (base::FeatureList::IsEnabled(media::kMediaInspectorLogging)) {
-    event_handler =
-        std::make_unique<InspectorMediaEventHandler>(inspector_context);
-  } else {
-    event_handler = std::make_unique<RenderMediaEventHandler>();
+    handlers.push_back(
+        std::make_unique<InspectorMediaEventHandler>(inspector_context));
   }
 
   // This must be created for every new WebMediaPlayer, each instance generates
@@ -621,7 +635,10 @@ blink::WebMediaPlayer* MediaFactory::CreateWebMediaPlayerForMediaStream(
   auto media_log = std::make_unique<BatchingMediaLog>(
       url::Origin(security_origin).GetURL(),
       render_frame_->GetTaskRunner(blink::TaskType::kInternalMedia),
-      std::move(event_handler));
+      std::move(handlers));
+
+  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter = CreateSubmitter(
+      &video_frame_compositor_task_runner, settings, media_log.get());
 
   return new blink::WebMediaPlayerMS(
       frame, client, GetWebMediaPlayerDelegate(), std::move(media_log),
@@ -632,7 +649,8 @@ blink::WebMediaPlayer* MediaFactory::CreateWebMediaPlayerForMediaStream(
       render_thread->GetWorkerTaskRunner(), render_thread->GetGpuFactories(),
       sink_id,
       base::BindOnce(&blink::WebSurfaceLayerBridge::Create,
-                     parent_frame_sink_id),
+                     parent_frame_sink_id,
+                     blink::WebSurfaceLayerBridge::ContainsVideo::kYes),
       std::move(submitter), GetVideoSurfaceLayerMode());
 }
 
@@ -688,7 +706,6 @@ media::CdmFactory* MediaFactory::GetCdmFactory() {
   return cdm_factory_.get();
 }
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
 media::mojom::InterfaceFactory* MediaFactory::GetMediaInterfaceFactory() {
   DCHECK(interface_broker_);
 
@@ -705,6 +722,5 @@ MediaFactory::CreateMojoRendererFactory() {
   return std::make_unique<media::MojoRendererFactory>(
       GetMediaInterfaceFactory());
 }
-#endif  // BUILDFLAG(ENABLE_MOJO_MEDIA)
 
 }  // namespace content
diff --git a/chromium/content/renderer/media/media_factory.h b/chromium/content/renderer/media/media_factory.h
index 0c65658918f..508690707a4 100644
--- a/chromium/content/renderer/media/media_factory.h
+++ b/chromium/content/renderer/media/media_factory.h
@@ -16,6 +16,8 @@
 #include "media/blink/webmediaplayer_params.h"
 #include "media/media_buildflags.h"
 #include "media/mojo/buildflags.h"
+#include "media/mojo/clients/mojo_renderer_factory.h"
+#include "media/mojo/mojom/interface_factory.mojom.h"
 #include "media/mojo/mojom/remoting.mojom.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/platform/web_media_player_source.h"
@@ -24,11 +26,6 @@
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/web/web_media_inspector.h"
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
-#include "media/mojo/clients/mojo_renderer_factory.h"  // nogncheck
-#include "media/mojo/mojom/interface_factory.mojom.h"  // nogncheck
-#endif
-
 namespace blink {
 class BrowserInterfaceBrokerProxy;
 class WebContentDecryptionModule;
@@ -86,7 +83,8 @@ class MediaFactory {
   std::unique_ptr<blink::WebVideoFrameSubmitter> CreateSubmitter(
       scoped_refptr<base::SingleThreadTaskRunner>*
           video_frame_compositor_task_runner,
-      const cc::LayerTreeSettings& settings);
+      const cc::LayerTreeSettings& settings,
+      media::MediaLog* media_log);
 
   // Creates a new WebMediaPlayer for the given |source| (either a stream or
   // URL). All pointers other than |initial_cdm| are required to be non-null.
@@ -142,19 +140,17 @@ class MediaFactory {
 
   media::CdmFactory* GetCdmFactory();
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
   media::mojom::InterfaceFactory* GetMediaInterfaceFactory();
 
   std::unique_ptr<media::MojoRendererFactory> CreateMojoRendererFactory();
 
-  // The media interface provider attached to this frame, lazily initialized.
-  std::unique_ptr<MediaInterfaceFactory> media_interface_factory_;
-#endif
-
   // The render frame we're helping. RenderFrameImpl owns this factory, so the
   // pointer will always be valid.
   RenderFrameImpl* render_frame_;
 
+  // The media interface provider attached to this frame, lazily initialized.
+  std::unique_ptr<MediaInterfaceFactory> media_interface_factory_;
+
   // Injected callback for requesting overlay routing tokens.
   media::RequestRoutingTokenCallback request_routing_token_cb_;
 
diff --git a/chromium/content/renderer/media/media_interface_factory.cc b/chromium/content/renderer/media/media_interface_factory.cc
index e816e91020a..8bd2766133a 100644
--- a/chromium/content/renderer/media/media_interface_factory.cc
+++ b/chromium/content/renderer/media/media_interface_factory.cc
@@ -143,28 +143,6 @@ void MediaInterfaceFactory::CreateCdm(
   GetMediaInterfaceFactory()->CreateCdm(key_system, std::move(receiver));
 }
 
-void MediaInterfaceFactory::CreateDecryptor(
-    int cdm_id,
-    mojo::PendingReceiver<media::mojom::Decryptor> receiver) {
-  if (!task_runner_->BelongsToCurrentThread()) {
-    task_runner_->PostTask(
-        FROM_HERE, base::BindOnce(&MediaInterfaceFactory::CreateDecryptor,
-                                  weak_this_, cdm_id, std::move(receiver)));
-    return;
-  }
-
-  DVLOG(1) << __func__;
-  GetMediaInterfaceFactory()->CreateDecryptor(cdm_id, std::move(receiver));
-}
-
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-void MediaInterfaceFactory::CreateCdmProxy(
-    const base::Token& cdm_guid,
-    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {
-  NOTREACHED() << "CdmProxy should only be connected from a library CDM";
-}
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-
 media::mojom::InterfaceFactory*
 MediaInterfaceFactory::GetMediaInterfaceFactory() {
   DVLOG(1) << __func__;
diff --git a/chromium/content/renderer/media/media_interface_factory.h b/chromium/content/renderer/media/media_interface_factory.h
index b876ba0517f..0f5e08c5f95 100644
--- a/chromium/content/renderer/media/media_interface_factory.h
+++ b/chromium/content/renderer/media/media_interface_factory.h
@@ -65,14 +65,6 @@ class CONTENT_EXPORT MediaInterfaceFactory
   void CreateCdm(const std::string& key_system,
                  mojo::PendingReceiver<media::mojom::ContentDecryptionModule>
                      receiver) final;
-  void CreateDecryptor(
-      int cdm_id,
-      mojo::PendingReceiver<media::mojom::Decryptor> receiver) final;
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  void CreateCdmProxy(
-      const base::Token& cdm_guid,
-      mojo::PendingReceiver<media::mojom::CdmProxy> receiver) final;
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
 
  private:
   media::mojom::InterfaceFactory* GetMediaInterfaceFactory();
diff --git a/chromium/content/renderer/media/render_media_client.cc b/chromium/content/renderer/media/render_media_client.cc
index e1878231f4e..ae86139534d 100644
--- a/chromium/content/renderer/media/render_media_client.cc
+++ b/chromium/content/renderer/media/render_media_client.cc
@@ -5,7 +5,6 @@
 #include "content/renderer/media/render_media_client.h"
 
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/time/default_tick_clock.h"
 #include "content/public/common/content_client.h"
 #include "content/public/renderer/content_renderer_client.h"
diff --git a/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc b/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc
index 40dd3becb0e..7eefa1dd352 100644
--- a/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc
+++ b/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc
@@ -10,8 +10,11 @@
 #include <string>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
-#include "base/logging.h"
+#include "base/notreached.h"
+#include "base/task/task_traits.h"
+#include "base/task/thread_pool.h"
 #include "base/time/time.h"
 #include "content/renderer/media/audio/audio_device_factory.h"
 #include "content/renderer/render_frame_impl.h"
@@ -61,15 +64,12 @@ int GetOutputBufferSize(const blink::WebAudioLatencyHint& latency_hint,
     case media::AudioLatency::LATENCY_INTERACTIVE:
       return media::AudioLatency::GetInteractiveBufferSize(
           hardware_params.frames_per_buffer());
-      break;
     case media::AudioLatency::LATENCY_RTC:
       return media::AudioLatency::GetRtcBufferSize(
           hardware_params.sample_rate(), hardware_params.frames_per_buffer());
-      break;
     case media::AudioLatency::LATENCY_PLAYBACK:
       return media::AudioLatency::GetHighLatencyBufferSize(
           hardware_params.sample_rate(), hardware_params.frames_per_buffer());
-      break;
     case media::AudioLatency::LATENCY_EXACT_MS:
       return media::AudioLatency::GetExactBufferSize(
           base::TimeDelta::FromSecondsD(latency_hint.Seconds()),
@@ -77,7 +77,6 @@ int GetOutputBufferSize(const blink::WebAudioLatencyHint& latency_hint,
           hardware_capabilities.min_frames_per_buffer,
           hardware_capabilities.max_frames_per_buffer,
           media::limits::kMaxWebAudioBufferSize);
-      break;
     default:
       NOTREACHED();
   }
@@ -180,12 +179,12 @@ void RendererWebAudioDeviceImpl::Start() {
       GetLatencyHintSourceType(latency_hint_.Category()), frame_id_,
       media::AudioSinkParameters(session_id_, std::string()));
 
-  // Use the media thread instead of the render thread for fake Render() calls
+  // Use a task runner instead of the render thread for fake Render() calls
   // since it has special connotations for Blink and garbage collection. Timeout
   // value chosen to be highly unlikely in the normal case.
   webaudio_suspender_.reset(new media::SilentSinkSuspender(
       this, base::TimeDelta::FromSeconds(30), sink_params_, sink_,
-      GetMediaTaskRunner()));
+      GetSuspenderTaskRunner()));
   sink_->Initialize(sink_params_, webaudio_suspender_.get());
 
   sink_->Start();
@@ -196,6 +195,8 @@ void RendererWebAudioDeviceImpl::Pause() {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (sink_)
     sink_->Pause();
+  if (webaudio_suspender_)
+    webaudio_suspender_->OnPaused();
 }
 
 void RendererWebAudioDeviceImpl::Resume() {
@@ -222,6 +223,14 @@ int RendererWebAudioDeviceImpl::FramesPerBuffer() {
   return sink_params_.frames_per_buffer();
 }
 
+void RendererWebAudioDeviceImpl::SetDetectSilence(
+    bool enable_silence_detection) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  if (webaudio_suspender_)
+    webaudio_suspender_->SetDetectSilence(enable_silence_detection);
+}
+
 int RendererWebAudioDeviceImpl::Render(base::TimeDelta delay,
                                        base::TimeTicks delay_timestamp,
                                        int prior_frames_skipped,
@@ -249,18 +258,19 @@ void RendererWebAudioDeviceImpl::OnRenderError() {
   // TODO(crogers): implement error handling.
 }
 
-void RendererWebAudioDeviceImpl::SetMediaTaskRunnerForTesting(
-    const scoped_refptr<base::SingleThreadTaskRunner>& media_task_runner) {
-  media_task_runner_ = media_task_runner;
+void RendererWebAudioDeviceImpl::SetSuspenderTaskRunnerForTesting(
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
+  suspender_task_runner_ = std::move(task_runner);
 }
 
-const scoped_refptr<base::SingleThreadTaskRunner>&
-RendererWebAudioDeviceImpl::GetMediaTaskRunner() {
-  if (!media_task_runner_) {
-    media_task_runner_ =
-        RenderThreadImpl::current()->GetMediaThreadTaskRunner();
+scoped_refptr<base::SingleThreadTaskRunner>
+RendererWebAudioDeviceImpl::GetSuspenderTaskRunner() {
+  if (!suspender_task_runner_) {
+    suspender_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+        {base::TaskPriority::USER_VISIBLE,
+         base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
   }
-  return media_task_runner_;
+  return suspender_task_runner_;
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/media/renderer_webaudiodevice_impl.h b/chromium/content/renderer/media/renderer_webaudiodevice_impl.h
index 8dc13163ca6..870cf492fc7 100644
--- a/chromium/content/renderer/media/renderer_webaudiodevice_impl.h
+++ b/chromium/content/renderer/media/renderer_webaudiodevice_impl.h
@@ -50,6 +50,10 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
   double SampleRate() override;
   int FramesPerBuffer() override;
 
+  // Sets the detect silence flag for SilentSinkSuspender. Invoked by Blink Web
+  // Audio.
+  void SetDetectSilence(bool enable_silence_detection) override;
+
   // AudioRendererSink::RenderCallback implementation.
   int Render(base::TimeDelta delay,
              base::TimeTicks delay_timestamp,
@@ -58,8 +62,8 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
 
   void OnRenderError() override;
 
-  void SetMediaTaskRunnerForTesting(
-      const scoped_refptr<base::SingleThreadTaskRunner>& media_task_runner);
+  void SetSuspenderTaskRunnerForTesting(
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   const media::AudioParameters& get_sink_params_for_testing() {
     return sink_params_;
@@ -84,7 +88,7 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
                              RenderFrameIdCallback render_frame_id_cb);
 
  private:
-  const scoped_refptr<base::SingleThreadTaskRunner>& GetMediaTaskRunner();
+  scoped_refptr<base::SingleThreadTaskRunner> GetSuspenderTaskRunner();
 
   media::AudioParameters sink_params_;
 
@@ -109,8 +113,8 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
   // Render frame routing ID for the current context.
   int frame_id_;
 
-  // Allow unit tests to set a custom MediaThreadTaskRunner.
-  scoped_refptr<base::SingleThreadTaskRunner> media_task_runner_;
+  // Allow unit tests to set a custom TaskRunner for |webaudio_suspender_|.
+  scoped_refptr<base::SingleThreadTaskRunner> suspender_task_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(RendererWebAudioDeviceImpl);
 };
diff --git a/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc b/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
index 9d993147d95..8d0e3ca1099 100644
--- a/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
+++ b/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
@@ -71,7 +71,7 @@ class RendererWebAudioDeviceImplTest
     webaudio_device_.reset(new RendererWebAudioDeviceImplUnderTest(
         media::CHANNEL_LAYOUT_MONO, 1, latencyHint, this,
         base::UnguessableToken()));
-    webaudio_device_->SetMediaTaskRunnerForTesting(
+    webaudio_device_->SetSuspenderTaskRunnerForTesting(
         blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   }
 
@@ -81,7 +81,7 @@ class RendererWebAudioDeviceImplTest
         blink::WebAudioLatencyHint(
             blink::WebAudioLatencyHint::kCategoryInteractive),
         this, base::UnguessableToken()));
-    webaudio_device_->SetMediaTaskRunnerForTesting(
+    webaudio_device_->SetSuspenderTaskRunnerForTesting(
         blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   }
 
diff --git a/chromium/content/renderer/mouse_lock_dispatcher.cc b/chromium/content/renderer/mouse_lock_dispatcher.cc
index 34e33042f02..2ed4f462d0f 100644
--- a/chromium/content/renderer/mouse_lock_dispatcher.cc
+++ b/chromium/content/renderer/mouse_lock_dispatcher.cc
@@ -4,14 +4,13 @@
 
 #include "content/renderer/mouse_lock_dispatcher.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 
 namespace content {
 
 MouseLockDispatcher::MouseLockDispatcher()
-    : mouse_locked_(false),
-      pending_lock_request_(false),
+    : pending_lock_request_(false),
       pending_unlock_request_(false),
       target_(nullptr) {}
 
@@ -39,23 +38,27 @@ bool MouseLockDispatcher::ChangeMouseLock(
     blink::WebLocalFrame* requester_frame,
     blink::WebWidgetClient::PointerLockCallback callback,
     bool request_unadjusted_movement) {
-  if (pending_lock_request_ || pending_unlock_request_)
+  if (!mouse_lock_context_)
     return false;
 
-  pending_lock_request_ = true;
-  target_ = target;
-
   lock_mouse_callback_ = std::move(callback);
-
-  SendChangeLockRequest(requester_frame, request_unadjusted_movement);
+  // Unretained is safe because |this| owns the mojo::Remote
+  mouse_lock_context_->RequestMouseLockChange(
+      request_unadjusted_movement,
+      base::BindOnce(&MouseLockDispatcher::OnChangeLockAck,
+                     base::Unretained(this)));
   return true;
 }
 
-void MouseLockDispatcher::UnlockMouse(LockTarget* target) {
-  if (target && target == target_ && !pending_unlock_request_) {
-    pending_unlock_request_ = true;
+void MouseLockDispatcher::FlushContextPipeForTesting() {
+  if (mouse_lock_context_)
+    mouse_lock_context_.FlushForTesting();
+}
 
-    SendUnlockMouseRequest();
+void MouseLockDispatcher::UnlockMouse(LockTarget* target) {
+  if (IsMouseLockedTo(target)) {
+    mouse_lock_context_.reset();
+    target->OnMouseLockLost();
   }
 }
 
@@ -71,12 +74,12 @@ void MouseLockDispatcher::ClearLockTarget() {
 }
 
 bool MouseLockDispatcher::IsMouseLockedTo(LockTarget* target) {
-  return mouse_locked_ && target_ == target;
+  return mouse_lock_context_ && target_ == target;
 }
 
 bool MouseLockDispatcher::WillHandleMouseEvent(
     const blink::WebMouseEvent& event) {
-  if (mouse_locked_ && target_)
+  if (mouse_lock_context_ && target_)
     return target_->HandleMouseLockedInputEvent(event);
   return false;
 }
@@ -90,24 +93,31 @@ void MouseLockDispatcher::OnChangeLockAck(
 }
 
 void MouseLockDispatcher::OnLockMouseACK(
-    blink::mojom::PointerLockResult result) {
-  DCHECK(!mouse_locked_ && pending_lock_request_);
+    blink::mojom::PointerLockResult result,
+    mojo::PendingRemote<blink::mojom::PointerLockContext> context) {
+  DCHECK(!mouse_lock_context_ && pending_lock_request_);
 
-  mouse_locked_ = result == blink::mojom::PointerLockResult::kSuccess;
   pending_lock_request_ = false;
-  if (pending_unlock_request_ && !mouse_locked_) {
+  if (pending_unlock_request_ && !context) {
     // We have sent an unlock request after the lock request. However, since
     // the lock request has failed, the unlock request will be ignored by the
     // browser side and there won't be any response to it.
     pending_unlock_request_ = false;
   }
 
-  if (lock_mouse_callback_) {
-    std::move(lock_mouse_callback_).Run(result);
+  if (context) {
+    mouse_lock_context_.Bind(std::move(context));
+    // The browser might unlock the mouse for many reasons including closing
+    // the tab, the user hitting esc, the page losing focus, and more.
+    mouse_lock_context_.set_disconnect_handler(base::BindOnce(
+        &MouseLockDispatcher::OnMouseLockLost, base::Unretained(this)));
   }
 
+  if (lock_mouse_callback_)
+    std::move(lock_mouse_callback_).Run(result);
+
   LockTarget* last_target = target_;
-  if (!mouse_locked_)
+  if (!mouse_lock_context_)
     target_ = nullptr;
 
   // Callbacks made after all state modification to prevent reentrant errors
@@ -119,9 +129,8 @@ void MouseLockDispatcher::OnLockMouseACK(
 }
 
 void MouseLockDispatcher::OnMouseLockLost() {
-  DCHECK(mouse_locked_ && !pending_lock_request_);
-
-  mouse_locked_ = false;
+  DCHECK(mouse_lock_context_ && !pending_lock_request_);
+  mouse_lock_context_.reset();
   pending_unlock_request_ = false;
 
   LockTarget* last_target = target_;
diff --git a/chromium/content/renderer/mouse_lock_dispatcher.h b/chromium/content/renderer/mouse_lock_dispatcher.h
index 9e5f13a78c6..7e2838de8a5 100644
--- a/chromium/content/renderer/mouse_lock_dispatcher.h
+++ b/chromium/content/renderer/mouse_lock_dispatcher.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/common/input/input_handler.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/web/web_widget_client.h"
 
 namespace blink {
@@ -45,8 +46,8 @@ class CONTENT_EXPORT MouseLockDispatcher {
                        blink::WebLocalFrame* requester_frame,
                        blink::WebWidgetClient::PointerLockCallback callback,
                        bool request_unadjusted_movement);
-  // Request to unlock the mouse. An asynchronous response to
-  // target->OnMouseLockLost() will follow.
+  // Request to unlock the mouse. This call destroys the |mouse_lock_context_|.
+  // A response to target->OnMouseLockLost() will follow.
   void UnlockMouse(LockTarget* target);
   // Clears out the reference to the |target| because it has or is being
   // destroyed. Unlocks if locked. The pointer will not be accessed.
@@ -60,35 +61,34 @@ class CONTENT_EXPORT MouseLockDispatcher {
 
   // Subclasses or users have to call these methods to report mouse lock events
   // from the browser.
-  void OnLockMouseACK(blink::mojom::PointerLockResult result);
+  void OnLockMouseACK(
+      blink::mojom::PointerLockResult result,
+      mojo::PendingRemote<blink::mojom::PointerLockContext> context);
   void OnChangeLockAck(blink::mojom::PointerLockResult result);
-  void OnMouseLockLost();
+
+  void FlushContextPipeForTesting();
 
  protected:
   // Subclasses must implement these methods to send mouse lock requests to the
   // browser.
   virtual void SendLockMouseRequest(blink::WebLocalFrame* requester_frame,
                                     bool request_unadjusted_movement) = 0;
-  virtual void SendChangeLockRequest(blink::WebLocalFrame* requester_frame,
-                                     bool request_unadjusted_movement) {}
-  virtual void SendUnlockMouseRequest() = 0;
-
-  base::WeakPtr<MouseLockDispatcher> AsWeakPtr() {
-    return weak_ptr_factory_.GetWeakPtr();
-  }
 
  private:
   bool MouseLockedOrPendingAction() const {
-    return mouse_locked_ || pending_lock_request_ || pending_unlock_request_;
+    return mouse_lock_context_ || pending_lock_request_ ||
+           pending_unlock_request_;
   }
 
-  bool mouse_locked_;
+  void OnMouseLockLost();
+
   // If both |pending_lock_request_| and |pending_unlock_request_| are true,
   // it means a lock request was sent before an unlock request and we haven't
   // received responses for them. The logic in LockMouse() makes sure that a
   // lock request won't be sent when there is a pending unlock request.
   bool pending_lock_request_;
   bool pending_unlock_request_;
+  mojo::Remote<blink::mojom::PointerLockContext> mouse_lock_context_;
 
   blink::WebWidgetClient::PointerLockCallback lock_mouse_callback_;
 
@@ -97,8 +97,6 @@ class CONTENT_EXPORT MouseLockDispatcher {
   // when it is destroyed.
   LockTarget* target_;
 
-  base::WeakPtrFactory<MouseLockDispatcher> weak_ptr_factory_{this};
-
   DISALLOW_COPY_AND_ASSIGN(MouseLockDispatcher);
 };
 
diff --git a/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc b/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc
index 0fb45b6dfa0..af32de7cafe 100644
--- a/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc
+++ b/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/public/test/render_view_test.h"
 #include "content/renderer/mouse_lock_dispatcher.h"
 #include "content/renderer/render_view_impl.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
@@ -25,6 +26,13 @@ class MockLockTarget : public MouseLockDispatcher::LockTarget {
                 bool(const blink::WebMouseEvent&));
 };
 
+class PointerLockContextImpl : public blink::mojom::PointerLockContext {
+ public:
+  void RequestMouseLockChange(
+      bool unadjusted_movement,
+      PointerLockContext::RequestMouseLockChangeCallback response) override {}
+};
+
 // MouseLockDispatcher is a RenderViewObserver, and we test it by creating a
 // fixture containing a RenderViewImpl view() and interacting to that interface.
 class MouseLockDispatcherTest : public RenderViewTest {
@@ -66,19 +74,27 @@ TEST_F(MouseLockDispatcherTest, BasicWebWidget) {
   EXPECT_TRUE(widget()->RequestPointerLock(
       view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(widget()->IsPointerLocked());
 
   // Unlock.
   widget()->RequestPointerUnlock();
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(widget()->IsPointerLocked());
 
   // Attempt a lock, and have it fail.
   EXPECT_TRUE(widget()->RequestPointerLock(
       view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError);
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError,
+                               mojo::NullRemote());
   EXPECT_FALSE(widget()->IsPointerLocked());
 }
 
@@ -98,22 +114,28 @@ TEST_F(MouseLockDispatcherTest, BasicMockLockTarget) {
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
   // Receive mouse event.
   dispatcher()->WillHandleMouseEvent(blink::WebMouseEvent());
 
   // Unlock.
-  dispatcher()->UnlockMouse(target_);
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 
   // Attempt a lock, and have it fail.
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError);
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError,
+                               mojo::NullRemote());
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 }
 
@@ -122,22 +144,28 @@ TEST_F(MouseLockDispatcherTest, DeleteAndUnlock) {
   ::testing::InSequence expect_calls_in_sequence;
   EXPECT_CALL(*target_, OnLockMouseACK(/*succeeded=*/true));
   EXPECT_CALL(*target_, HandleMouseLockedInputEvent(_)).Times(0);
-  EXPECT_CALL(*target_, OnMouseLockLost()).Times(0);
+  EXPECT_CALL(*target_, OnMouseLockLost()).Times(1);
 
   // Lock.
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
-  // Unlock, with a deleted target.
-  // Don't receive mouse events or lock lost.
+  // Unlock, with a deleted target and context destruction.
+  // Don't receive mouse events.
   dispatcher()->OnLockTargetDestroyed(target_);
   delete target_;
   target_ = nullptr;
   dispatcher()->WillHandleMouseEvent(blink::WebMouseEvent());
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 }
 
@@ -158,7 +186,9 @@ TEST_F(MouseLockDispatcherTest, DeleteWithPendingLockSuccess) {
   target_ = nullptr;
 
   // Lock response.
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> context;
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(context));
 }
 
 // Test deleting a target that is pending a lock request failure response.
@@ -178,7 +208,8 @@ TEST_F(MouseLockDispatcherTest, DeleteWithPendingLockFail) {
   target_ = nullptr;
 
   // Lock response.
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError);
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError,
+                               mojo::NullRemote());
 }
 
 // Test not receiving mouse events when a target is not locked.
@@ -197,15 +228,20 @@ TEST_F(MouseLockDispatcherTest, MouseEventsNotReceived) {
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
   // Receive mouse event.
   dispatcher()->WillHandleMouseEvent(blink::WebMouseEvent());
 
   // Unlock.
-  dispatcher()->UnlockMouse(target_);
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 
   // (Don't) receive mouse event.
@@ -234,7 +270,14 @@ TEST_F(MouseLockDispatcherTest, MultipleTargets) {
       base::DoNothing(), false /* unadjusted_movement */));
 
   // Lock completion for target.
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
   // Fail attempt to lock alternate.
@@ -252,9 +295,10 @@ TEST_F(MouseLockDispatcherTest, MultipleTargets) {
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(alternate_target_));
 
   // Though the call to UnlockMouse should not unlock any target, we will
-  // cause an unlock (as if e.g. user escaped mouse lock) and verify the
-  // correct target is unlocked.
-  widget()->PointerLockLost();
+  // cause an unlock by disconnecting the pipe (e.g. user escaped
+  // mouse lock) and verify the correct target is unlocked.
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 }
 
diff --git a/chromium/content/renderer/navigation_state.h b/chromium/content/renderer/navigation_state.h
index 0d505d791c9..375495ca33d 100644
--- a/chromium/content/renderer/navigation_state.h
+++ b/chromium/content/renderer/navigation_state.h
@@ -77,10 +77,6 @@ class CONTENT_EXPORT NavigationState {
     navigation_client_ = std::move(navigation_client_impl);
   }
 
-  void set_navigation_start(const base::TimeTicks& navigation_start) {
-    common_params_->navigation_start = navigation_start;
-  }
-
   void RunCommitNavigationCallback(blink::mojom::CommitResult result);
 
   void RunPerNavigationInterfaceCommitNavigationCallback(
diff --git a/chromium/content/renderer/pepper/DEPS b/chromium/content/renderer/pepper/DEPS
index 016a0618b4f..f39485257d4 100644
--- a/chromium/content/renderer/pepper/DEPS
+++ b/chromium/content/renderer/pepper/DEPS
@@ -9,4 +9,5 @@ include_rules = [
   "+third_party/opus",
   "+ui/base/ime",
   "+ui/base/range",
+  "+ui/events/keycodes/keyboard_codes.h",
 ]
diff --git a/chromium/content/renderer/pepper/audio_helper.cc b/chromium/content/renderer/pepper/audio_helper.cc
index d9c0b1d37bb..eb8462c7940 100644
--- a/chromium/content/renderer/pepper/audio_helper.cc
+++ b/chromium/content/renderer/pepper/audio_helper.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/audio_helper.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/pepper_file_util.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
diff --git a/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc b/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc
index a7f102fe9f9..8892d3c050d 100644
--- a/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc
+++ b/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc
@@ -6,8 +6,9 @@
 
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ptr_util.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "content/common/content_switches_internal.h"
diff --git a/chromium/content/renderer/pepper/event_conversion.cc b/chromium/content/renderer/pepper/event_conversion.cc
index b2df311ac6f..0f8b87b33d2 100644
--- a/chromium/content/renderer/pepper/event_conversion.cc
+++ b/chromium/content/renderer/pepper/event_conversion.cc
@@ -11,9 +11,10 @@
 #include <algorithm>
 #include <memory>
 
+#include "base/check_op.h"
 #include "base/feature_list.h"
 #include "base/i18n/char_iterator.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -95,40 +96,40 @@ static_assert(static_cast<int>(PP_INPUTEVENT_MODIFIER_ISRIGHT) ==
 
 PP_InputEvent_Type ConvertEventTypes(const WebInputEvent& event) {
   switch (event.GetType()) {
-    case WebInputEvent::kMouseDown:
+    case WebInputEvent::Type::kMouseDown:
       return PP_INPUTEVENT_TYPE_MOUSEDOWN;
-    case WebInputEvent::kMouseUp:
+    case WebInputEvent::Type::kMouseUp:
       return PP_INPUTEVENT_TYPE_MOUSEUP;
-    case WebInputEvent::kMouseMove:
+    case WebInputEvent::Type::kMouseMove:
       return PP_INPUTEVENT_TYPE_MOUSEMOVE;
-    case WebInputEvent::kMouseEnter:
+    case WebInputEvent::Type::kMouseEnter:
       return PP_INPUTEVENT_TYPE_MOUSEENTER;
-    case WebInputEvent::kMouseLeave:
+    case WebInputEvent::Type::kMouseLeave:
       return PP_INPUTEVENT_TYPE_MOUSELEAVE;
-    case WebInputEvent::kContextMenu:
+    case WebInputEvent::Type::kContextMenu:
       return PP_INPUTEVENT_TYPE_CONTEXTMENU;
-    case WebInputEvent::kMouseWheel:
+    case WebInputEvent::Type::kMouseWheel:
       return PP_INPUTEVENT_TYPE_WHEEL;
-    case WebInputEvent::kRawKeyDown:
+    case WebInputEvent::Type::kRawKeyDown:
       // In the past blink has always returned kKeyDown passed into plugins
       // although PPAPI had a RAWKEYDOWN definition. However implementations are
       // broken now that blink passes kRawKeyDown so convert it to a keydown.
       return PP_INPUTEVENT_TYPE_KEYDOWN;
-    case WebInputEvent::kKeyDown:
+    case WebInputEvent::Type::kKeyDown:
       return PP_INPUTEVENT_TYPE_KEYDOWN;
-    case WebInputEvent::kKeyUp:
+    case WebInputEvent::Type::kKeyUp:
       return PP_INPUTEVENT_TYPE_KEYUP;
-    case WebInputEvent::kChar:
+    case WebInputEvent::Type::kChar:
       return PP_INPUTEVENT_TYPE_CHAR;
-    case WebInputEvent::kTouchStart:
+    case WebInputEvent::Type::kTouchStart:
       return PP_INPUTEVENT_TYPE_TOUCHSTART;
-    case WebInputEvent::kTouchMove:
+    case WebInputEvent::Type::kTouchMove:
       return PP_INPUTEVENT_TYPE_TOUCHMOVE;
-    case WebInputEvent::kTouchEnd:
+    case WebInputEvent::Type::kTouchEnd:
       return PP_INPUTEVENT_TYPE_TOUCHEND;
-    case WebInputEvent::kTouchCancel:
+    case WebInputEvent::Type::kTouchCancel:
       return PP_INPUTEVENT_TYPE_TOUCHCANCEL;
-    case WebInputEvent::kUndefined:
+    case WebInputEvent::Type::kUndefined:
     default:
       return PP_INPUTEVENT_TYPE_UNDEFINED;
   }
@@ -220,9 +221,9 @@ void AppendMouseEvent(const WebInputEvent& event,
   const WebMouseEvent& mouse_event = static_cast<const WebMouseEvent&>(event);
   InputEventData result = GetEventWithCommonFieldsAndType(event);
   result.event_modifiers = ConvertEventModifiers(mouse_event.GetModifiers());
-  if (mouse_event.GetType() == WebInputEvent::kMouseDown ||
-      mouse_event.GetType() == WebInputEvent::kMouseMove ||
-      mouse_event.GetType() == WebInputEvent::kMouseUp) {
+  if (mouse_event.GetType() == WebInputEvent::Type::kMouseDown ||
+      mouse_event.GetType() == WebInputEvent::Type::kMouseMove ||
+      mouse_event.GetType() == WebInputEvent::Type::kMouseUp) {
     switch (mouse_event.button) {
       case WebMouseEvent::Button::kNoButton:
       case WebMouseEvent::Button::kLeft:
@@ -240,7 +241,7 @@ void AppendMouseEvent(const WebInputEvent& event,
   result.mouse_click_count = mouse_event.click_count;
 
   if (base::FeatureList::IsEnabled(features::kConsolidatedMovementXY)) {
-    if (mouse_event.GetType() == WebInputEvent::kMouseMove &&
+    if (mouse_event.GetType() == WebInputEvent::Type::kMouseMove &&
         *in_out_last_mouse_position) {
       result.mouse_movement.x = mouse_event.PositionInScreen().x() -
                                 (*in_out_last_mouse_position)->x();
@@ -292,13 +293,13 @@ void SetPPTouchPoints(const WebTouchPoint* touches,
   for (uint32_t i = 0; i < touches_length; i++) {
     const WebTouchPoint& touch_point = touches[i];
     if (included_types == ACTIVE &&
-        (touch_point.state == WebTouchPoint::kStateReleased ||
-         touch_point.state == WebTouchPoint::kStateCancelled)) {
+        (touch_point.state == WebTouchPoint::State::kStateReleased ||
+         touch_point.state == WebTouchPoint::State::kStateCancelled)) {
       continue;
     }
     if (included_types == CHANGED &&
-        (touch_point.state == WebTouchPoint::kStateUndefined ||
-         touch_point.state == WebTouchPoint::kStateStationary)) {
+        (touch_point.state == WebTouchPoint::State::kStateUndefined ||
+         touch_point.state == WebTouchPoint::State::kStateStationary)) {
       continue;
     }
     PP_TouchPoint pp_pt;
@@ -397,24 +398,24 @@ void SetWebTouchPointsIfNotYetSet(
 
 WebTouchEvent* BuildTouchEvent(const InputEventData& event) {
   WebTouchEvent* web_event = new WebTouchEvent();
-  WebTouchPoint::State state = WebTouchPoint::kStateUndefined;
-  WebInputEvent::Type type = WebInputEvent::kUndefined;
+  WebTouchPoint::State state = WebTouchPoint::State::kStateUndefined;
+  WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (event.event_type) {
     case PP_INPUTEVENT_TYPE_TOUCHSTART:
-      type = WebInputEvent::kTouchStart;
-      state = WebTouchPoint::kStatePressed;
+      type = WebInputEvent::Type::kTouchStart;
+      state = WebTouchPoint::State::kStatePressed;
       break;
     case PP_INPUTEVENT_TYPE_TOUCHMOVE:
-      type = WebInputEvent::kTouchMove;
-      state = WebTouchPoint::kStateMoved;
+      type = WebInputEvent::Type::kTouchMove;
+      state = WebTouchPoint::State::kStateMoved;
       break;
     case PP_INPUTEVENT_TYPE_TOUCHEND:
-      type = WebInputEvent::kTouchEnd;
-      state = WebTouchPoint::kStateReleased;
+      type = WebInputEvent::Type::kTouchEnd;
+      state = WebTouchPoint::State::kStateReleased;
       break;
     case PP_INPUTEVENT_TYPE_TOUCHCANCEL:
-      type = WebInputEvent::kTouchCancel;
-      state = WebTouchPoint::kStateCancelled;
+      type = WebInputEvent::Type::kTouchCancel;
+      state = WebTouchPoint::State::kStateCancelled;
       break;
     default:
       NOTREACHED();
@@ -429,7 +430,8 @@ WebTouchEvent* BuildTouchEvent(const InputEventData& event) {
   // (stationary) touches.
   SetWebTouchPointsIfNotYetSet(event.changed_touches, state, web_event->touches,
                                &web_event->touches_length);
-  SetWebTouchPointsIfNotYetSet(event.touches, WebTouchPoint::kStateStationary,
+  SetWebTouchPointsIfNotYetSet(event.touches,
+                               WebTouchPoint::State::kStateStationary,
                                web_event->touches, &web_event->touches_length);
 
   return web_event;
@@ -439,13 +441,13 @@ WebKeyboardEvent* BuildKeyEvent(const InputEventData& event) {
   WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (event.event_type) {
     case PP_INPUTEVENT_TYPE_RAWKEYDOWN:
-      type = WebInputEvent::kRawKeyDown;
+      type = WebInputEvent::Type::kRawKeyDown;
       break;
     case PP_INPUTEVENT_TYPE_KEYDOWN:
-      type = WebInputEvent::kKeyDown;
+      type = WebInputEvent::Type::kKeyDown;
       break;
     case PP_INPUTEVENT_TYPE_KEYUP:
-      type = WebInputEvent::kKeyUp;
+      type = WebInputEvent::Type::kKeyUp;
       break;
     default:
       NOTREACHED();
@@ -460,7 +462,7 @@ WebKeyboardEvent* BuildKeyEvent(const InputEventData& event) {
 
 WebKeyboardEvent* BuildCharEvent(const InputEventData& event) {
   WebKeyboardEvent* key_event = new WebKeyboardEvent(
-      WebInputEvent::kChar, event.event_modifiers,
+      WebInputEvent::Type::kChar, event.event_modifiers,
       base::TimeTicks() +
           base::TimeDelta::FromSecondsD(event.event_time_stamp));
 
@@ -477,25 +479,25 @@ WebKeyboardEvent* BuildCharEvent(const InputEventData& event) {
 }
 
 WebMouseEvent* BuildMouseEvent(const InputEventData& event) {
-  WebInputEvent::Type type = WebInputEvent::kUndefined;
+  WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (event.event_type) {
     case PP_INPUTEVENT_TYPE_MOUSEDOWN:
-      type = WebInputEvent::kMouseDown;
+      type = WebInputEvent::Type::kMouseDown;
       break;
     case PP_INPUTEVENT_TYPE_MOUSEUP:
-      type = WebInputEvent::kMouseUp;
+      type = WebInputEvent::Type::kMouseUp;
       break;
     case PP_INPUTEVENT_TYPE_MOUSEMOVE:
-      type = WebInputEvent::kMouseMove;
+      type = WebInputEvent::Type::kMouseMove;
       break;
     case PP_INPUTEVENT_TYPE_MOUSEENTER:
-      type = WebInputEvent::kMouseEnter;
+      type = WebInputEvent::Type::kMouseEnter;
       break;
     case PP_INPUTEVENT_TYPE_MOUSELEAVE:
-      type = WebInputEvent::kMouseLeave;
+      type = WebInputEvent::Type::kMouseLeave;
       break;
     case PP_INPUTEVENT_TYPE_CONTEXTMENU:
-      type = WebInputEvent::kContextMenu;
+      type = WebInputEvent::Type::kContextMenu;
       break;
     default:
       NOTREACHED();
@@ -506,7 +508,7 @@ WebMouseEvent* BuildMouseEvent(const InputEventData& event) {
           base::TimeDelta::FromSecondsD(event.event_time_stamp));
   mouse_event->pointer_type = blink::WebPointerProperties::PointerType::kMouse;
   mouse_event->button = static_cast<WebMouseEvent::Button>(event.mouse_button);
-  if (mouse_event->GetType() == WebInputEvent::kMouseMove) {
+  if (mouse_event->GetType() == WebInputEvent::Type::kMouseMove) {
     if (mouse_event->GetModifiers() & WebInputEvent::kLeftButtonDown)
       mouse_event->button = WebMouseEvent::Button::kLeft;
     else if (mouse_event->GetModifiers() & WebInputEvent::kMiddleButtonDown)
@@ -524,7 +526,7 @@ WebMouseEvent* BuildMouseEvent(const InputEventData& event) {
 
 WebMouseWheelEvent* BuildMouseWheelEvent(const InputEventData& event) {
   WebMouseWheelEvent* mouse_wheel_event = new WebMouseWheelEvent(
-      WebInputEvent::kMouseWheel, event.event_modifiers,
+      WebInputEvent::Type::kMouseWheel, event.event_modifiers,
       base::TimeTicks() +
           base::TimeDelta::FromSecondsD(event.event_time_stamp));
   mouse_wheel_event->delta_x = event.wheel_delta.x;
@@ -558,7 +560,7 @@ WebMouseWheelEvent* BuildMouseWheelEvent(const InputEventData& event) {
 #endif
 
 // Convert a character string to a Windows virtual key code. Adapted from
-// src/content/shell/test_runner/event_sender.cc. This
+// src/content/shell/renderer/web_test/event_sender.cc. This
 // is used by CreateSimulatedWebInputEvents to convert keyboard events.
 void GetKeyCode(const std::string& char_text,
                 uint16_t* code,
@@ -630,32 +632,32 @@ void CreateInputEventData(
   result->clear();
 
   switch (event.GetType()) {
-    case WebInputEvent::kMouseDown:
-    case WebInputEvent::kMouseUp:
-    case WebInputEvent::kMouseMove:
-    case WebInputEvent::kMouseEnter:
-    case WebInputEvent::kMouseLeave:
-    case WebInputEvent::kContextMenu:
+    case WebInputEvent::Type::kMouseDown:
+    case WebInputEvent::Type::kMouseUp:
+    case WebInputEvent::Type::kMouseMove:
+    case WebInputEvent::Type::kMouseEnter:
+    case WebInputEvent::Type::kMouseLeave:
+    case WebInputEvent::Type::kContextMenu:
       AppendMouseEvent(event, in_out_last_mouse_position, result);
       break;
-    case WebInputEvent::kMouseWheel:
+    case WebInputEvent::Type::kMouseWheel:
       AppendMouseWheelEvent(event, result);
       break;
-    case WebInputEvent::kRawKeyDown:
-    case WebInputEvent::kKeyDown:
-    case WebInputEvent::kKeyUp:
+    case WebInputEvent::Type::kRawKeyDown:
+    case WebInputEvent::Type::kKeyDown:
+    case WebInputEvent::Type::kKeyUp:
       AppendKeyEvent(event, result);
       break;
-    case WebInputEvent::kChar:
+    case WebInputEvent::Type::kChar:
       AppendCharEvent(event, result);
       break;
-    case WebInputEvent::kTouchStart:
-    case WebInputEvent::kTouchMove:
-    case WebInputEvent::kTouchEnd:
-    case WebInputEvent::kTouchCancel:
+    case WebInputEvent::Type::kTouchStart:
+    case WebInputEvent::Type::kTouchMove:
+    case WebInputEvent::Type::kTouchEnd:
+    case WebInputEvent::Type::kTouchCancel:
       AppendTouchEvent(event, result);
       break;
-    case WebInputEvent::kUndefined:
+    case WebInputEvent::Type::kUndefined:
     default:
       break;
   }
@@ -705,7 +707,7 @@ WebInputEvent* CreateWebInputEvent(const InputEventData& event) {
 }
 
 // Generate a coherent sequence of input events to simulate a user event.
-// From src/content/shell/test_runner/event_sender.cc.
+// From src/content/shell/renderer/web_test/event_sender.cc.
 std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
     const ppapi::InputEventData& event,
     int plugin_x,
@@ -729,7 +731,8 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
           static_cast<blink::WebTouchEvent*>(original_event.get());
       for (unsigned i = 0; i < touch_event->touches_length; ++i) {
         const blink::WebTouchPoint& touch_point = touch_event->touches[i];
-        if (touch_point.state != blink::WebTouchPoint::kStateStationary) {
+        if (touch_point.state !=
+            blink::WebTouchPoint::State::kStateStationary) {
           events.push_back(
               std::make_unique<WebPointerEvent>(*touch_event, touch_point));
         }
@@ -750,8 +753,8 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
 #if defined(OS_WIN)
       WebKeyboardEvent* web_keyboard_event =
           static_cast<WebKeyboardEvent*>(original_event.get());
-      if (web_keyboard_event->GetType() == WebInputEvent::kKeyDown)
-        web_keyboard_event->SetType(WebInputEvent::kRawKeyDown);
+      if (web_keyboard_event->GetType() == WebInputEvent::Type::kKeyDown)
+        web_keyboard_event->SetType(WebInputEvent::Type::kRawKeyDown);
 #endif
       events.push_back(std::move(original_event));
       break;
@@ -771,7 +774,7 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
 
       // Synthesize key down and key up events in all cases.
       std::unique_ptr<WebKeyboardEvent> key_down_event(new WebKeyboardEvent(
-          WebInputEvent::kRawKeyDown,
+          WebInputEvent::Type::kRawKeyDown,
           needs_shift_modifier ? WebInputEvent::kShiftKey
                                : WebInputEvent::kNoModifiers,
           web_char_event->TimeStamp()));
@@ -791,11 +794,11 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
       events.push_back(std::move(key_down_event));
 
       if (generate_char) {
-        web_char_event->SetType(WebInputEvent::kChar);
+        web_char_event->SetType(WebInputEvent::Type::kChar);
         events.push_back(std::move(original_event));
       }
 
-      key_up_event->SetType(WebInputEvent::kKeyUp);
+      key_up_event->SetType(WebInputEvent::Type::kKeyUp);
       events.push_back(std::move(key_up_event));
       break;
     }
@@ -808,26 +811,26 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
 
 PP_InputEvent_Class ClassifyInputEvent(const WebInputEvent& event) {
   switch (event.GetType()) {
-    case WebInputEvent::kMouseDown:
-    case WebInputEvent::kMouseUp:
-    case WebInputEvent::kMouseMove:
-    case WebInputEvent::kMouseEnter:
-    case WebInputEvent::kMouseLeave:
-    case WebInputEvent::kContextMenu:
+    case WebInputEvent::Type::kMouseDown:
+    case WebInputEvent::Type::kMouseUp:
+    case WebInputEvent::Type::kMouseMove:
+    case WebInputEvent::Type::kMouseEnter:
+    case WebInputEvent::Type::kMouseLeave:
+    case WebInputEvent::Type::kContextMenu:
       return PP_INPUTEVENT_CLASS_MOUSE;
-    case WebInputEvent::kMouseWheel:
+    case WebInputEvent::Type::kMouseWheel:
       return PP_INPUTEVENT_CLASS_WHEEL;
-    case WebInputEvent::kRawKeyDown:
-    case WebInputEvent::kKeyDown:
-    case WebInputEvent::kKeyUp:
-    case WebInputEvent::kChar:
+    case WebInputEvent::Type::kRawKeyDown:
+    case WebInputEvent::Type::kKeyDown:
+    case WebInputEvent::Type::kKeyUp:
+    case WebInputEvent::Type::kChar:
       return PP_INPUTEVENT_CLASS_KEYBOARD;
-    case WebInputEvent::kTouchCancel:
-    case WebInputEvent::kTouchEnd:
-    case WebInputEvent::kTouchMove:
-    case WebInputEvent::kTouchStart:
+    case WebInputEvent::Type::kTouchCancel:
+    case WebInputEvent::Type::kTouchEnd:
+    case WebInputEvent::Type::kTouchMove:
+    case WebInputEvent::Type::kTouchStart:
       return PP_INPUTEVENT_CLASS_TOUCH;
-    case WebInputEvent::kTouchScrollStarted:
+    case WebInputEvent::Type::kTouchScrollStarted:
       return PP_InputEvent_Class(0);
     default:
       CHECK(WebInputEvent::IsGestureEventType(event.GetType()));
diff --git a/chromium/content/renderer/pepper/event_conversion_unittest.cc b/chromium/content/renderer/pepper/event_conversion_unittest.cc
index 29af5d533c0..f1cb3204a76 100644
--- a/chromium/content/renderer/pepper/event_conversion_unittest.cc
+++ b/chromium/content/renderer/pepper/event_conversion_unittest.cc
@@ -8,7 +8,6 @@
 
 #include <memory>
 
-#include "base/logging.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "ppapi/shared_impl/ppb_input_event_shared.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -155,7 +154,7 @@ TEST_F(EventConversionTest, TouchCancel) {
 TEST_F(EventConversionTest, MouseMove) {
   std::unique_ptr<gfx::PointF> last_mouse_position;
   blink::WebMouseEvent mouse_event = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 100, 200, 0);
+      blink::WebInputEvent::Type::kMouseMove, 100, 200, 0);
 
   std::vector<ppapi::InputEventData> pp_events;
   CreateInputEventData(mouse_event, &last_mouse_position, &pp_events);
@@ -172,7 +171,7 @@ TEST_F(EventConversionTest, MouseMove) {
   }
 
   mouse_event = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 123, 188, 0);
+      blink::WebInputEvent::Type::kMouseMove, 123, 188, 0);
   CreateInputEventData(mouse_event, &last_mouse_position, &pp_events);
   ASSERT_EQ(PP_INPUTEVENT_TYPE_MOUSEMOVE, pp_event.event_type);
   ASSERT_EQ(pp_event.mouse_position.x, mouse_event.PositionInWidget().x());
diff --git a/chromium/content/renderer/pepper/host_array_buffer_var.cc b/chromium/content/renderer/pepper/host_array_buffer_var.cc
index ddd173ae68e..729d28de884 100644
--- a/chromium/content/renderer/pepper/host_array_buffer_var.cc
+++ b/chromium/content/renderer/pepper/host_array_buffer_var.cc
@@ -9,7 +9,6 @@
 
 #include <memory>
 
-#include "base/logging.h"
 #include "base/memory/shared_memory_mapping.h"
 #include "base/memory/unsafe_shared_memory_region.h"
 #include "base/process/process_handle.h"
diff --git a/chromium/content/renderer/pepper/host_var_tracker.cc b/chromium/content/renderer/pepper/host_var_tracker.cc
index 9141cc4618a..089cb866c1e 100644
--- a/chromium/content/renderer/pepper/host_var_tracker.cc
+++ b/chromium/content/renderer/pepper/host_var_tracker.cc
@@ -6,7 +6,8 @@
 
 #include <tuple>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "content/renderer/pepper/host_array_buffer_var.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/host_resource_var.h"
diff --git a/chromium/content/renderer/pepper/pepper_audio_input_host.cc b/chromium/content/renderer/pepper/pepper_audio_input_host.cc
index 75700b8a20f..6e183116bde 100644
--- a/chromium/content/renderer/pepper/pepper_audio_input_host.cc
+++ b/chromium/content/renderer/pepper/pepper_audio_input_host.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/pepper_audio_input_host.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "build/build_config.h"
 #include "content/common/pepper_file_util.h"
 #include "content/renderer/pepper/pepper_media_device_manager.h"
diff --git a/chromium/content/renderer/pepper/pepper_audio_output_host.cc b/chromium/content/renderer/pepper/pepper_audio_output_host.cc
index 472731e6a89..40a2b3b41fd 100644
--- a/chromium/content/renderer/pepper/pepper_audio_output_host.cc
+++ b/chromium/content/renderer/pepper/pepper_audio_output_host.cc
@@ -4,7 +4,8 @@
 
 #include "content/renderer/pepper/pepper_audio_output_host.h"
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "build/build_config.h"
 #include "content/common/pepper_file_util.h"
 #include "content/renderer/pepper/pepper_audio_controller.h"
diff --git a/chromium/content/renderer/pepper/pepper_broker_unittest.cc b/chromium/content/renderer/pepper/pepper_broker_unittest.cc
index 0592f73e9e0..96e0b880f5e 100644
--- a/chromium/content/renderer/pepper/pepper_broker_unittest.cc
+++ b/chromium/content/renderer/pepper/pepper_broker_unittest.cc
@@ -11,7 +11,7 @@
 
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
-#include "content/test/mock_render_process.h"
+#include "content/renderer/render_process.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -22,7 +22,7 @@ class PepperBrokerTest : public ::testing::Test {
       : task_environment_(base::test::TaskEnvironment::MainThreadType::IO) {}
   base::test::TaskEnvironment task_environment_;
   // We need a render process for ppapi::proxy::ProxyChannel to work.
-  MockRenderProcess mock_process_;
+  RenderProcess process_;
 };
 
 // Try to initialize PepperBrokerDispatcherWrapper with invalid ChannelHandle.
diff --git a/chromium/content/renderer/pepper/pepper_browser_connection.cc b/chromium/content/renderer/pepper/pepper_browser_connection.cc
index dbb3a94e3f6..1c26446a2e5 100644
--- a/chromium/content/renderer/pepper/pepper_browser_connection.cc
+++ b/chromium/content/renderer/pepper/pepper_browser_connection.cc
@@ -6,7 +6,7 @@
 
 #include <limits>
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "content/common/frame_messages.h"
 #include "content/renderer/pepper/pepper_in_process_router.h"
 #include "content/renderer/render_frame_impl.h"
diff --git a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
index 3d3fd0580fd..ae714b7897e 100644
--- a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
+++ b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
@@ -5,8 +5,8 @@
 #include "content/renderer/pepper/pepper_device_enumeration_host_helper.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
index 6ee9f765ab9..feefd15086e 100644
--- a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
+++ b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
@@ -7,8 +7,8 @@
 
 #include <map>
 
+#include "base/check.h"
 #include "base/compiler_specific.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/run_loop.h"
diff --git a/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc b/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc
index 354a6e5dbf4..1179913ffc5 100644
--- a/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc
+++ b/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc
@@ -8,8 +8,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/read_only_shared_memory_region.h"
 #include "base/numerics/checked_math.h"
 #include "base/single_thread_task_runner.h"
@@ -705,7 +705,8 @@ bool PepperGraphics2DHost::PrepareTransferableResource(
                           viz::ResourceFormatToClosestSkColorType(true, format),
                           kUnknown_SkAlphaType);
     ri->WaitSyncTokenCHROMIUM(in_sync_token.GetConstData());
-    ri->WritePixels(gpu_mailbox, 0, 0, texture_target, src_info, src);
+    ri->WritePixels(gpu_mailbox, 0, 0, texture_target, src_info.minRowBytes(),
+                    src_info, src);
 
     gpu::SyncToken out_sync_token;
     ri->GenUnverifiedSyncTokenCHROMIUM(out_sync_token.GetData());
diff --git a/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc b/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc
index 29331380673..bd311fdc583 100644
--- a/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc
+++ b/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc
@@ -5,8 +5,8 @@
 #include "content/renderer/pepper/pepper_in_process_resource_creation.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
 #include "base/memory/weak_ptr.h"
+#include "base/notreached.h"
 #include "content/child/browser_font_resource_trusted.h"
 #include "content/renderer/pepper/pepper_in_process_router.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_device_manager.cc b/chromium/content/renderer/pepper/pepper_media_device_manager.cc
index 9b90bc48692..c00f38126ad 100644
--- a/chromium/content/renderer/pepper/pepper_media_device_manager.cc
+++ b/chromium/content/renderer/pepper/pepper_media_device_manager.cc
@@ -5,9 +5,10 @@
 #include "content/renderer/pepper/pepper_media_device_manager.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/feature_list.h"
 #include "base/location.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/threading/thread_task_runner_handle.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc b/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc
index af26f982e6a..5a8bc7db9ac 100644
--- a/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc
+++ b/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc
@@ -7,8 +7,8 @@
 #include <algorithm>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/numerics/safe_math.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc b/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc
index 6d205fb5659..25fbe3563e1 100644
--- a/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc
+++ b/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/memory/unsafe_shared_memory_region.h"
 #include "base/numerics/safe_math.h"
 #include "content/common/pepper_file_util.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc b/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
index 807a126f1d3..adcc1128610 100644
--- a/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
+++ b/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
@@ -537,8 +537,8 @@ void PepperMediaStreamVideoTrackHost::InitBlinkTrack() {
   const bool enabled = true;
   track_ = blink::MediaStreamVideoTrack::CreateVideoTrack(
       source,
-      base::BindRepeating(&PepperMediaStreamVideoTrackHost::OnTrackStarted,
-                          base::Unretained(this)),
+      base::BindOnce(&PepperMediaStreamVideoTrackHost::OnTrackStarted,
+                     base::Unretained(this)),
       enabled);
   // Note: The call to CreateVideoTrack() returned a track that holds a
   // ref-counted reference to |webkit_source| (and, implicitly, |source|).
diff --git a/chromium/content/renderer/pepper/pepper_platform_audio_input.cc b/chromium/content/renderer/pepper/pepper_platform_audio_input.cc
index 41016baca10..3a0d7f90fdd 100644
--- a/chromium/content/renderer/pepper/pepper_platform_audio_input.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_audio_input.cc
@@ -5,8 +5,8 @@
 #include "content/renderer/pepper/pepper_platform_audio_input.h"
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
diff --git a/chromium/content/renderer/pepper/pepper_platform_audio_output.cc b/chromium/content/renderer/pepper/pepper_platform_audio_output.cc
index 10d99da1cea..8a058d19b27 100644
--- a/chromium/content/renderer/pepper/pepper_platform_audio_output.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_audio_output.cc
@@ -5,8 +5,9 @@
 #include "content/renderer/pepper/pepper_platform_audio_output.h"
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
diff --git a/chromium/content/renderer/pepper/pepper_platform_camera_device.cc b/chromium/content/renderer/pepper/pepper_platform_camera_device.cc
index 8b8cb288861..35aff32c3eb 100644
--- a/chromium/content/renderer/pepper/pepper_platform_camera_device.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_camera_device.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/pepper/gfx_conversion.h"
 #include "content/renderer/pepper/pepper_camera_device_host.h"
 #include "content/renderer/pepper/pepper_media_device_manager.h"
diff --git a/chromium/content/renderer/pepper/pepper_platform_video_capture.cc b/chromium/content/renderer/pepper/pepper_platform_video_capture.cc
index 72dd4ce3f39..ab6546536be 100644
--- a/chromium/content/renderer/pepper/pepper_platform_video_capture.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_video_capture.cc
@@ -5,8 +5,9 @@
 #include "content/renderer/pepper/pepper_platform_video_capture.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "content/renderer/pepper/pepper_media_device_manager.h"
 #include "content/renderer/pepper/pepper_video_capture_host.h"
 #include "content/renderer/render_frame_impl.h"
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
index 44680376952..e0a663c1e38 100644
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -91,14 +91,15 @@
 #include "ppapi/thunk/enter.h"
 #include "ppapi/thunk/ppb_buffer_api.h"
 #include "printing/buildflags/buildflags.h"
+#include "printing/mojom/print.mojom.h"
 #include "skia/ext/platform_canvas.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
 #include "third_party/blink/public/common/input/web_pointer_event.h"
 #include "third_party/blink/public/common/input/web_touch_event.h"
 #include "third_party/blink/public/platform/url_conversion.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_security_origin.h"
@@ -328,8 +329,8 @@ std::unique_ptr<const char* []> StringVectorToArgArray(
 // for things like screen brightness and volume control.
 bool IsReservedSystemInputEvent(const blink::WebInputEvent& event) {
 #if defined(OS_CHROMEOS)
-  if (event.GetType() != WebInputEvent::kKeyDown &&
-      event.GetType() != WebInputEvent::kKeyUp)
+  if (event.GetType() != WebInputEvent::Type::kKeyDown &&
+      event.GetType() != WebInputEvent::Type::kKeyUp)
     return false;
   const blink::WebKeyboardEvent& key_event =
       static_cast<const blink::WebKeyboardEvent&>(event);
@@ -388,6 +389,13 @@ void PrintPDFOutput(PP_Resource print_output,
 #endif  // BUILDFLAG(ENABLE_PRINTING)
 }
 
+constexpr char kChromePrint[] = "chrome://print/";
+
+bool IsPrintPreviewUrl(const GURL& document_url) {
+  return url::Origin::Create(document_url.GetOrigin()) ==
+         url::Origin::Create(GURL(kChromePrint));
+}
+
 }  // namespace
 
 // static
@@ -1109,7 +1117,7 @@ bool PepperPluginInstanceImpl::HandleInputEvent(
     return false;
 
   if (!has_been_clicked_ && is_flash_plugin_ &&
-      event.GetType() == blink::WebInputEvent::kMouseDown &&
+      event.GetType() == blink::WebInputEvent::Type::kMouseDown &&
       (event.GetModifiers() & blink::WebInputEvent::kLeftButtonDown)) {
     has_been_clicked_ = true;
   }
@@ -2013,16 +2021,17 @@ bool PepperPluginInstanceImpl::GetPrintPresetOptionsFromDocument(
   preset_options->is_scaling_disabled = PP_ToBool(options.is_scaling_disabled);
   switch (options.duplex) {
     case PP_PRIVATEDUPLEXMODE_SIMPLEX:
-      preset_options->duplex_mode = blink::kWebSimplex;
+      preset_options->duplex_mode = printing::mojom::DuplexMode::kSimplex;
       break;
     case PP_PRIVATEDUPLEXMODE_SHORT_EDGE:
-      preset_options->duplex_mode = blink::kWebShortEdge;
+      preset_options->duplex_mode = printing::mojom::DuplexMode::kShortEdge;
       break;
     case PP_PRIVATEDUPLEXMODE_LONG_EDGE:
-      preset_options->duplex_mode = blink::kWebLongEdge;
+      preset_options->duplex_mode = printing::mojom::DuplexMode::kLongEdge;
       break;
     default:
-      preset_options->duplex_mode = blink::kWebUnknownDuplexMode;
+      preset_options->duplex_mode =
+          printing::mojom::DuplexMode::kUnknownDuplexMode;
       break;
   }
   preset_options->copies = options.copies;
@@ -2229,6 +2238,12 @@ void PepperPluginInstanceImpl::OnHiddenForPlaceholder(bool hidden) {
   UpdateLayer(false /* device_changed */);
 }
 
+bool PepperPluginInstanceImpl::SupportsKeyboardFocus() {
+  // Only PDF plugin supports keyboard focus. PDF plugin shouldn't be focusable
+  // if it's embedded in Print Preview.
+  return LoadPdfInterface() && !IsPrintPreviewUrl(document_url_);
+}
+
 void PepperPluginInstanceImpl::AddPluginObject(PluginObject* plugin_object) {
   DCHECK(live_plugin_objects_.find(plugin_object) ==
          live_plugin_objects_.end());
@@ -2279,8 +2294,9 @@ void PepperPluginInstanceImpl::SimulateInputEvent(
       CreateSimulatedWebInputEvents(
           input_event, view_data_.rect.point.x + view_data_.rect.size.width / 2,
           view_data_.rect.point.y + view_data_.rect.size.height / 2);
-  for (auto it = events.begin(); it != events.end(); ++it) {
-    widget->HandleInputEvent(blink::WebCoalescedInputEvent(*it->get()));
+  for (auto& event : events) {
+    widget->HandleInputEvent(
+        blink::WebCoalescedInputEvent(std::move(event), ui::LatencyInfo()));
   }
   if (input_event.event_type == PP_INPUTEVENT_TYPE_TOUCHSTART ||
       input_event.event_type == PP_INPUTEVENT_TYPE_TOUCHMOVE ||
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
index e358c31ec0e..4409f64a62d 100644
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
+++ b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
@@ -63,8 +63,8 @@
 #include "third_party/blink/public/web/web_plugin.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/base/cursor/cursor.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/base/ime/text_input_type.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/geometry/rect.h"
 #include "url/gurl.h"
 #include "v8/include/v8.h"
@@ -522,6 +522,8 @@ class CONTENT_EXPORT PepperPluginInstanceImpl
   // Should be used only for logging.
   bool is_flash_plugin() const { return is_flash_plugin_; }
 
+  bool SupportsKeyboardFocus();
+
  private:
   friend class base::RefCounted<PepperPluginInstanceImpl>;
   friend class PpapiPluginInstanceTest;
diff --git a/chromium/content/renderer/pepper/pepper_url_request_unittest.cc b/chromium/content/renderer/pepper/pepper_url_request_unittest.cc
index 8286b7e126d..901bfa697bc 100644
--- a/chromium/content/renderer/pepper/pepper_url_request_unittest.cc
+++ b/chromium/content/renderer/pepper/pepper_url_request_unittest.cc
@@ -76,6 +76,22 @@ class URLRequestInfoTest : public RenderViewTest {
     return web_request.GetRequestContext();
   }
 
+  network::mojom::RequestDestination GetDestination() {
+    WebURLRequest web_request;
+    URLRequestInfoData data = info_->GetData();
+    if (!CreateWebURLRequest(pp_instance_, &data, GetMainFrame(), &web_request))
+      return network::mojom::RequestDestination::kEmpty;
+    return web_request.GetRequestDestination();
+  }
+
+  network::mojom::RequestMode GetMode() {
+    WebURLRequest web_request;
+    URLRequestInfoData data = info_->GetData();
+    if (!CreateWebURLRequest(pp_instance_, &data, GetMainFrame(), &web_request))
+      return network::mojom::RequestMode::kNavigate;
+    return web_request.GetMode();
+  }
+
   WebString GetHeaderValue(const char* field) {
     WebURLRequest web_request;
     URLRequestInfoData data = info_->GetData();
@@ -214,9 +230,11 @@ TEST_F(URLRequestInfoTest, SetHeaders) {
   EXPECT_STREQ("baz", GetHeaderValue("bar").Utf8().data());
 }
 
-TEST_F(URLRequestInfoTest, RequestContext) {
-  // Test context is PLUGIN.
+TEST_F(URLRequestInfoTest, RequestContextAndDestination) {
+  // Test context and destination for PLUGIN.
   EXPECT_EQ(blink::mojom::RequestContextType::PLUGIN, GetContext());
+  EXPECT_EQ(network::mojom::RequestDestination::kEmbed, GetDestination());
+  EXPECT_EQ(network::mojom::RequestMode::kNoCors, GetMode());
 }
 
 // TODO(bbudge) Unit tests for AppendDataToBody, AppendFileToBody.
diff --git a/chromium/content/renderer/pepper/pepper_webplugin_impl.cc b/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
index b42240a5792..57d85b9f56a 100644
--- a/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
+++ b/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
@@ -13,6 +13,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "base/time/time.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/pepper/message_channel.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
@@ -23,9 +24,12 @@
 #include "content/renderer/renderer_blink_platform_impl.h"
 #include "ppapi/shared_impl/ppapi_globals.h"
 #include "ppapi/shared_impl/var_tracker.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
+#include "third_party/blink/public/mojom/input/focus_type.mojom.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_size.h"
 #include "third_party/blink/public/web/web_associated_url_loader_client.h"
@@ -37,6 +41,8 @@
 #include "third_party/blink/public/web/web_print_params.h"
 #include "third_party/blink/public/web/web_print_preset_options.h"
 #include "third_party/blink/public/web/web_print_scaling_option.h"
+#include "ui/base/cursor/cursor.h"
+#include "ui/events/keycodes/keyboard_codes.h"
 #include "url/gurl.h"
 
 using ppapi::V8ObjectVar;
@@ -187,6 +193,10 @@ v8::Local<v8::Object> PepperWebPluginImpl::V8ScriptableObject(
   return result;
 }
 
+bool PepperWebPluginImpl::SupportsKeyboardFocus() const {
+  return instance_ && instance_->SupportsKeyboardFocus();
+}
+
 void PepperWebPluginImpl::Paint(cc::PaintCanvas* canvas, const WebRect& rect) {
   // Re-entrancy may cause JS to try to execute script on the plugin before it
   // is fully initialized. See: crbug.com/715747.
@@ -208,8 +218,33 @@ void PepperWebPluginImpl::UpdateFocus(bool focused,
                                       blink::mojom::FocusType focus_type) {
   // Re-entrancy may cause JS to try to execute script on the plugin before it
   // is fully initialized. See: crbug.com/715747.
-  if (instance_)
+  if (instance_) {
     instance_->SetWebKitFocus(focused);
+
+    if (focused && instance_->SupportsKeyboardFocus()) {
+      switch (focus_type) {
+        case blink::mojom::FocusType::kForward:
+        case blink::mojom::FocusType::kBackward: {
+          int modifiers = blink::WebInputEvent::kNoModifiers;
+          if (focus_type == blink::mojom::FocusType::kBackward)
+            modifiers |= blink::WebInputEvent::kShiftKey;
+          // As part of focus management for plugin, blink brings plugin to
+          // focus but does not forward the tab event to plugin. Hence
+          // simulating tab event here to enable seamless tabbing across UI &
+          // plugin.
+          blink::WebKeyboardEvent simulated_event(
+              blink::WebInputEvent::Type::kKeyDown, modifiers,
+              base::TimeTicks());
+          simulated_event.windows_key_code = ui::KeyboardCode::VKEY_TAB;
+          ui::Cursor cursor;
+          instance_->HandleInputEvent(simulated_event, &cursor);
+          break;
+        }
+        default:
+          break;
+      }
+    }
+  }
 }
 
 void PepperWebPluginImpl::UpdateVisibility(bool visible) {}
diff --git a/chromium/content/renderer/pepper/pepper_webplugin_impl.h b/chromium/content/renderer/pepper/pepper_webplugin_impl.h
index 03a48405c7b..1e751f4cd57 100644
--- a/chromium/content/renderer/pepper/pepper_webplugin_impl.h
+++ b/chromium/content/renderer/pepper/pepper_webplugin_impl.h
@@ -44,6 +44,7 @@ class PepperWebPluginImpl : public blink::WebPlugin {
   bool Initialize(blink::WebPluginContainer* container) override;
   void Destroy() override;
   v8::Local<v8::Object> V8ScriptableObject(v8::Isolate* isolate) override;
+  bool SupportsKeyboardFocus() const override;
   void UpdateAllLifecyclePhases(blink::DocumentUpdateReason) override {}
   void Paint(cc::PaintCanvas* canvas, const blink::WebRect& rect) override;
   void UpdateGeometry(const blink::WebRect& window_rect,
diff --git a/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc b/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc
index 9af6c928ab7..dd4d081d31b 100644
--- a/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc
+++ b/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc
@@ -161,7 +161,7 @@ void PluginInstanceThrottlerImpl::Initialize(
         observer.OnPeripheralStateChange();
 
       if (status == RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_BIG)
-        frame->WhitelistContentOrigin(content_origin);
+        frame->AllowlistContentOrigin(content_origin);
 
       return;
     }
@@ -172,7 +172,7 @@ void PluginInstanceThrottlerImpl::Initialize(
         content_origin,
         base::BindOnce(&PluginInstanceThrottlerImpl::MarkPluginEssential,
                        weak_factory_.GetWeakPtr(),
-                       UNTHROTTLE_METHOD_BY_WHITELIST));
+                       UNTHROTTLE_METHOD_BY_ALLOWLIST));
   }
 }
 
@@ -206,7 +206,7 @@ bool PluginInstanceThrottlerImpl::ConsumeInputEvent(
     return false;
 
   if (state_ != THROTTLER_STATE_MARKED_ESSENTIAL &&
-      event.GetType() == blink::WebInputEvent::kMouseUp &&
+      event.GetType() == blink::WebInputEvent::Type::kMouseUp &&
       (event.GetModifiers() & blink::WebInputEvent::kLeftButtonDown)) {
     bool was_throttled = IsThrottled();
     MarkPluginEssential(UNTHROTTLE_METHOD_BY_CLICK);
diff --git a/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc b/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc
index ad67ea66949..dcf187803f9 100644
--- a/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc
+++ b/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc
@@ -7,8 +7,8 @@
 #include <memory>
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/test/task_environment.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_frame.h"
@@ -54,9 +54,9 @@ class PluginInstanceThrottlerImplTest
     return throttler_.get();
   }
 
-  void DisablePowerSaverByRetroactiveWhitelist() {
+  void DisablePowerSaverByRetroactiveAllowlist() {
     throttler()->MarkPluginEssential(
-        PluginInstanceThrottlerImpl::UNTHROTTLE_METHOD_BY_WHITELIST);
+        PluginInstanceThrottlerImpl::UNTHROTTLE_METHOD_BY_ALLOWLIST);
   }
 
   int change_callback_calls() { return change_callback_calls_; }
@@ -145,18 +145,18 @@ TEST_F(PluginInstanceThrottlerImplTest, IgnoreThrottlingAfterMouseUp) {
   EXPECT_EQ(0, change_callback_calls());
 }
 
-TEST_F(PluginInstanceThrottlerImplTest, FastWhitelisting) {
+TEST_F(PluginInstanceThrottlerImplTest, FastAllowlisting) {
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(0, change_callback_calls());
 
-  DisablePowerSaverByRetroactiveWhitelist();
+  DisablePowerSaverByRetroactiveAllowlist();
 
   EngageThrottle();
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(0, change_callback_calls());
 }
 
-TEST_F(PluginInstanceThrottlerImplTest, SlowWhitelisting) {
+TEST_F(PluginInstanceThrottlerImplTest, SlowAllowlisting) {
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(0, change_callback_calls());
 
@@ -164,7 +164,7 @@ TEST_F(PluginInstanceThrottlerImplTest, SlowWhitelisting) {
   EXPECT_TRUE(throttler()->IsThrottled());
   EXPECT_EQ(1, change_callback_calls());
 
-  DisablePowerSaverByRetroactiveWhitelist();
+  DisablePowerSaverByRetroactiveAllowlist();
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(2, change_callback_calls());
 }
diff --git a/chromium/content/renderer/pepper/plugin_object.cc b/chromium/content/renderer/pepper/plugin_object.cc
index 7c36cd0abdb..09e8e8f1056 100644
--- a/chromium/content/renderer/pepper/plugin_object.cc
+++ b/chromium/content/renderer/pepper/plugin_object.cc
@@ -9,8 +9,9 @@
 #include <memory>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/plugin_power_saver_helper.cc b/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
index 3d3cc75e47c..4b088e4634f 100644
--- a/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
+++ b/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
@@ -49,15 +49,15 @@ void PluginPowerSaverHelper::DidCommitProvisionalLoad(
   if (frame->Parent() || is_same_document_navigation)
     return;  // Not a top-level navigation.
 
-  origin_whitelist_.clear();
+  origin_allowlist_.clear();
 }
 
 bool PluginPowerSaverHelper::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(PluginPowerSaverHelper, message)
-  IPC_MESSAGE_HANDLER(FrameMsg_UpdatePluginContentOriginWhitelist,
-                      OnUpdatePluginContentOriginWhitelist)
-  IPC_MESSAGE_UNHANDLED(handled = false)
+    IPC_MESSAGE_HANDLER(FrameMsg_UpdatePluginContentOriginAllowlist,
+                        OnUpdatePluginContentOriginAllowlist)
+    IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
@@ -66,14 +66,14 @@ void PluginPowerSaverHelper::OnDestruct() {
   delete this;
 }
 
-void PluginPowerSaverHelper::OnUpdatePluginContentOriginWhitelist(
-    const std::set<url::Origin>& origin_whitelist) {
-  origin_whitelist_ = origin_whitelist;
+void PluginPowerSaverHelper::OnUpdatePluginContentOriginAllowlist(
+    const std::set<url::Origin>& origin_allowlist) {
+  origin_allowlist_ = origin_allowlist;
 
   // Check throttled plugin instances to see if any can be unthrottled.
   auto it = peripheral_plugins_.begin();
   while (it != peripheral_plugins_.end()) {
-    if (origin_whitelist.count(it->content_origin)) {
+    if (origin_allowlist.count(it->content_origin)) {
       // Because the unthrottle callback may register another peripheral plugin
       // and invalidate our iterator, we cannot run it synchronously.
       render_frame()
@@ -105,12 +105,12 @@ PluginPowerSaverHelper::GetPeripheralContentStatus(
   }
 
   return PeripheralContentHeuristic::GetPeripheralStatus(
-      origin_whitelist_, main_frame_origin, content_origin, unobscured_size);
+      origin_allowlist_, main_frame_origin, content_origin, unobscured_size);
 }
 
-void PluginPowerSaverHelper::WhitelistContentOrigin(
+void PluginPowerSaverHelper::AllowlistContentOrigin(
     const url::Origin& content_origin) {
-  if (origin_whitelist_.insert(content_origin).second) {
+  if (origin_allowlist_.insert(content_origin).second) {
     Send(new FrameHostMsg_PluginContentOriginAllowed(
         render_frame()->GetRoutingID(), content_origin));
   }
diff --git a/chromium/content/renderer/pepper/plugin_power_saver_helper.h b/chromium/content/renderer/pepper/plugin_power_saver_helper.h
index ba682b0a501..ff8497e7c15 100644
--- a/chromium/content/renderer/pepper/plugin_power_saver_helper.h
+++ b/chromium/content/renderer/pepper/plugin_power_saver_helper.h
@@ -49,7 +49,7 @@ class CONTENT_EXPORT PluginPowerSaverHelper : public RenderFrameObserver {
       const url::Origin& content_origin,
       const gfx::Size& unobscured_size,
       RenderFrame::RecordPeripheralDecision record_decision) const;
-  void WhitelistContentOrigin(const url::Origin& content_origin);
+  void AllowlistContentOrigin(const url::Origin& content_origin);
 
   // RenderFrameObserver implementation.
   void DidCommitProvisionalLoad(bool is_same_document_navigation,
@@ -57,11 +57,11 @@ class CONTENT_EXPORT PluginPowerSaverHelper : public RenderFrameObserver {
   bool OnMessageReceived(const IPC::Message& message) override;
   void OnDestruct() override;
 
-  void OnUpdatePluginContentOriginWhitelist(
-      const std::set<url::Origin>& origin_whitelist);
+  void OnUpdatePluginContentOriginAllowlist(
+      const std::set<url::Origin>& origin_allowlist);
 
-  // Local copy of the whitelist for the entire tab.
-  std::set<url::Origin> origin_whitelist_;
+  // Local copy of the allowlist for the entire tab.
+  std::set<url::Origin> origin_allowlist_;
 
   // Set of peripheral plugins eligible to be unthrottled ex post facto.
   std::vector<PeripheralPlugin> peripheral_plugins_;
diff --git a/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc b/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc
index 3496efeda9e..70096cd34d4 100644
--- a/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc
+++ b/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc
@@ -42,7 +42,7 @@ class PluginPowerSaverHelperTest : public RenderViewTest {
   DISALLOW_COPY_AND_ASSIGN(PluginPowerSaverHelperTest);
 };
 
-TEST_F(PluginPowerSaverHelperTest, TemporaryOriginWhitelist) {
+TEST_F(PluginPowerSaverHelperTest, TemporaryOriginAllowlist) {
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_PERIPHERAL,
             frame()->GetPeripheralContentStatus(
                 url::Origin::Create(GURL("http://same.com")),
@@ -52,10 +52,10 @@ TEST_F(PluginPowerSaverHelperTest, TemporaryOriginWhitelist) {
   // Clear out other messages so we find just the plugin power saver IPCs.
   sink_->ClearMessages();
 
-  frame()->WhitelistContentOrigin(
+  frame()->AllowlistContentOrigin(
       url::Origin::Create(GURL("http://other.com")));
 
-  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED,
+  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED,
             frame()->GetPeripheralContentStatus(
                 url::Origin::Create(GURL("http://same.com")),
                 url::Origin::Create(GURL("http://other.com")),
@@ -72,25 +72,25 @@ TEST_F(PluginPowerSaverHelperTest, TemporaryOriginWhitelist) {
                   .IsSameOriginWith(std::get<0>(params)));
 }
 
-TEST_F(PluginPowerSaverHelperTest, UnthrottleOnExPostFactoWhitelist) {
+TEST_F(PluginPowerSaverHelperTest, UnthrottleOnExPostFactoAllowlist) {
   base::RunLoop loop;
   frame()->RegisterPeripheralPlugin(
       url::Origin::Create(GURL("http://other.com")), loop.QuitClosure());
 
-  std::set<url::Origin> origin_whitelist;
-  origin_whitelist.insert(url::Origin::Create(GURL("http://other.com")));
-  frame()->OnMessageReceived(FrameMsg_UpdatePluginContentOriginWhitelist(
-      frame()->GetRoutingID(), origin_whitelist));
+  std::set<url::Origin> origin_allowlist;
+  origin_allowlist.insert(url::Origin::Create(GURL("http://other.com")));
+  frame()->OnMessageReceived(FrameMsg_UpdatePluginContentOriginAllowlist(
+      frame()->GetRoutingID(), origin_allowlist));
 
   // Runs until the unthrottle closure is run.
   loop.Run();
 }
 
-TEST_F(PluginPowerSaverHelperTest, ClearWhitelistOnNavigate) {
-  frame()->WhitelistContentOrigin(
+TEST_F(PluginPowerSaverHelperTest, ClearAllowlistOnNavigate) {
+  frame()->AllowlistContentOrigin(
       url::Origin::Create(GURL("http://other.com")));
 
-  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED,
+  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED,
             frame()->GetPeripheralContentStatus(
                 url::Origin::Create(GURL("http://same.com")),
                 url::Origin::Create(GURL("http://other.com")),
diff --git a/chromium/content/renderer/pepper/ppb_audio_impl.cc b/chromium/content/renderer/pepper/ppb_audio_impl.cc
index 964afa8ff08..cd91a137591 100644
--- a/chromium/content/renderer/pepper/ppb_audio_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_audio_impl.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/ppb_audio_impl.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/pepper/pepper_audio_controller.h"
 #include "content/renderer/pepper/pepper_platform_audio_output.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/ppb_broker_impl.cc b/chromium/content/renderer/pepper/ppb_broker_impl.cc
index 3488c65dc7e..41c36f9db49 100644
--- a/chromium/content/renderer/pepper/ppb_broker_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_broker_impl.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/ppb_broker_impl.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/metrics/histogram_macros.h"
 #include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
diff --git a/chromium/content/renderer/pepper/ppb_buffer_impl.cc b/chromium/content/renderer/pepper/ppb_buffer_impl.cc
index 207aa2fe5d3..6b0df315b0c 100644
--- a/chromium/content/renderer/pepper/ppb_buffer_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_buffer_impl.cc
@@ -7,7 +7,7 @@
 #include <algorithm>
 #include <memory>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/pepper_file_util.h"
 #include "content/renderer/render_thread_impl.h"
 #include "ppapi/c/dev/ppb_buffer_dev.h"
diff --git a/chromium/content/renderer/pepper/ppb_image_data_impl.cc b/chromium/content/renderer/pepper/ppb_image_data_impl.cc
index 20b953e6ada..2bb34645548 100644
--- a/chromium/content/renderer/pepper/ppb_image_data_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_image_data_impl.cc
@@ -8,7 +8,8 @@
 #include <limits>
 #include <memory>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "content/common/pepper_file_util.h"
 #include "content/common/view_messages.h"
 #include "content/renderer/render_thread_impl.h"
diff --git a/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc b/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
index 735637b353f..aeda13db576 100644
--- a/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
@@ -6,8 +6,9 @@
 
 #include <string>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 #include "content/renderer/pepper/plugin_module.h"
diff --git a/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc b/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc
index d01779026bb..21c9507179b 100644
--- a/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc
+++ b/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc
@@ -5,9 +5,9 @@
 #include "content/renderer/pepper/renderer_ppapi_host_impl.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/files/file_path.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/process/process_handle.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
diff --git a/chromium/content/renderer/pepper/url_request_info_util.cc b/chromium/content/renderer/pepper/url_request_info_util.cc
index cb0f5e593c8..84c4667e596 100644
--- a/chromium/content/renderer/pepper/url_request_info_util.cc
+++ b/chromium/content/renderer/pepper/url_request_info_util.cc
@@ -7,7 +7,8 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/renderer/loader/request_extra_data.h"
@@ -253,6 +254,11 @@ bool CreateWebURLRequest(PP_Instance instance,
   }
 
   dest->SetRequestContext(blink::mojom::RequestContextType::PLUGIN);
+  // TODO(lyf): We don't currently distinguish between plugin content loaded
+  // via `<embed>` or `<object>` as https://github.com/whatwg/fetch/pull/948
+  // asks us to do. See `content::PepperURLLoaderHost::InternalOnHostMsgOpen`
+  // for details.
+  dest->SetRequestDestination(network::mojom::RequestDestination::kEmbed);
 
   return true;
 }
diff --git a/chromium/content/renderer/pepper/v8_var_converter_unittest.cc b/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
index d699fd8a7c0..ae60ce11f33 100644
--- a/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
+++ b/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
@@ -12,8 +12,9 @@
 #include <unordered_map>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/run_loop.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/test/task_environment.h"
diff --git a/chromium/content/renderer/pepper/v8object_var.cc b/chromium/content/renderer/pepper/v8object_var.cc
index 9e7ee57c3c1..374dc7ddec1 100644
--- a/chromium/content/renderer/pepper/v8object_var.cc
+++ b/chromium/content/renderer/pepper/v8object_var.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/v8object_var.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/public/renderer/pepper_plugin_instance.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/video_decoder_shim.cc b/chromium/content/renderer/pepper/video_decoder_shim.cc
index a61cc93a64a..e0add969e80 100644
--- a/chromium/content/renderer/pepper/video_decoder_shim.cc
+++ b/chromium/content/renderer/pepper/video_decoder_shim.cc
@@ -12,11 +12,12 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/containers/queue.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -382,11 +383,15 @@ void VideoDecoderShim::YUVConverter::Convert(const media::VideoFrame* frame,
     //   U - 128  : Turns unsigned U into signed U [-128,127]
     //   V - 128  : Turns unsigned V into signed V [-128,127]
     static const float yuv_adjust_constrained[3] = {
-        -0.0625f, -0.5f, -0.5f,
+        -0.0625f,
+        -0.5f,
+        -0.5f,
     };
     // Same as above, but without the head and footroom.
     static const float yuv_adjust_full[3] = {
-        0.0f, -0.5f, -0.5f,
+        0.0f,
+        -0.5f,
+        -0.5f,
     };
 
     yuv_adjust = yuv_adjust_constrained;
@@ -1020,8 +1025,7 @@ void VideoDecoderShim::OnOutputComplete(std::unique_ptr<PendingFrame> frame) {
       // all textures to |textures_to_dismiss_| and dismiss any that aren't in
       // use by the plugin. We will dismiss the rest as they are recycled.
       for (TextureIdMap::const_iterator it = texture_id_map_.begin();
-           it != texture_id_map_.end();
-           ++it) {
+           it != texture_id_map_.end(); ++it) {
         textures_to_dismiss_.insert(it->first);
       }
       for (auto it = available_textures_.begin();
diff --git a/chromium/content/renderer/peripheral_content_heuristic.cc b/chromium/content/renderer/peripheral_content_heuristic.cc
index c6b87517f04..5bfb7e1889e 100644
--- a/chromium/content/renderer/peripheral_content_heuristic.cc
+++ b/chromium/content/renderer/peripheral_content_heuristic.cc
@@ -40,7 +40,7 @@ bool IsTiny(const gfx::Size& unobscured_size) {
 // static
 RenderFrame::PeripheralContentStatus
 PeripheralContentHeuristic::GetPeripheralStatus(
-    const std::set<url::Origin>& origin_whitelist,
+    const std::set<url::Origin>& origin_allowlist,
     const url::Origin& main_frame_origin,
     const url::Origin& content_origin,
     const gfx::Size& unobscured_size) {
@@ -50,8 +50,8 @@ PeripheralContentHeuristic::GetPeripheralStatus(
   if (main_frame_origin.IsSameOriginWith(content_origin))
     return RenderFrame::CONTENT_STATUS_ESSENTIAL_SAME_ORIGIN;
 
-  if (origin_whitelist.count(content_origin))
-    return RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED;
+  if (origin_allowlist.count(content_origin))
+    return RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED;
 
   if (IsLargeContent(unobscured_size))
     return RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_BIG;
diff --git a/chromium/content/renderer/peripheral_content_heuristic.h b/chromium/content/renderer/peripheral_content_heuristic.h
index 251edaa966c..11c22ce136f 100644
--- a/chromium/content/renderer/peripheral_content_heuristic.h
+++ b/chromium/content/renderer/peripheral_content_heuristic.h
@@ -30,7 +30,7 @@ class CONTENT_EXPORT PeripheralContentHeuristic {
   //  - Cross-origin:  a.com -> b.com/iframe.html -> b.com/plugin.swf
   //  - Same-origin:   a.com -> b.com/iframe-to-a.html -> a.com/plugin.swf
   //
-  // |origin_whitelist| is the whitelist of content origins.
+  // |origin_allowlist| is the allowlist of content origins.
   //
   // |main_frame_origin| is the origin of the main frame.
   //
@@ -38,7 +38,7 @@ class CONTENT_EXPORT PeripheralContentHeuristic {
   //
   // |unobscured_size| is in zoom and device scale independent logical pixels.
   static RenderFrame::PeripheralContentStatus GetPeripheralStatus(
-      const std::set<url::Origin>& origin_whitelist,
+      const std::set<url::Origin>& origin_allowlist,
       const url::Origin& main_frame_origin,
       const url::Origin& content_origin,
       const gfx::Size& unobscured_size);
diff --git a/chromium/content/renderer/peripheral_content_heuristic_unittest.cc b/chromium/content/renderer/peripheral_content_heuristic_unittest.cc
index 56d006c815e..c74f934a0fb 100644
--- a/chromium/content/renderer/peripheral_content_heuristic_unittest.cc
+++ b/chromium/content/renderer/peripheral_content_heuristic_unittest.cc
@@ -61,34 +61,34 @@ TEST(PeripheralContentHeuristic, TinyContent) {
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size(10, 10)));
 }
 
-TEST(PeripheralContentHeuristic, TemporaryOriginWhitelist) {
+TEST(PeripheralContentHeuristic, TemporaryOriginAllowlist) {
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_PERIPHERAL,
             PeripheralContentHeuristic::GetPeripheralStatus(
                 std::set<url::Origin>(), url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size(100, 100)));
 
-  std::set<url::Origin> whitelist;
-  whitelist.insert(url::Origin::Create(GURL(kOtherOrigin)));
+  std::set<url::Origin> allowlist;
+  allowlist.insert(url::Origin::Create(GURL(kOtherOrigin)));
 
-  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED,
+  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED,
             PeripheralContentHeuristic::GetPeripheralStatus(
-                whitelist, url::Origin::Create(GURL(kSameOrigin)),
+                allowlist, url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size(100, 100)));
 }
 
 TEST(PeripheralContentHeuristic, UndefinedSize) {
   // Undefined size plugins from any origin (including same-origin and
-  // whitelisted origins) are marked tiny until proven otherwise.
+  // allowlisted origins) are marked tiny until proven otherwise.
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_TINY,
             PeripheralContentHeuristic::GetPeripheralStatus(
                 std::set<url::Origin>(), url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kSameOrigin)), gfx::Size()));
 
-  std::set<url::Origin> whitelist;
-  whitelist.insert(url::Origin::Create(GURL(kOtherOrigin)));
+  std::set<url::Origin> allowlist;
+  allowlist.insert(url::Origin::Create(GURL(kOtherOrigin)));
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_TINY,
             PeripheralContentHeuristic::GetPeripheralStatus(
-                whitelist, url::Origin::Create(GURL(kSameOrigin)),
+                allowlist, url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size()));
 
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_TINY,
diff --git a/chromium/content/renderer/queue_message_swap_promise_unittest.cc b/chromium/content/renderer/queue_message_swap_promise_unittest.cc
index e3c705c7898..f9cb7f1df14 100644
--- a/chromium/content/renderer/queue_message_swap_promise_unittest.cc
+++ b/chromium/content/renderer/queue_message_swap_promise_unittest.cc
@@ -17,7 +17,6 @@
 #include "content/common/widget_messages.h"
 #include "content/renderer/frame_swap_message_queue.h"
 #include "content/renderer/render_widget.h"
-#include "content/test/mock_render_process.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "ipc/ipc_test_sink.h"
diff --git a/chromium/content/renderer/render_frame_impl.cc b/chromium/content/renderer/render_frame_impl.cc
index 2ab5e79b71c..d3461419137 100644
--- a/chromium/content/renderer/render_frame_impl.cc
+++ b/chromium/content/renderer/render_frame_impl.cc
@@ -52,7 +52,6 @@
 #include "content/common/associated_interfaces.mojom.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/content_navigation_policy.h"
-#include "content/common/edit_command.h"
 #include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_replication_state.h"
@@ -72,10 +71,10 @@
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/isolated_world_ids.h"
 #include "content/public/common/navigation_policy.h"
 #include "content/public/common/page_state.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/common/untrustworthy_context_menu_params.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
@@ -96,12 +95,12 @@
 #include "content/renderer/crash_helpers.h"
 #include "content/renderer/dom_automation_controller.h"
 #include "content/renderer/effective_connection_type_helper.h"
-#include "content/renderer/external_popup_menu.h"
 #include "content/renderer/frame_owner_properties_converter.h"
 #include "content/renderer/gpu_benchmarking_extension.h"
 #include "content/renderer/history_entry.h"
 #include "content/renderer/history_serialization.h"
 #include "content/renderer/ime_event_guard.h"
+#include "content/renderer/impression_conversions.h"
 #include "content/renderer/input/frame_input_handler_impl.h"
 #include "content/renderer/input/input_target_client_impl.h"
 #include "content/renderer/input/widget_input_handler_manager.h"
@@ -140,6 +139,7 @@
 #include "content/renderer/web_ui_extension_data.h"
 #include "content/renderer/worker/dedicated_worker_host_factory_client.h"
 #include "crypto/sha2.h"
+#include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
@@ -160,7 +160,6 @@
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/features.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "third_party/blink/public/common/logging/logging_utils.h"
@@ -172,6 +171,7 @@
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "third_party/blink/public/mojom/loader/request_context_frame_type.mojom.h"
 #include "third_party/blink/public/mojom/permissions/permission.mojom.h"
 #include "third_party/blink/public/mojom/referrer.mojom.h"
@@ -254,8 +254,6 @@ using blink::WebDOMEvent;
 using blink::WebDOMMessageEvent;
 using blink::WebElement;
 using blink::WebElementCollection;
-using blink::WebExternalPopupMenu;
-using blink::WebExternalPopupMenuClient;
 using blink::WebFrame;
 using blink::WebFrameLoadType;
 using blink::WebFrameSerializer;
@@ -272,7 +270,6 @@ using blink::WebNavigationType;
 using blink::WebNode;
 using blink::WebPluginDocument;
 using blink::WebPluginParams;
-using blink::WebPopupMenuInfo;
 using blink::WebRange;
 using blink::WebRect;
 using blink::WebScriptSource;
@@ -1386,7 +1383,8 @@ RenderFrameImpl* RenderFrameImpl::CreateMainFrame(
 
   WebLocalFrame* web_frame = WebLocalFrame::CreateMainFrame(
       render_view->GetWebView(), render_frame,
-      render_frame->blink_interface_registry_.get(), opener,
+      render_frame->blink_interface_registry_.get(),
+      params->main_frame_frame_token, opener,
       // This conversion is a little sad, as this often comes from a
       // WebString...
       WebString::FromUTF8(params->replicated_frame_state.name),
@@ -1397,7 +1395,6 @@ RenderFrameImpl* RenderFrameImpl::CreateMainFrame(
 
   std::unique_ptr<RenderWidget> render_widget = RenderWidget::CreateForFrame(
       params->main_frame_widget_routing_id, compositor_deps,
-      params->visual_properties.display_mode,
       render_view->widgets_never_composited());
   render_widget->set_delegate(render_view);
 
@@ -1444,6 +1441,7 @@ void RenderFrameImpl::CreateFrame(
     int opener_routing_id,
     int parent_routing_id,
     int previous_sibling_routing_id,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const FrameReplicationState& replicated_state,
     CompositorDependencies* compositor_deps,
@@ -1494,7 +1492,7 @@ void RenderFrameImpl::CreateFrame(
         render_frame->blink_interface_registry_.get(),
         previous_sibling_web_frame,
         frame_owner_properties->To<blink::WebFrameOwnerProperties>(),
-        replicated_state.frame_owner_element_type,
+        replicated_state.frame_owner_element_type, frame_token,
         ResolveWebFrame(opener_routing_id));
 
     // The RenderFrame is created and inserted into the frame tree in the above
@@ -1530,7 +1528,7 @@ void RenderFrameImpl::CreateFrame(
       previous_proxy->set_provisional_frame_routing_id(routing_id);
     web_frame = blink::WebLocalFrame::CreateProvisional(
         render_frame, render_frame->blink_interface_registry_.get(),
-        previous_web_frame, replicated_state.frame_policy,
+        frame_token, previous_web_frame, replicated_state.frame_policy,
         WebString::FromUTF8(replicated_state.name));
     // The new |web_frame| is a main frame iff the proxy's frame was.
     DCHECK_EQ(!previous_web_frame->Parent(), !web_frame->Parent());
@@ -1561,7 +1559,6 @@ void RenderFrameImpl::CreateFrame(
 
     std::unique_ptr<RenderWidget> render_widget = RenderWidget::CreateForFrame(
         widget_params->routing_id, compositor_deps,
-        widget_params->visual_properties.display_mode,
         render_view->widgets_never_composited());
     render_widget->set_delegate(render_view);
 
@@ -1611,7 +1608,6 @@ void RenderFrameImpl::CreateFrame(
     // space/context.
     std::unique_ptr<RenderWidget> render_widget = RenderWidget::CreateForFrame(
         widget_params->routing_id, compositor_deps,
-        widget_params->visual_properties.display_mode,
         render_view->widgets_never_composited());
 
     // Non-owning pointer that is self-referencing and destroyed by calling
@@ -2152,14 +2148,6 @@ bool RenderFrameImpl::Send(IPC::Message* message) {
   return RenderThread::Get()->Send(message);
 }
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-void RenderFrameImpl::DidHideExternalPopupMenu() {
-  // We need to clear external_popup_menu_ as soon as ExternalPopupMenu::close
-  // is called. Otherwise, createExternalPopupMenu() for new popup will fail.
-  external_popup_menu_.reset();
-}
-#endif
-
 bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
   // Page IPCs are routed via the main frame (both local and remote) and then
   // forwarded to the RenderView. See comment in
@@ -2190,8 +2178,6 @@ bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderFrameImpl, msg)
     IPC_MESSAGE_HANDLER(UnfreezableFrameMsg_Unload, OnUnload)
-    IPC_MESSAGE_HANDLER(FrameMsg_SwapIn, OnSwapIn)
-    IPC_MESSAGE_HANDLER(FrameMsg_Stop, OnStop)
     IPC_MESSAGE_HANDLER(FrameMsg_ContextMenuClosed, OnContextMenuClosed)
     IPC_MESSAGE_HANDLER(FrameMsg_CustomContextMenuAction,
                         OnCustomContextMenuAction)
@@ -2202,21 +2188,12 @@ bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
                         OnVisualStateRequest)
     IPC_MESSAGE_HANDLER(FrameMsg_Reload, OnReload)
     IPC_MESSAGE_HANDLER(FrameMsg_UpdateOpener, OnUpdateOpener)
-    IPC_MESSAGE_HANDLER(FrameMsg_AdvanceFocus, OnAdvanceFocus)
     IPC_MESSAGE_HANDLER(FrameMsg_GetSavableResourceLinks,
                         OnGetSavableResourceLinks)
     IPC_MESSAGE_HANDLER(FrameMsg_GetSerializedHtmlWithLocalLinks,
                         OnGetSerializedHtmlWithLocalLinks)
     IPC_MESSAGE_HANDLER(FrameMsg_MixedContentFound, OnMixedContentFound)
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-    IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItem, OnSelectPopupMenuItem)
-#else
-    IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItems, OnSelectPopupMenuItems)
-#endif
-#endif
     IPC_MESSAGE_HANDLER(UnfreezableFrameMsg_Delete, OnDeleteFrame)
-
   IPC_END_MESSAGE_MAP()
 
   return handled;
@@ -2287,7 +2264,8 @@ void RenderFrameImpl::BindNavigationClient(
 void RenderFrameImpl::OnUnload(
     int proxy_routing_id,
     bool is_loading,
-    const FrameReplicationState& replicated_frame_state) {
+    const FrameReplicationState& replicated_frame_state,
+    const base::UnguessableToken& frame_token) {
   TRACE_EVENT1("navigation,rail", "RenderFrameImpl::OnUnload", "id",
                routing_id_);
   DCHECK(!base::RunLoop::IsNestedOnCurrentThread());
@@ -2299,7 +2277,7 @@ void RenderFrameImpl::OnUnload(
   // so its routing id is registered for receiving IPC messages.
   CHECK_NE(proxy_routing_id, MSG_ROUTING_NONE);
   RenderFrameProxy* proxy = RenderFrameProxy::CreateProxyToReplaceFrame(
-      this, proxy_routing_id, replicated_frame_state.scope);
+      this, proxy_routing_id, replicated_frame_state.scope, frame_token);
 
   RenderViewImpl* render_view = render_view_;
   bool is_main_frame = is_main_frame_;
@@ -2364,10 +2342,6 @@ void RenderFrameImpl::OnUnload(
   task_runner->PostTask(FROM_HERE, std::move(send_unload_ack));
 }
 
-void RenderFrameImpl::OnSwapIn() {
-  SwapIn();
-}
-
 void RenderFrameImpl::OnDeleteFrame(FrameDeleteIntention intent) {
   // The main frame (when not provisional) is owned by the renderer's frame tree
   // via WebViewImpl. When a provisional main frame is swapped in, the ownership
@@ -2632,6 +2606,10 @@ void RenderFrameImpl::OnPortalActivated(
                             std::move(callback));
 }
 
+void RenderFrameImpl::SwapIn() {
+  SwapInInternal();
+}
+
 void RenderFrameImpl::ForwardMessageFromHost(
     blink::TransferableMessage message,
     const url::Origin& source_origin,
@@ -2701,53 +2679,6 @@ void RenderFrameImpl::OnUpdateOpener(int opener_routing_id) {
   frame_->SetOpener(opener);
 }
 
-void RenderFrameImpl::OnAdvanceFocus(blink::mojom::FocusType type,
-                                     int32_t source_routing_id) {
-  RenderFrameProxy* source_frame =
-      RenderFrameProxy::FromRoutingID(source_routing_id);
-  if (!source_frame) {
-    render_view_->GetWebView()->SetInitialFocus(
-        type == blink::mojom::FocusType::kBackward);
-    return;
-  }
-
-  render_view_->GetWebView()->AdvanceFocusAcrossFrames(
-      type, source_frame->web_frame(), frame_);
-}
-
-void RenderFrameImpl::PostMessageEvent(int32_t source_routing_id,
-                                       const base::string16& source_origin,
-                                       const base::string16& target_origin,
-                                       blink::TransferableMessage message) {
-  // Make sure that |message| owns its data so that the data is alive even after
-  // moved.
-  message.EnsureDataIsOwned();
-
-  // Find the source frame if it exists.
-  WebFrame* source_frame = nullptr;
-  if (source_routing_id != MSG_ROUTING_NONE) {
-    RenderFrameProxy* source_proxy =
-        RenderFrameProxy::FromRoutingID(source_routing_id);
-    if (source_proxy)
-      source_frame = source_proxy->web_frame();
-  }
-
-  // We must pass in the target_origin to do the security check on this side,
-  // since it may have changed since the original postMessage call was made.
-  WebSecurityOrigin target_security_origin;
-  if (!target_origin.empty()) {
-    target_security_origin = WebSecurityOrigin::CreateFromString(
-        WebString::FromUTF16(target_origin));
-  }
-
-  WebDOMMessageEvent msg_event(std::move(message),
-                               WebString::FromUTF16(source_origin),
-                               source_frame, frame_->GetDocument());
-
-  frame_->DispatchMessageEventWithOriginCheck(target_security_origin,
-                                              msg_event);
-}
-
 void RenderFrameImpl::OnReload() {
   frame_->StartReload(WebFrameLoadType::kReload);
 }
@@ -2921,9 +2852,9 @@ RenderFrameImpl::GetPeripheralContentStatus(
       main_frame_origin, content_origin, unobscured_size, record_decision);
 }
 
-void RenderFrameImpl::WhitelistContentOrigin(
+void RenderFrameImpl::AllowlistContentOrigin(
     const url::Origin& content_origin) {
-  return plugin_power_saver_helper_->WhitelistContentOrigin(content_origin);
+  return plugin_power_saver_helper_->AllowlistContentOrigin(content_origin);
 }
 
 void RenderFrameImpl::PluginDidStartLoading() {
@@ -3048,9 +2979,6 @@ void RenderFrameImpl::AllowBindings(int32_t enabled_bindings_flags) {
   }
 
   enabled_bindings_ |= enabled_bindings_flags;
-
-  // Keep track of the total bindings accumulated in this process.
-  RenderProcess::current()->AddBindings(enabled_bindings_flags);
 }
 
 void RenderFrameImpl::EnableMojoJsBindings() {
@@ -3678,7 +3606,7 @@ void RenderFrameImpl::UpdateSubresourceLoaderFactories(
 void RenderFrameImpl::BindDevToolsAgent(
     mojo::PendingAssociatedRemote<blink::mojom::DevToolsAgentHost> host,
     mojo::PendingAssociatedReceiver<blink::mojom::DevToolsAgent> receiver) {
-  frame_->BindDevToolsAgent(host.PassHandle(), receiver.PassHandle());
+  frame_->BindDevToolsAgent(std::move(host), std::move(receiver));
 }
 
 // blink::WebLocalFrameClient implementation
@@ -3776,12 +3704,14 @@ RenderFrameImpl::CreateWorkerContentSettingsClient() {
       this);
 }
 
+#if !defined(OS_ANDROID)
 std::unique_ptr<media::SpeechRecognitionClient>
 RenderFrameImpl::CreateSpeechRecognitionClient() {
   if (!frame_ || !frame_->View())
     return nullptr;
   return GetContentClient()->renderer()->CreateSpeechRecognitionClient(this);
 }
+#endif
 
 scoped_refptr<blink::WebWorkerFetchContext>
 RenderFrameImpl::CreateWorkerFetchContext() {
@@ -3810,8 +3740,6 @@ RenderFrameImpl::CreateWorkerFetchContext() {
       frame_->GetDocument().SiteForCookies());
   worker_fetch_context->set_top_frame_origin(
       frame_->GetDocument().TopFrameOrigin());
-  worker_fetch_context->set_origin_url(
-      GURL(frame_->GetDocument().Url()).GetOrigin());
 
   for (auto& observer : observers_)
     observer.WillCreateWorkerFetchContext(worker_fetch_context.get());
@@ -3840,36 +3768,12 @@ RenderFrameImpl::CreateWorkerFetchContextForPlzDedicatedWorker(
       frame_->GetDocument().SiteForCookies());
   worker_fetch_context->set_top_frame_origin(
       frame_->GetDocument().TopFrameOrigin());
-  worker_fetch_context->set_origin_url(
-      GURL(frame_->GetDocument().Url()).GetOrigin());
 
   for (auto& observer : observers_)
     observer.WillCreateWorkerFetchContext(worker_fetch_context.get());
   return worker_fetch_context;
 }
 
-WebExternalPopupMenu* RenderFrameImpl::CreateExternalPopupMenu(
-    const WebPopupMenuInfo& popup_menu_info,
-    WebExternalPopupMenuClient* popup_menu_client) {
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  // An IPC message is sent to the browser to build and display the actual
-  // popup. The user could have time to click a different select by the time
-  // the popup is shown. In that case external_popup_menu_ is non NULL.
-  // By returning NULL in that case, we instruct Blink to cancel that new
-  // popup. So from the user perspective, only the first one will show, and
-  // will have to close the first one before another one can be shown.
-  if (external_popup_menu_)
-    return nullptr;
-  external_popup_menu_ = std::make_unique<ExternalPopupMenu>(
-      this, popup_menu_info, popup_menu_client);
-  external_popup_menu_->SetOriginScaleForEmulation(
-      GetLocalRootRenderWidget()->GetEmulatorScale());
-  return external_popup_menu_.get();
-#else
-  return nullptr;
-#endif
-}
-
 std::unique_ptr<blink::WebPrescientNetworking>
 RenderFrameImpl::CreatePrescientNetworking() {
   return GetContentClient()->renderer()->CreatePrescientNetworking(this);
@@ -3912,12 +3816,12 @@ RenderFrameImpl::GetRemoteNavigationAssociatedInterfaces() {
 
 blink::WebLocalFrame* RenderFrameImpl::CreateChildFrame(
     blink::WebLocalFrame* parent,
-    blink::WebTreeScopeType scope,
+    blink::mojom::TreeScopeType scope,
     const blink::WebString& name,
     const blink::WebString& fallback_name,
     const blink::FramePolicy& frame_policy,
     const blink::WebFrameOwnerProperties& frame_owner_properties,
-    blink::FrameOwnerElementType frame_owner_element_type) {
+    blink::mojom::FrameOwnerElementType frame_owner_element_type) {
   DCHECK_EQ(frame_, parent);
 
   // Synchronously notify the browser of a child frame creation to get the
@@ -3991,7 +3895,8 @@ blink::WebLocalFrame* RenderFrameImpl::CreateChildFrame(
   child_render_frame->InitializeBlameContext(this);
   blink::WebLocalFrame* web_frame = parent->CreateLocalChild(
       scope, child_render_frame,
-      child_render_frame->blink_interface_registry_.get());
+      child_render_frame->blink_interface_registry_.get(),
+      params_reply.frame_token);
 
   child_render_frame->in_frame_tree_ = true;
   child_render_frame->Initialize();
@@ -4001,22 +3906,23 @@ blink::WebLocalFrame* RenderFrameImpl::CreateChildFrame(
 
 std::pair<blink::WebRemoteFrame*, base::UnguessableToken>
 RenderFrameImpl::CreatePortal(
-    mojo::ScopedInterfaceEndpointHandle portal_endpoint,
-    mojo::ScopedInterfaceEndpointHandle client_endpoint,
+    blink::CrossVariantMojoAssociatedReceiver<blink::mojom::PortalInterfaceBase>
+        portal_endpoint,
+    blink::CrossVariantMojoAssociatedRemote<
+        blink::mojom::PortalClientInterfaceBase> client_endpoint,
     const blink::WebElement& portal_element) {
   int proxy_routing_id = MSG_ROUTING_NONE;
   FrameReplicationState initial_replicated_state;
   base::UnguessableToken portal_token;
+  base::UnguessableToken frame_token;
   base::UnguessableToken devtools_frame_token;
-  GetFrameHost()->CreatePortal(
-      mojo::PendingAssociatedReceiver<blink::mojom::Portal>(
-          std::move(portal_endpoint)),
-      mojo::PendingAssociatedRemote<blink::mojom::PortalClient>(
-          std::move(client_endpoint), blink::mojom::PortalClient::Version_),
-      &proxy_routing_id, &initial_replicated_state, &portal_token,
-      &devtools_frame_token);
+  GetFrameHost()->CreatePortal(std::move(portal_endpoint),
+                               std::move(client_endpoint), &proxy_routing_id,
+                               &initial_replicated_state, &portal_token,
+                               &frame_token, &devtools_frame_token);
   RenderFrameProxy* proxy = RenderFrameProxy::CreateProxyForPortal(
-      this, proxy_routing_id, devtools_frame_token, portal_element);
+      this, proxy_routing_id, frame_token, devtools_frame_token,
+      portal_element);
   proxy->SetReplicatedState(initial_replicated_state);
   return std::make_pair(proxy->web_frame(), portal_token);
 }
@@ -4025,13 +3931,16 @@ blink::WebRemoteFrame* RenderFrameImpl::AdoptPortal(
     const base::UnguessableToken& portal_token,
     const blink::WebElement& portal_element) {
   int proxy_routing_id = MSG_ROUTING_NONE;
+  base::UnguessableToken frame_token;
   base::UnguessableToken devtools_frame_token;
   FrameReplicationState replicated_state;
   viz::FrameSinkId frame_sink_id;
   GetFrameHost()->AdoptPortal(portal_token, &proxy_routing_id, &frame_sink_id,
-                              &replicated_state, &devtools_frame_token);
+                              &replicated_state, &frame_token,
+                              &devtools_frame_token);
   RenderFrameProxy* proxy = RenderFrameProxy::CreateProxyForPortal(
-      this, proxy_routing_id, devtools_frame_token, portal_element);
+      this, proxy_routing_id, frame_token, devtools_frame_token,
+      portal_element);
   proxy->FrameSinkIdChanged(frame_sink_id);
   proxy->SetReplicatedState(replicated_state);
   return proxy->web_frame();
@@ -4144,26 +4053,17 @@ void RenderFrameImpl::DidChangeFramePolicy(
 }
 
 void RenderFrameImpl::DidSetFramePolicyHeaders(
-    blink::mojom::WebSandboxFlags flags,
+    network::mojom::WebSandboxFlags flags,
     const blink::ParsedFeaturePolicy& fp_header,
     const blink::DocumentPolicy::FeatureState& dp_header) {
   // If any of Feature Policy or Sandbox Flags or Document Policy are different
   // from the default (empty) values, then send them to the browser.
   if (!dp_header.empty() || !fp_header.empty() ||
-      flags != blink::mojom::WebSandboxFlags::kNone) {
+      flags != network::mojom::WebSandboxFlags::kNone) {
     GetFrameHost()->DidSetFramePolicyHeaders(flags, fp_header, dp_header);
   }
 }
 
-void RenderFrameImpl::DidChangeFrameOwnerProperties(
-    blink::WebFrame* child_frame,
-    const blink::WebFrameOwnerProperties& frame_owner_properties) {
-  Send(new FrameHostMsg_DidChangeFrameOwnerProperties(
-      routing_id_, RenderFrame::GetRoutingIdForWebFrame(child_frame),
-      *(blink::mojom::FrameOwnerProperties::From(frame_owner_properties)
-            .get())));
-}
-
 void RenderFrameImpl::DidMatchCSS(
     const blink::WebVector<blink::WebString>& newly_matching_selectors,
     const blink::WebVector<blink::WebString>& stopped_matching_selectors) {
@@ -4254,39 +4154,25 @@ void RenderFrameImpl::DidCommitNavigation(
                "id", routing_id_,
                "url", GetLoadingUrl().possibly_invalid_spec());
 
-  base::Optional<base::UnguessableToken> embedding_token = base::nullopt;
-  if (previous_routing_id_ != MSG_ROUTING_NONE) {
+  bool is_provisional_frame = previous_routing_id_ != MSG_ROUTING_NONE;
+  if (is_provisional_frame) {
     // If this is a provisional frame associated with a proxy (i.e., a frame
     // created for a remote-to-local navigation), swap it into the frame tree
     // now.
-    if (!SwapIn())
+    if (!SwapInInternal())
       return;
+  }
 
-    // Main frames don't require an embedding token since they aren't embedded
-    // in anything. Frames local to their parent also aren't considered to be
-    // embedded.
-    if (!is_main_frame_ && frame_->Parent()->IsWebRemoteFrame()) {
-      embedding_token = base::UnguessableToken::Create();
-      GetWebFrame()->SetEmbeddingToken(embedding_token.value());
-    }
-  } else {
-    // If this is not a provisional frame then use the old embedding token. This
-    // will be base::nullopt if there was no old embedding token.
-    embedding_token = GetWebFrame()->GetEmbeddingToken();
-
-    // In the case a crashed subframe is navigating to the same site
-    // e.g. https://crbug.com/634368 then generate a new embedding token to
-    // restore a sane state.
-    //
-    // Logic behind this behavior:
-    // - Main frames don't have embedding tokens.
-    // - A remote subframe *must* have an embedding token.
-    // - If a remote subframe doesn't have an embedding token to re-use we
-    //   need to create one.
-    if (!is_main_frame_ && frame_->Parent()->IsWebRemoteFrame() &&
-        !embedding_token.has_value()) {
-      embedding_token = base::UnguessableToken::Create();
-      GetWebFrame()->SetEmbeddingToken(embedding_token.value());
+  // Main frames don't require an embedding token since they aren't embedded
+  // in anything. Frames local to their parent also aren't considered to be
+  // embedded.
+  if (!is_main_frame_ && frame_->Parent()->IsWebRemoteFrame()) {
+    // Provisional frames need a new token. Non-provisional frames need one if
+    // they don't already have one, e.g. a crashed subframe navigating to same
+    // site (https://crbug.com/634368).
+    if (is_provisional_frame ||
+        !GetWebFrame()->GetEmbeddingToken().has_value()) {
+      GetWebFrame()->SetEmbeddingToken(base::UnguessableToken::Create());
     }
   }
 
@@ -4380,7 +4266,7 @@ void RenderFrameImpl::DidCommitNavigation(
                 std::move(remote_interface_provider_receiver),
                 std::move(browser_interface_broker_receiver))
           : nullptr,
-      embedding_token);
+      GetWebFrame()->GetEmbeddingToken());
 
   // If we end up reusing this WebRequest (for example, due to a #ref click),
   // we don't want the transition type to persist.  Just clear it.
@@ -4398,7 +4284,7 @@ void RenderFrameImpl::DidCreateInitialEmptyDocument() {
     observer.DidCreateNewDocument();
 }
 
-void RenderFrameImpl::DidCommitJavascriptUrlNavigation(
+void RenderFrameImpl::DidCommitDocumentReplacementNavigation(
     blink::WebDocumentLoader* document_loader) {
   // TODO(https://crbug.com/855189): figure out which of the following observer
   // calls are necessary, if any.
@@ -4433,8 +4319,6 @@ void RenderFrameImpl::DidClearWindowObject() {
   if (command_line.HasSwitch(switches::kEnableSkiaBenchmarking))
     SkiaBenchmarking::Install(frame_);
 
-  for (auto& observer : render_view_->observers())
-    observer.DidClearWindowObject(frame_);
   for (auto& observer : observers_)
     observer.DidClearWindowObject();
 }
@@ -4620,12 +4504,12 @@ void RenderFrameImpl::DidChangeSelection(bool is_empty_selection) {
 
 bool RenderFrameImpl::HandleCurrentKeyboardEvent() {
   bool did_execute_command = false;
-  for (auto command : GetLocalRootRenderWidget()->edit_commands()) {
+  for (const auto& command : GetLocalRootRenderWidget()->edit_commands()) {
     // In gtk and cocoa, it's possible to bind multiple edit commands to one
     // key (but it's the exception). Once one edit command is not executed, it
     // seems safest to not execute the rest.
-    if (!frame_->ExecuteCommand(blink::WebString::FromUTF8(command.name),
-                                blink::WebString::FromUTF8(command.value)))
+    if (!frame_->ExecuteCommand(blink::WebString::FromUTF8(command->name),
+                                blink::WebString::FromUTF8(command->value)))
       break;
     did_execute_command = true;
   }
@@ -4725,7 +4609,7 @@ void RenderFrameImpl::WillSendRequestInternal(
 
   ApplyFilePathAlias(&request);
   GURL new_url;
-  bool attach_same_site_cookies = false;
+  bool force_ignore_site_for_cookies = false;
   base::Optional<url::Origin> initiator_origin =
       request.RequestorOrigin().IsNull()
           ? base::Optional<url::Origin>()
@@ -4733,7 +4617,7 @@ void RenderFrameImpl::WillSendRequestInternal(
   GetContentClient()->renderer()->WillSendRequest(
       frame_, transition_type, request.Url(), request.SiteForCookies(),
       base::OptionalOrNullptr(initiator_origin), &new_url,
-      &attach_same_site_cookies);
+      &force_ignore_site_for_cookies);
   if (!new_url.is_empty())
     request.SetUrl(WebURL(new_url));
 
@@ -4770,7 +4654,7 @@ void RenderFrameImpl::WillSendRequestInternal(
   bool is_for_no_state_prefetch =
       GetContentClient()->renderer()->IsPrefetchOnly(this, request);
   extra_data->set_is_for_no_state_prefetch(is_for_no_state_prefetch);
-  extra_data->set_attach_same_site_cookies(attach_same_site_cookies);
+  extra_data->set_force_ignore_site_for_cookies(force_ignore_site_for_cookies);
   extra_data->set_frame_request_blocker(frame_request_blocker_);
   extra_data->set_allow_cross_origin_auth_prompt(
       render_view_->renderer_preferences().allow_cross_origin_auth_prompt);
@@ -4803,24 +4687,11 @@ void RenderFrameImpl::WillSendRequestInternal(
 void RenderFrameImpl::DidLoadResourceFromMemoryCache(
     const blink::WebURLRequest& request,
     const blink::WebURLResponse& response) {
-  // The recipients of this message have no use for data: URLs: they don't
-  // affect the page's insecure content list and are not in the disk cache. To
-  // prevent large (1M+) data: URLs from crashing in the IPC system, we simply
-  // filter them out here.
-  if (request.Url().ProtocolIs(url::kDataScheme))
-    return;
-
   for (auto& observer : observers_) {
     observer.DidLoadResourceFromMemoryCache(
         request.Url(), response.RequestId(), response.EncodedBodyLength(),
         response.MimeType().Utf8(), response.FromArchive());
   }
-
-  // Let the browser know we loaded a resource from the memory cache.  This
-  // message is needed to display the correct SSL indicators.
-  Send(new FrameHostMsg_DidLoadResourceFromMemoryCache(
-      routing_id_, request.Url(), request.HttpMethod().Utf8(),
-      response.MimeType().Utf8(), request.GetRequestDestination()));
 }
 
 void RenderFrameImpl::DidStartResponse(
@@ -4909,6 +4780,15 @@ void RenderFrameImpl::DidObserveLayoutShift(double score,
     observer.DidObserveLayoutShift(score, after_input_or_scroll);
 }
 
+void RenderFrameImpl::DidObserveLayoutNg(uint32_t all_block_count,
+                                         uint32_t ng_block_count,
+                                         uint32_t all_call_count,
+                                         uint32_t ng_call_count) {
+  for (auto& observer : observers_)
+    observer.DidObserveLayoutNg(all_block_count, ng_block_count, all_call_count,
+                                ng_call_count);
+}
+
 void RenderFrameImpl::DidObserveLazyLoadBehavior(
     WebLocalFrameClient::LazyLoadBehavior lazy_load_behavior) {
   for (auto& observer : observers_)
@@ -5018,14 +4898,12 @@ bool RenderFrameImpl::AllowContentInitiatedDataUrlNavigations(
   return url.GetString() == kUnreachableWebDataURL;
 }
 
-void RenderFrameImpl::PostAccessibilityEvent(const blink::WebAXObject& obj,
-                                             ax::mojom::Event event,
-                                             ax::mojom::EventFrom event_from) {
+void RenderFrameImpl::PostAccessibilityEvent(const ui::AXEvent& event) {
   if (!IsAccessibilityEnabled())
     return;
 
   render_accessibility_manager_->GetRenderAccessibilityImpl()
-      ->HandleWebAccessibilityEvent(obj, event, event_from);
+      ->HandleWebAccessibilityEvent(event);
 }
 
 void RenderFrameImpl::MarkWebAXObjectDirty(const blink::WebAXObject& obj,
@@ -5055,20 +4933,6 @@ void RenderFrameImpl::RemoveObserver(RenderFrameObserver* observer) {
   observers_.RemoveObserver(observer);
 }
 
-void RenderFrameImpl::OnStop() {
-  DCHECK(frame_);
-
-  // The stopLoading call may run script, which may cause this frame to be
-  // detached/deleted.  If that happens, return immediately.
-  base::WeakPtr<RenderFrameImpl> weak_this = weak_factory_.GetWeakPtr();
-  frame_->StopLoading();
-  if (!weak_this)
-    return;
-
-  for (auto& observer : observers_)
-    observer.OnStop();
-}
-
 void RenderFrameImpl::OnDroppedNavigation() {
   browser_side_navigation_pending_ = false;
   browser_side_navigation_pending_url_ = GURL();
@@ -5514,7 +5378,7 @@ blink::mojom::CommitResult RenderFrameImpl::PrepareForHistoryNavigationCommit(
   return blink::mojom::CommitResult::Ok;
 }
 
-bool RenderFrameImpl::SwapIn() {
+bool RenderFrameImpl::SwapInInternal() {
   CHECK_NE(previous_routing_id_, MSG_ROUTING_NONE);
   CHECK(!in_frame_tree_);
 
@@ -5707,9 +5571,10 @@ void RenderFrameImpl::BeginNavigation(
     // All navigations to or from WebUI URLs or within WebUI-enabled
     // RenderProcesses must be handled by the browser process so that the
     // correct bindings and data sources can be registered.
-    int cumulative_bindings = RenderProcess::current()->GetEnabledBindings();
+    // All frames in a WebUI process must have the same enabled_bindings_, so
+    // we can do a per-frame check here rather than a process-wide check.
     bool should_fork = HasWebUIScheme(url) || HasWebUIScheme(old_url) ||
-                       (cumulative_bindings & kWebUIBindingsPolicyMask);
+                       (enabled_bindings_ & kWebUIBindingsPolicyMask);
     if (should_fork) {
       OpenURL(std::move(info));
       return;  // Suppress the load here.
@@ -5728,9 +5593,7 @@ void RenderFrameImpl::BeginNavigation(
         !weak_self) {
       return;
     }
-  }
 
-  if (info->navigation_policy == blink::kWebNavigationPolicyCurrentTab) {
     if (!info->form.IsNull()) {
       for (auto& observer : observers_)
         observer.WillSubmitForm(info->form);
@@ -5947,44 +5810,6 @@ void RenderFrameImpl::RequestOverlayRoutingToken(
       base::Unretained(this), std::move(callback)));
 }
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-void RenderFrameImpl::OnSelectPopupMenuItem(int selected_index) {
-  if (external_popup_menu_ == NULL)
-    return;
-
-  if (frame_)
-    frame_->NotifyUserActivation();
-  // We need to reset |external_popup_menu_| before calling DidSelectItem(),
-  // which might delete |this|.
-  // See ExternalPopupMenuRemoveTest.RemoveFrameOnChange
-  std::unique_ptr<ExternalPopupMenu> popup;
-  popup.swap(external_popup_menu_);
-  popup->DidSelectItem(selected_index);
-}
-#else
-void RenderFrameImpl::OnSelectPopupMenuItems(
-    bool canceled,
-    const std::vector<int>& selected_indices) {
-  // It is possible to receive more than one of these calls if the user presses
-  // a select faster than it takes for the show-select-popup IPC message to make
-  // it to the browser UI thread. Ignore the extra-messages.
-  // TODO(jcivelli): http:/b/5793321 Implement a better fix, as detailed in bug.
-  if (!external_popup_menu_)
-    return;
-
-  if (frame_)
-    frame_->NotifyUserActivation();
-  // We need to reset |external_popup_menu_| before calling DidSelectItems(),
-  // which might delete |this|.
-  // See ExternalPopupMenuRemoveTest.RemoveFrameOnChange
-  std::unique_ptr<ExternalPopupMenu> popup;
-  popup.swap(external_popup_menu_);
-  popup->DidSelectItems(canceled, selected_indices);
-}
-#endif
-#endif
-
 void RenderFrameImpl::OpenURL(std::unique_ptr<blink::WebNavigationInfo> info) {
   // A valid RequestorOrigin is always expected to be present.
   DCHECK(!info->url_request.RequestorOrigin().IsNull());
@@ -6007,17 +5832,27 @@ void RenderFrameImpl::OpenURL(std::unique_ptr<blink::WebNavigationInfo> info) {
       info->frame_load_type == WebFrameLoadType::kReplaceCurrentItem &&
       render_view_->history_list_length_;
   params.user_gesture = info->has_transient_user_activation;
+
+  RenderFrameImpl* initiator_render_frame =
+      RenderFrameImpl::FromWebFrame(info->initiator_frame);
+  params.initiator_routing_id = initiator_render_frame
+                                    ? initiator_render_frame->GetRoutingID()
+                                    : MSG_ROUTING_NONE;
+
+  if (info->impression)
+    params.impression = ConvertWebImpressionToImpression(*info->impression);
+
   if (GetContentClient()->renderer()->AllowPopup())
     params.user_gesture = true;
 
-  // TODO(csharrison,dgozman): FrameLoader::StartNavigation already consumes for
-  // all main frame navigations, except in the case where page A is navigating
-  // page B (e.g. using anchor targets). This edge case can go away when
-  // UserActivationV2 ships, which would make the conditional below redundant.
-  if (is_main_frame_ || policy == blink::kWebNavigationPolicyNewBackgroundTab ||
-      policy == blink::kWebNavigationPolicyNewForegroundTab ||
-      policy == blink::kWebNavigationPolicyNewWindow ||
-      policy == blink::kWebNavigationPolicyNewPopup) {
+  // A main frame navigation should already have consumed an activation in
+  // FrameLoader::StartNavigation.
+  DCHECK(!is_main_frame_ || !frame_->HasTransientUserActivation());
+  if (!is_main_frame_ &&
+      (policy == blink::kWebNavigationPolicyNewBackgroundTab ||
+       policy == blink::kWebNavigationPolicyNewForegroundTab ||
+       policy == blink::kWebNavigationPolicyNewWindow ||
+       policy == blink::kWebNavigationPolicyNewPopup)) {
     frame_->ConsumeTransientUserActivation();
   }
 
@@ -6307,8 +6142,16 @@ void RenderFrameImpl::BeginNavigationInternal(
     initiator = base::DictionaryValue::From(
         base::JSONReader::ReadDeprecated(info->devtools_initiator_info.Utf8()));
   }
+
+  RenderFrameImpl* initiator_render_frame =
+      RenderFrameImpl::FromWebFrame(info->initiator_frame);
+  int initiator_frame_routing_id = initiator_render_frame
+                                       ? initiator_render_frame->GetRoutingID()
+                                       : MSG_ROUTING_NONE;
+
   mojom::BeginNavigationParamsPtr begin_navigation_params =
       mojom::BeginNavigationParams::New(
+          initiator_frame_routing_id,
           GetWebURLRequestHeadersAsString(info->url_request), load_flags,
           info->url_request.GetSkipServiceWorker(),
           GetRequestContextTypeForWebURLRequest(info->url_request),
@@ -6318,10 +6161,14 @@ void RenderFrameImpl::BeginNavigationInternal(
           searchable_form_encoding, client_side_redirect_url,
           initiator ? base::make_optional<base::Value>(std::move(*initiator))
                     : base::nullopt,
-          info->url_request.GetExtraData()->attach_same_site_cookies(),
+          info->url_request.GetExtraData()->force_ignore_site_for_cookies(),
           info->url_request.TrustTokenParams()
               ? info->url_request.TrustTokenParams()->Clone()
-              : nullptr);
+              : nullptr,
+          info->impression
+              ? base::make_optional<Impression>(
+                    ConvertWebImpressionToImpression(*info->impression))
+              : base::nullopt);
 
   mojo::PendingAssociatedRemote<mojom::NavigationClient>
       navigation_client_remote;
@@ -6405,7 +6252,7 @@ bool RenderFrameImpl::ShouldDisplayErrorPageForFailedLoad(
 
   // Allow the embedder to suppress an error page.
   if (GetContentClient()->renderer()->ShouldSuppressErrorPage(
-          this, unreachable_url)) {
+          this, unreachable_url, error_code)) {
     return false;
   }
 
@@ -6439,7 +6286,7 @@ void RenderFrameImpl::HandlePepperImeCommit(const base::string16& text) {
     base::i18n::UTF16CharIterator iterator(&text);
     int32_t i = 0;
     while (iterator.Advance()) {
-      blink::WebKeyboardEvent char_event(blink::WebInputEvent::kChar,
+      blink::WebKeyboardEvent char_event(blink::WebInputEvent::Type::kChar,
                                          blink::WebInputEvent::kNoModifiers,
                                          ui::EventTimeForNow());
       char_event.windows_key_code = text[i];
@@ -6453,7 +6300,7 @@ void RenderFrameImpl::HandlePepperImeCommit(const base::string16& text) {
 
       if (GetLocalRootRenderWidget()->GetWebWidget())
         GetLocalRootRenderWidget()->GetWebWidget()->HandleInputEvent(
-            blink::WebCoalescedInputEvent(char_event));
+            blink::WebCoalescedInputEvent(char_event, ui::LatencyInfo()));
     }
   } else {
     // Mimics the order of events sent by WebKit.
@@ -6544,6 +6391,11 @@ RenderFrameImpl::CreateURLLoaderFactory() {
   return std::make_unique<FrameURLLoaderFactory>(weak_factory_.GetWeakPtr());
 }
 
+void RenderFrameImpl::OnStopLoading() {
+  for (auto& observer : observers_)
+    observer.OnStop();
+}
+
 void RenderFrameImpl::DraggableRegionsChanged() {
   for (auto& observer : observers_)
     observer.DraggableRegionsChanged();
@@ -6789,6 +6641,16 @@ void RenderFrameImpl::TransferUserActivationFrom(
   }
 }
 
+bool RenderFrameImpl::GetCaretBoundsFromFocusedPlugin(gfx::Rect& rect) {
+#if BUILDFLAG(ENABLE_PLUGINS)
+  if (focused_pepper_plugin_) {
+    rect = focused_pepper_plugin_->GetCaretBounds();
+    return true;
+  }
+#endif
+  return false;
+}
+
 void RenderFrameImpl::AddMessageToConsoleImpl(
     blink::mojom::ConsoleMessageLevel level,
     const std::string& message,
diff --git a/chromium/content/renderer/render_frame_impl.h b/chromium/content/renderer/render_frame_impl.h
index 6a33dcf8df3..0963dea51a8 100644
--- a/chromium/content/renderer/render_frame_impl.h
+++ b/chromium/content/renderer/render_frame_impl.h
@@ -79,7 +79,6 @@
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/loader/loading_behavior_flag.h"
 #include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "third_party/blink/public/mojom/autoplay/autoplay.mojom.h"
@@ -88,6 +87,7 @@
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-forward.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-forward.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-forward.h"
@@ -103,6 +103,7 @@
 #include "third_party/blink/public/web/web_local_frame_client.h"
 #include "third_party/blink/public/web/web_meaningful_layout.h"
 #include "third_party/blink/public/web/web_script_execution_callback.h"
+#include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/gfx/range/range.h"
 #include "url/gurl.h"
@@ -139,7 +140,9 @@ class Range;
 
 namespace media {
 class MediaPermission;
+#if !defined(OS_ANDROID)
 class SpeechRecognitionClient;
+#endif
 }
 
 namespace service_manager {
@@ -159,7 +162,6 @@ namespace content {
 class BlinkInterfaceRegistryImpl;
 class CompositorDependencies;
 class DocumentState;
-class ExternalPopupMenu;
 class FrameRequestBlocker;
 class MediaPermissionDispatcher;
 class NavigationClient;
@@ -225,6 +227,7 @@ class CONTENT_EXPORT RenderFrameImpl
       int opener_routing_id,
       int parent_routing_id,
       int previous_sibling_routing_id,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const FrameReplicationState& replicated_state,
       CompositorDependencies* compositor_deps,
@@ -308,10 +311,12 @@ class CONTENT_EXPORT RenderFrameImpl
   // Returns the RenderWidget associated with this frame.
   RenderWidget* GetLocalRootRenderWidget();
 
-  // This method must be called after the frame has been added to the frame
-  // tree. It creates all objects that depend on the frame being at its proper
-  // spot.
-  void Initialize();
+  // This method must be called after the WebLocalFrame backing this RenderFrame
+  // has been created and added to the frame tree. It creates all objects that
+  // depend on the frame being at its proper spot.
+  //
+  // Virtual for web tests to inject their own behaviour into the WebLocalFrame.
+  virtual void Initialize();
 
   // Notifications from RenderWidget.
   void WasHidden();
@@ -414,10 +419,6 @@ class CONTENT_EXPORT RenderFrameImpl
 
   void ScriptedPrint(bool user_initiated);
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  void DidHideExternalPopupMenu();
-#endif
-
   // IPC::Sender
   bool Send(IPC::Message* msg) override;
 
@@ -459,7 +460,7 @@ class CONTENT_EXPORT RenderFrameImpl
       const url::Origin& content_origin,
       const gfx::Size& unobscured_size,
       RecordPeripheralDecision record_decision) override;
-  void WhitelistContentOrigin(const url::Origin& content_origin) override;
+  void AllowlistContentOrigin(const url::Origin& content_origin) override;
   void PluginDidStartLoading() override;
   void PluginDidStopLoading() override;
 #endif
@@ -524,10 +525,6 @@ class CONTENT_EXPORT RenderFrameImpl
   void EnableMojoJsBindings() override;
 
   // mojom::FrameNavigationControl implementation:
-  void PostMessageEvent(int32_t source_routing_id,
-                        const base::string16& source_origin,
-                        const base::string16& target_origin,
-                        blink::TransferableMessage message) override;
   void ForwardMessageFromHost(
       blink::TransferableMessage message,
       const url::Origin& source_origin,
@@ -621,6 +618,7 @@ class CONTENT_EXPORT RenderFrameImpl
       mojo::PendingAssociatedReceiver<blink::mojom::PortalClient> portal_client,
       blink::TransferableMessage data,
       OnPortalActivatedCallback callback) override;
+  void SwapIn() override;
 
   // mojom::FullscreenVideoElementHandler implementation:
   void RequestFullscreenVideoElement() override;
@@ -641,16 +639,15 @@ class CONTENT_EXPORT RenderFrameImpl
       const blink::WebString& sink_id) override;
   std::unique_ptr<blink::WebContentSettingsClient>
   CreateWorkerContentSettingsClient() override;
+#if !defined(OS_ANDROID)
   std::unique_ptr<media::SpeechRecognitionClient>
   CreateSpeechRecognitionClient();
+#endif
   scoped_refptr<blink::WebWorkerFetchContext> CreateWorkerFetchContext()
       override;
   scoped_refptr<blink::WebWorkerFetchContext>
   CreateWorkerFetchContextForPlzDedicatedWorker(
       blink::WebDedicatedWorkerHostFactoryClient* factory_client) override;
-  blink::WebExternalPopupMenu* CreateExternalPopupMenu(
-      const blink::WebPopupMenuInfo& popup_menu_info,
-      blink::WebExternalPopupMenuClient* popup_menu_client) override;
   std::unique_ptr<blink::WebPrescientNetworking> CreatePrescientNetworking()
       override;
   blink::BlameContext* GetFrameBlameContext() override;
@@ -660,15 +657,17 @@ class CONTENT_EXPORT RenderFrameImpl
       override;
   blink::WebLocalFrame* CreateChildFrame(
       blink::WebLocalFrame* parent,
-      blink::WebTreeScopeType scope,
+      blink::mojom::TreeScopeType scope,
       const blink::WebString& name,
       const blink::WebString& fallback_name,
       const blink::FramePolicy& frame_policy,
       const blink::WebFrameOwnerProperties& frame_owner_properties,
-      blink::FrameOwnerElementType frame_owner_element_type) override;
+      blink::mojom::FrameOwnerElementType frame_owner_element_type) override;
   std::pair<blink::WebRemoteFrame*, base::UnguessableToken> CreatePortal(
-      mojo::ScopedInterfaceEndpointHandle portal_endpoint,
-      mojo::ScopedInterfaceEndpointHandle client_endpoint,
+      blink::CrossVariantMojoAssociatedReceiver<
+          blink::mojom::PortalInterfaceBase> portal_endpoint,
+      blink::CrossVariantMojoAssociatedRemote<
+          blink::mojom::PortalClientInterfaceBase> client_endpoint,
       const blink::WebElement& portal_element) override;
   blink::WebRemoteFrame* AdoptPortal(
       const base::UnguessableToken& portal_token,
@@ -680,12 +679,9 @@ class CONTENT_EXPORT RenderFrameImpl
   void DidChangeFramePolicy(blink::WebFrame* child_frame,
                             const blink::FramePolicy& frame_policy) override;
   void DidSetFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags flags,
+      network::mojom::WebSandboxFlags flags,
       const blink::ParsedFeaturePolicy& fp_header,
       const blink::DocumentPolicy::FeatureState& dp_header) override;
-  void DidChangeFrameOwnerProperties(
-      blink::WebFrame* child_frame,
-      const blink::WebFrameOwnerProperties& frame_owner_properties) override;
   void DidMatchCSS(
       const blink::WebVector<blink::WebString>& newly_matching_selectors,
       const blink::WebVector<blink::WebString>& stopped_matching_selectors)
@@ -705,7 +701,7 @@ class CONTENT_EXPORT RenderFrameImpl
                            blink::WebHistoryCommitType commit_type,
                            bool should_reset_browser_interface_broker) override;
   void DidCreateInitialEmptyDocument() override;
-  void DidCommitJavascriptUrlNavigation(
+  void DidCommitDocumentReplacementNavigation(
       blink::WebDocumentLoader* document_loader) override;
   void DidClearWindowObject() override;
   void DidCreateDocumentElement() override;
@@ -745,6 +741,10 @@ class CONTENT_EXPORT RenderFrameImpl
   void DidObserveNewCssPropertyUsage(blink::mojom::CSSSampleId css_property,
                                      bool is_animated) override;
   void DidObserveLayoutShift(double score, bool after_input_or_scroll) override;
+  void DidObserveLayoutNg(uint32_t all_block_count,
+                          uint32_t ng_block_count,
+                          uint32_t all_call_count,
+                          uint32_t ng_call_count) override;
   void DidObserveLazyLoadBehavior(
       blink::WebLocalFrameClient::LazyLoadBehavior lazy_load_behavior) override;
   bool ShouldTrackUseCounter(const blink::WebURL& url) override;
@@ -761,15 +761,14 @@ class CONTENT_EXPORT RenderFrameImpl
   mojom::RendererAudioInputStreamFactory* GetAudioInputStreamFactory();
   bool AllowContentInitiatedDataUrlNavigations(
       const blink::WebURL& url) override;
-  void PostAccessibilityEvent(const blink::WebAXObject& obj,
-                              ax::mojom::Event event,
-                              ax::mojom::EventFrom event_from) override;
+  void PostAccessibilityEvent(const ui::AXEvent& event) override;
   void MarkWebAXObjectDirty(const blink::WebAXObject& obj,
                             bool subtree) override;
   void CheckIfAudioSinkExistsAndIsAuthorized(
       const blink::WebString& sink_id,
       blink::WebSetSinkIdCompleteCallback callback) override;
   std::unique_ptr<blink::WebURLLoaderFactory> CreateURLLoaderFactory() override;
+  void OnStopLoading() override;
   void DraggableRegionsChanged() override;
   blink::BrowserInterfaceBrokerProxy* GetBrowserInterfaceBroker() override;
 
@@ -910,6 +909,8 @@ class CONTENT_EXPORT RenderFrameImpl
 
   void TransferUserActivationFrom(blink::WebLocalFrame* source_frame) override;
 
+  bool GetCaretBoundsFromFocusedPlugin(gfx::Rect& rect) override;
+
   // Used in tests to install a fake WebURLLoaderFactory via
   // RenderViewTest::CreateFakeWebURLLoaderFactory().
   void SetWebURLLoaderFactoryOverrideForTest(
@@ -926,11 +927,6 @@ class CONTENT_EXPORT RenderFrameImpl
   friend class RenderFrameObserver;
   friend class TestRenderFrame;
 
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuDisplayNoneTest, SelectItem);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuRemoveTest, RemoveFrameOnChange);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuRemoveTest, RemoveOnChange);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuTest, NormalCase);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuTest, ShowPopupThenNavigate);
   FRIEND_TEST_ALL_PREFIXES(RenderAccessibilityImplTest,
                            AccessibilityMessagesQueueWhileSwappedOut);
   FRIEND_TEST_ALL_PREFIXES(RenderFrameImplTest, LocalChildFrameWasShown);
@@ -1009,12 +1005,12 @@ class CONTENT_EXPORT RenderFrameImpl
   void RemoveObserver(RenderFrameObserver* observer);
 
   // Swaps the current frame into the frame tree, replacing the
-  // RenderFrameProxy it is associated with.  Return value indicates whether
-  // the swap operation succeeded.  This should only be used for provisional
-  // frames associated with a proxy, while the proxy is still in the frame
-  // tree. If the associated proxy has been detached before this is called,
-  // this returns false and aborts the swap.
-  bool SwapIn();
+  // RenderFrameProxy it is associated with. Return value indicates whether
+  // the swap operation succeeded. This should only be used for provisional
+  // frames associated with a proxy, while the proxy is still in the frame tree.
+  // If the associated proxy has been detached before this is called, this
+  // returns false and aborts the swap.
+  bool SwapInInternal();
 
   // Returns the RenderWidget associated with the main frame.
   // TODO(ajwong): This method should go away when cross-frame property setting
@@ -1028,12 +1024,11 @@ class CONTENT_EXPORT RenderFrameImpl
   //
   // The documentation for these functions should be in
   // content/common/*_messages.h for the message that the function is handling.
-  void OnSwapIn();
   void OnUnload(int proxy_routing_id,
                 bool is_loading,
-                const FrameReplicationState& replicated_frame_state);
+                const FrameReplicationState& replicated_frame_state,
+                const base::UnguessableToken& frame_token);
   void OnDeleteFrame(FrameDeleteIntention intent);
-  void OnStop();
   void OnShowContextMenu(const gfx::Point& location);
   void OnContextMenuClosed(const CustomContextMenuContext& custom_context);
   void OnCustomContextMenuAction(const CustomContextMenuContext& custom_context,
@@ -1045,7 +1040,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // TODO(https://crbug.com/995428): Deprecated.
   void OnReload();
   void OnUpdateOpener(int opener_routing_id);
-  void OnAdvanceFocus(blink::mojom::FocusType type, int32_t source_routing_id);
   void OnGetSavableResourceLinks();
   void OnGetSerializedHtmlWithLocalLinks(
       const std::map<GURL, base::FilePath>& url_to_local_path,
@@ -1054,15 +1048,6 @@ class CONTENT_EXPORT RenderFrameImpl
   void OnSuppressFurtherDialogs();
   void OnMixedContentFound(const FrameMsg_MixedContentFound_Params& params);
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-  void OnSelectPopupMenuItem(int selected_index);
-#else
-  void OnSelectPopupMenuItems(bool canceled,
-                              const std::vector<int>& selected_indices);
-#endif
-#endif
-
   // Callback scheduled from SerializeAsMHTML for when writing serialized
   // MHTML to the handle has been completed in the file thread.
   void OnWriteMHTMLComplete(
@@ -1361,7 +1346,7 @@ class CONTENT_EXPORT RenderFrameImpl
   bool in_frame_tree_;
 
   RenderViewImpl* render_view_;
-  int routing_id_;
+  const int routing_id_;
 
   // If this RenderFrame was created to replace a previous object, this will
   // store its routing id. The previous object can be:
@@ -1459,11 +1444,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // Whether or not this RenderFrame is currently pasting.
   bool is_pasting_;
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  // The external popup for the currently showing select popup.
-  std::unique_ptr<ExternalPopupMenu> external_popup_menu_;
-#endif
-
   std::unique_ptr<FrameBlameContext> blame_context_;
 
   // Plugins -------------------------------------------------------------------
diff --git a/chromium/content/renderer/render_frame_impl_browsertest.cc b/chromium/content/renderer/render_frame_impl_browsertest.cc
index 1f6d2113836..866a4905895 100644
--- a/chromium/content/renderer/render_frame_impl_browsertest.cc
+++ b/chromium/content/renderer/render_frame_impl_browsertest.cc
@@ -113,7 +113,8 @@ class RenderFrameImplTest : public RenderViewTest {
 
     RenderFrameImpl::FromWebFrame(
         view_->GetMainRenderFrame()->GetWebFrame()->FirstChild())
-        ->OnUnload(kFrameProxyRouteId, false, frame_replication_state);
+        ->OnUnload(kFrameProxyRouteId, false, frame_replication_state,
+                   base::UnguessableToken::Create());
 
     mojo::PendingRemote<service_manager::mojom::InterfaceProvider>
         stub_interface_provider;
@@ -128,8 +129,8 @@ class RenderFrameImplTest : public RenderViewTest {
         kSubframeRouteId, std::move(stub_interface_provider),
         std::move(stub_browser_interface_broker), MSG_ROUTING_NONE,
         MSG_ROUTING_NONE, kFrameProxyRouteId, MSG_ROUTING_NONE,
-        base::UnguessableToken::Create(), frame_replication_state,
-        &compositor_deps_, std::move(widget_params),
+        base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+        frame_replication_state, &compositor_deps_, std::move(widget_params),
         blink::mojom::FrameOwnerProperties::New(),
         /*has_committed_real_load=*/true);
 
@@ -289,8 +290,9 @@ TEST_F(RenderFrameImplTest, LocalChildFrameWasShown) {
   blink::WebLocalFrame* parent_web_frame = frame()->GetWebFrame();
 
   parent_web_frame->CreateLocalChild(
-      blink::WebTreeScopeType::kDocument, grandchild,
-      grandchild->blink_interface_registry_.get());
+      blink::mojom::TreeScopeType::kDocument, grandchild,
+      grandchild->blink_interface_registry_.get(),
+      base::UnguessableToken::Create());
   grandchild->in_frame_tree_ = true;
   grandchild->Initialize();
 
@@ -538,8 +540,7 @@ TEST_F(RenderFrameImplTest, DISABLED_MainFrameDocumentIntersectionRecorded) {
   frame_widget()->OnMessageReceived(set_viewport_intersection_message);
   // Setting a new frame intersection in a local frame triggers the render frame
   // observer call.
-  EXPECT_EQ(observer.last_intersection_rect(),
-            blink::WebRect(7, -11, 200, 140));
+  EXPECT_EQ(observer.last_intersection_rect(), blink::WebRect(0, 0, 200, 140));
 }
 
 // Used to annotate the source of an interface request.
diff --git a/chromium/content/renderer/render_frame_proxy.cc b/chromium/content/renderer/render_frame_proxy.cc
index 676217a665c..fb083b2f555 100644
--- a/chromium/content/renderer/render_frame_proxy.cc
+++ b/chromium/content/renderer/render_frame_proxy.cc
@@ -21,16 +21,19 @@
 #include "content/common/view_messages.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/screen_info.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/child_frame_compositing_helper.h"
+#include "content/renderer/impression_conversions.h"
 #include "content/renderer/loader/web_url_request_util.h"
 #include "content/renderer/mojo/blink_interface_registry_impl.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/render_widget.h"
+#include "ipc/ipc_message.h"
 #include "ipc/ipc_message_macros.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "printing/buildflags/buildflags.h"
@@ -71,7 +74,8 @@ base::LazyInstance<FrameProxyMap>::DestructorAtExit g_frame_proxy_map =
 RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
     RenderFrameImpl* frame_to_replace,
     int routing_id,
-    blink::WebTreeScopeType scope) {
+    blink::mojom::TreeScopeType scope,
+    const base::UnguessableToken& proxy_frame_token) {
   CHECK_NE(routing_id, MSG_ROUTING_NONE);
 
   std::unique_ptr<RenderFrameProxy> proxy(new RenderFrameProxy(routing_id));
@@ -83,7 +87,7 @@ RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
   // follow later.
   blink::WebRemoteFrame* web_frame = blink::WebRemoteFrame::Create(
       scope, proxy.get(), proxy->blink_interface_registry_.get(),
-      proxy->GetRemoteAssociatedInterfaces());
+      proxy->GetRemoteAssociatedInterfaces(), proxy_frame_token);
 
   RenderWidget* ancestor_widget = nullptr;
   bool parent_is_local = false;
@@ -117,6 +121,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
     blink::WebFrame* opener,
     int parent_routing_id,
     const FrameReplicationState& replicated_state,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token) {
   RenderFrameProxy* parent = nullptr;
   if (parent_routing_id != MSG_ROUTING_NONE) {
@@ -140,7 +145,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
     web_frame = blink::WebRemoteFrame::CreateMainFrame(
         render_view->GetWebView(), proxy.get(),
         proxy->blink_interface_registry_.get(),
-        proxy->GetRemoteAssociatedInterfaces(), opener);
+        proxy->GetRemoteAssociatedInterfaces(), frame_token, opener);
     // Root frame proxy has no ancestors to point to their RenderWidget.
   } else {
     // Create a frame under an existing parent. The parent is always expected
@@ -152,7 +157,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
         replicated_state.frame_policy,
         replicated_state.frame_owner_element_type, proxy.get(),
         proxy->blink_interface_registry_.get(),
-        proxy->GetRemoteAssociatedInterfaces(), opener);
+        proxy->GetRemoteAssociatedInterfaces(), frame_token, opener);
     proxy->unique_name_ = replicated_state.unique_name;
     render_view = parent->render_view();
     ancestor_widget = parent->ancestor_render_widget_;
@@ -175,14 +180,15 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
 RenderFrameProxy* RenderFrameProxy::CreateProxyForPortal(
     RenderFrameImpl* parent,
     int proxy_routing_id,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const blink::WebElement& portal_element) {
   auto proxy = base::WrapUnique(new RenderFrameProxy(proxy_routing_id));
   proxy->devtools_frame_token_ = devtools_frame_token;
   blink::WebRemoteFrame* web_frame = blink::WebRemoteFrame::CreateForPortal(
-      blink::WebTreeScopeType::kDocument, proxy.get(),
+      blink::mojom::TreeScopeType::kDocument, proxy.get(),
       proxy->blink_interface_registry_.get(),
-      proxy->GetRemoteAssociatedInterfaces(), portal_element);
+      proxy->GetRemoteAssociatedInterfaces(), frame_token, portal_element);
   proxy->Init(web_frame, parent->render_view(),
               parent->GetLocalRootRenderWidget(), true);
   return proxy.release();
@@ -628,13 +634,16 @@ void RenderFrameProxy::ForwardPostMessage(
   Send(new FrameHostMsg_RouteMessageEvent(routing_id_, params));
 }
 
-void RenderFrameProxy::Navigate(const blink::WebURLRequest& request,
-                                bool should_replace_current_entry,
-                                bool is_opener_navigation,
-                                bool initiator_frame_has_download_sandbox_flag,
-                                bool blocking_downloads_in_sandbox_enabled,
-                                bool initiator_frame_is_ad,
-                                mojo::ScopedMessagePipeHandle blob_url_token) {
+void RenderFrameProxy::Navigate(
+    const blink::WebURLRequest& request,
+    blink::WebLocalFrame* initiator_frame,
+    bool should_replace_current_entry,
+    bool is_opener_navigation,
+    bool initiator_frame_has_download_sandbox_flag,
+    bool blocking_downloads_in_sandbox_enabled,
+    bool initiator_frame_is_ad,
+    mojo::ScopedMessagePipeHandle blob_url_token,
+    const base::Optional<blink::WebImpression>& impression) {
   // The request must always have a valid initiator origin.
   DCHECK(!request.RequestorOrigin().IsNull());
 
@@ -652,6 +661,15 @@ void RenderFrameProxy::Navigate(const blink::WebURLRequest& request,
   params.triggering_event_info = blink::TriggeringEventInfo::kUnknown;
   params.blob_url_token = blob_url_token.release();
 
+  RenderFrameImpl* initiator_render_frame =
+      RenderFrameImpl::FromWebFrame(initiator_frame);
+  params.initiator_routing_id = initiator_render_frame
+                                    ? initiator_render_frame->GetRoutingID()
+                                    : MSG_ROUTING_NONE;
+
+  if (impression)
+    params.impression = ConvertWebImpressionToImpression(*impression);
+
   // Note: For the AdFrame/Sandbox download policy here it only covers the case
   // where the navigation initiator frame is ad. The download_policy may be
   // further augmented in RenderFrameProxyHost::OnOpenURL if the navigating
diff --git a/chromium/content/renderer/render_frame_proxy.h b/chromium/content/renderer/render_frame_proxy.h
index d202bf52adf..6012fd36b03 100644
--- a/chromium/content/renderer/render_frame_proxy.h
+++ b/chromium/content/renderer/render_frame_proxy.h
@@ -78,7 +78,8 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
   static RenderFrameProxy* CreateProxyToReplaceFrame(
       RenderFrameImpl* frame_to_replace,
       int routing_id,
-      blink::WebTreeScopeType scope);
+      blink::mojom::TreeScopeType scope,
+      const base::UnguessableToken& proxy_frame_token);
 
   // This method should be used to create a RenderFrameProxy, when there isn't
   // an existing RenderFrame. It should be called to construct a local
@@ -99,6 +100,7 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
       blink::WebFrame* opener,
       int parent_routing_id,
       const FrameReplicationState& replicated_state,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token);
 
   // Creates a RenderFrameProxy to be used with a portal owned by |parent|.
@@ -106,6 +108,7 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
   static RenderFrameProxy* CreateProxyForPortal(
       RenderFrameImpl* parent,
       int proxy_routing_id,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const blink::WebElement& portal_element);
 
@@ -178,13 +181,16 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
                           blink::WebRemoteFrame* targetFrame,
                           blink::WebSecurityOrigin target,
                           blink::WebDOMMessageEvent event) override;
-  void Navigate(const blink::WebURLRequest& request,
-                bool should_replace_current_entry,
-                bool is_opener_navigation,
-                bool initiator_frame_has_download_sandbox_flag,
-                bool blocking_downloads_in_sandbox_enabled,
-                bool initiator_frame_is_ad,
-                mojo::ScopedMessagePipeHandle blob_url_token) override;
+  void Navigate(
+      const blink::WebURLRequest& request,
+      blink::WebLocalFrame* initiator_frame,
+      bool should_replace_current_entry,
+      bool is_opener_navigation,
+      bool initiator_frame_has_download_sandbox_flag,
+      bool blocking_downloads_in_sandbox_enabled,
+      bool initiator_frame_is_ad,
+      mojo::ScopedMessagePipeHandle blob_url_token,
+      const base::Optional<blink::WebImpression>& impression) override;
   void FrameRectsChanged(const blink::WebRect& local_frame_rect,
                          const blink::WebRect& screen_space_rect) override;
   void UpdateRemoteViewportIntersection(
diff --git a/chromium/content/renderer/render_process.h b/chromium/content/renderer/render_process.h
index e18ea7ae216..69f93d3ee75 100644
--- a/chromium/content/renderer/render_process.h
+++ b/chromium/content/renderer/render_process.h
@@ -30,13 +30,6 @@ class RenderProcess : public ChildProcess {
                     thread_pool_init_params);
   ~RenderProcess() override {}
 
-  // Keep track of the cumulative set of enabled bindings for this process,
-  // across any view.
-  virtual void AddBindings(int bindings) = 0;
-
-  // The cumulative set of enabled bindings for this process.
-  virtual int GetEnabledBindings() const = 0;
-
   // Returns a pointer to the RenderProcess singleton instance. Assuming that
   // we're actually a renderer or a renderer test, this static cast will
   // be correct.
diff --git a/chromium/content/renderer/render_process_impl.cc b/chromium/content/renderer/render_process_impl.cc
index f31a4f949bd..fb9d6684a78 100644
--- a/chromium/content/renderer/render_process_impl.cc
+++ b/chromium/content/renderer/render_process_impl.cc
@@ -88,8 +88,7 @@ void V8DcheckCallbackHandler(const char* file, int line, const char* message) {
 namespace content {
 
 RenderProcessImpl::RenderProcessImpl()
-    : RenderProcess("Renderer", GetThreadPoolInitParams()),
-      enabled_bindings_(0) {
+    : RenderProcess("Renderer", GetThreadPoolInitParams()) {
 #if defined(DCHECK_IS_CONFIGURABLE)
   // Some official builds ship with DCHECKs compiled in. Failing DCHECKs then
   // are either fatal or simply log the error, based on a feature flag.
@@ -221,11 +220,6 @@ RenderProcessImpl::RenderProcessImpl()
       v8::V8::SetFlagsFromString(flag.as_string().c_str(), flag.size());
     }
   }
-
-  if (command_line.HasSwitch(switches::kDomAutomationController))
-    enabled_bindings_ |= BINDINGS_POLICY_DOM_AUTOMATION;
-  if (command_line.HasSwitch(switches::kStatsCollectionController))
-    enabled_bindings_ |= BINDINGS_POLICY_STATS_COLLECTION;
 }
 
 RenderProcessImpl::~RenderProcessImpl() {
@@ -242,14 +236,6 @@ std::unique_ptr<RenderProcess> RenderProcessImpl::Create() {
   return base::WrapUnique(new RenderProcessImpl());
 }
 
-void RenderProcessImpl::AddBindings(int bindings) {
-  enabled_bindings_ |= bindings;
-}
-
-int RenderProcessImpl::GetEnabledBindings() const {
-  return enabled_bindings_;
-}
-
 void RenderProcessImpl::AddRefProcess() {
   NOTREACHED();
 }
diff --git a/chromium/content/renderer/render_process_impl.h b/chromium/content/renderer/render_process_impl.h
index b8f72956625..67dfe3f903f 100644
--- a/chromium/content/renderer/render_process_impl.h
+++ b/chromium/content/renderer/render_process_impl.h
@@ -27,10 +27,6 @@ class RenderProcessImpl : public RenderProcess {
   // required by constructor of the base class.
   static std::unique_ptr<RenderProcess> Create();
 
-  // RenderProcess implementation.
-  void AddBindings(int bindings) override;
-  int GetEnabledBindings() const override;
-
   // Do not use these functions.
   // The browser process is the only one responsible for knowing when to
   // shutdown its renderer processes. Reference counting to keep this process
@@ -42,10 +38,6 @@ class RenderProcessImpl : public RenderProcess {
  private:
   RenderProcessImpl();
 
-  // Bitwise-ORed set of extra bindings that have been enabled anywhere in this
-  // process.  See BindingsPolicy for details.
-  int enabled_bindings_;
-
   DISALLOW_COPY_AND_ASSIGN(RenderProcessImpl);
 };
 
diff --git a/chromium/content/renderer/render_thread_impl.cc b/chromium/content/renderer/render_thread_impl.cc
index 76176518dfe..b305148481d 100644
--- a/chromium/content/renderer/render_thread_impl.cc
+++ b/chromium/content/renderer/render_thread_impl.cc
@@ -61,7 +61,6 @@
 #include "content/child/thread_safe_sender.h"
 #include "content/common/buildflags.h"
 #include "content/common/content_constants_internal.h"
-#include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/render_frame_metadata.mojom.h"
 #include "content/common/view_messages.h"
@@ -182,6 +181,10 @@
 #include <malloc.h>
 #endif
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+#include "base/test/clang_profiling.h"
+#endif
+
 using base::ThreadRestrictions;
 using blink::WebDocument;
 using blink::WebFrame;
@@ -662,6 +665,9 @@ void RenderThreadImpl::Init() {
 // but the system default is true.
 #if defined(OS_MACOSX)
   is_elastic_overscroll_enabled_ = true;
+#elif defined(OS_WIN)
+  is_elastic_overscroll_enabled_ =
+      base::FeatureList::IsEnabled(features::kElasticOverscrollWin);
 #else
   is_elastic_overscroll_enabled_ = false;
 #endif
@@ -880,8 +886,8 @@ IPC::SyncMessageFilter* RenderThreadImpl::GetSyncMessageFilter() {
 
 void RenderThreadImpl::AddRoute(int32_t routing_id, IPC::Listener* listener) {
   ChildThreadImpl::GetRouter()->AddRoute(routing_id, listener);
-  auto it = pending_frame_creates_.find(routing_id);
-  if (it == pending_frame_creates_.end())
+  auto it = pending_frames_.find(routing_id);
+  if (it == pending_frames_.end())
     return;
 
   RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(routing_id);
@@ -897,25 +903,22 @@ void RenderThreadImpl::AddRoute(int32_t routing_id, IPC::Listener* listener) {
       frame->GetTaskRunner(
           blink::TaskType::kInternalNavigationAssociatedUnfreezable));
 
-  scoped_refptr<PendingFrameCreate> create(it->second);
-  frame->BindFrame(it->second->TakeFrameReceiver());
-  pending_frame_creates_.erase(it);
+  frame->BindFrame(std::move(it->second));
+  pending_frames_.erase(it);
 }
 
 void RenderThreadImpl::RemoveRoute(int32_t routing_id) {
   ChildThreadImpl::GetRouter()->RemoveRoute(routing_id);
   unfreezable_message_filter_->RemoveListenerUnfreezableTaskRunner(routing_id);
   GetChannel()->RemoveListenerTaskRunner(routing_id);
+  pending_frames_.erase(routing_id);
 }
 
 void RenderThreadImpl::RegisterPendingFrameCreate(
     int routing_id,
     mojo::PendingReceiver<mojom::Frame> frame_receiver) {
-  std::pair<PendingFrameCreateMap::iterator, bool> result =
-      pending_frame_creates_.insert(std::make_pair(
-          routing_id, base::MakeRefCounted<PendingFrameCreate>(
-                          routing_id, std::move(frame_receiver))));
-  CHECK(result.second) << "Inserting a duplicate item.";
+  auto pair = pending_frames_.emplace(routing_id, std::move(frame_receiver));
+  CHECK(pair.second) << "Inserting a duplicate item.";
 }
 
 mojom::RendererHost* RenderThreadImpl::GetRendererHost() {
@@ -1090,9 +1093,10 @@ int RenderThreadImpl::PostTaskToAllWebWorkers(base::RepeatingClosure closure) {
 }
 
 bool RenderThreadImpl::ResolveProxy(const GURL& url, std::string* proxy_list) {
-  bool result = false;
-  Send(new ViewHostMsg_ResolveProxy(url, &result, proxy_list));
-  return result;
+  base::Optional<std::string> result;
+  GetRendererHost()->ResolveProxy(url, &result);
+  *proxy_list = result.value_or(std::string());
+  return result.has_value();
 }
 
 media::GpuVideoAcceleratorFactories* RenderThreadImpl::GetGpuFactories() {
@@ -1358,9 +1362,8 @@ RenderThreadImpl::GetCompositorMainThreadTaskRunner() {
   return main_thread_compositor_task_runner_;
 }
 
-scoped_refptr<base::SingleThreadTaskRunner>
-RenderThreadImpl::GetCompositorImplThreadTaskRunner() {
-  return compositor_task_runner_;
+bool RenderThreadImpl::IsSingleThreaded() {
+  return !compositor_task_runner_;
 }
 
 scoped_refptr<base::SingleThreadTaskRunner>
@@ -1484,6 +1487,16 @@ void RenderThreadImpl::EnableV8LowMemoryMode() {
     low_memory_mode_controller_.reset(new LowMemoryModeController());
 }
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+void RenderThreadImpl::WriteClangProfilingProfile(
+    WriteClangProfilingProfileCallback callback) {
+  // This will write the profiling profile to the file that has been opened and
+  // passed to this renderer by the browser.
+  base::WriteClangProfilingProfile();
+  std::move(callback).Run();
+}
+#endif
+
 bool RenderThreadImpl::GetRendererMemoryMetrics(
     RendererMemoryMetrics* memory_metrics) const {
   DCHECK(memory_metrics);
@@ -1679,9 +1692,10 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
     const GURL& url,
     LayerTreeFrameSinkCallback callback,
     const char* client_name) {
+  const bool for_web_tests = blink::WebTestMode();
   // Misconfigured bots (eg. crbug.com/780757) could run web tests on a
   // machine where gpu compositing doesn't work. Don't crash in that case.
-  if (web_test_mode() && is_gpu_compositing_disabled_) {
+  if (for_web_tests && is_gpu_compositing_disabled_) {
     LOG(FATAL) << "Web tests require gpu compositing, but it is disabled.";
     return;
   }
@@ -1705,7 +1719,7 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
       *base::CommandLine::ForCurrentProcess();
   cc::mojo_embedder::AsyncLayerTreeFrameSink::InitParams params;
   params.compositor_task_runner = compositor_task_runner_;
-  if (web_test_mode() && !compositor_task_runner_) {
+  if (for_web_tests && !compositor_task_runner_) {
     // The frame sink provider expects a compositor task runner, but we might
     // not have that if we're running web tests in single threaded mode.
     // Set it to be our thread's task runner instead.
@@ -1734,7 +1748,7 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
       compositor_frame_sink_client.InitWithNewPipeAndPassReceiver();
 
   if (is_gpu_compositing_disabled_) {
-    DCHECK(!web_test_mode());
+    DCHECK(!for_web_tests);
     frame_sink_provider_->CreateForWidget(
         render_widget->routing_id(), std::move(compositor_frame_sink_receiver),
         std::move(compositor_frame_sink_client));
@@ -1892,8 +1906,8 @@ void RenderThreadImpl::CreateFrame(mojom::CreateFrameParamsPtr params) {
       params->routing_id, std::move(interface_provider),
       std::move(browser_interface_broker), params->previous_routing_id,
       params->opener_routing_id, params->parent_routing_id,
-      params->previous_sibling_routing_id, params->devtools_frame_token,
-      params->replication_state, compositor_deps,
+      params->previous_sibling_routing_id, params->frame_token,
+      params->devtools_frame_token, params->replication_state, compositor_deps,
       std::move(params->widget_params),
       std::move(params->frame_owner_properties),
       params->has_committed_real_load);
@@ -1905,11 +1919,12 @@ void RenderThreadImpl::CreateFrameProxy(
     int32_t opener_routing_id,
     int32_t parent_routing_id,
     const FrameReplicationState& replicated_state,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token) {
   RenderFrameProxy::CreateFrameProxy(
       routing_id, render_view_routing_id,
       RenderFrameImpl::ResolveWebFrame(opener_routing_id), parent_routing_id,
-      replicated_state, devtools_frame_token);
+      replicated_state, frame_token, devtools_frame_token);
 }
 
 void RenderThreadImpl::OnNetworkConnectionChanged(
@@ -2201,19 +2216,6 @@ void RenderThreadImpl::ReleaseFreeMemory() {
   }
 }
 
-RenderThreadImpl::PendingFrameCreate::PendingFrameCreate(
-    int routing_id,
-    mojo::PendingReceiver<mojom::Frame> frame_receiver)
-    : routing_id_(routing_id), frame_receiver_(std::move(frame_receiver)) {}
-
-RenderThreadImpl::PendingFrameCreate::~PendingFrameCreate() = default;
-
-void RenderThreadImpl::PendingFrameCreate::OnConnectionError() {
-  size_t erased =
-      RenderThreadImpl::current()->pending_frame_creates_.erase(routing_id_);
-  DCHECK_EQ(1u, erased);
-}
-
 void RenderThreadImpl::OnSyncMemoryPressure(
     base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level) {
   if (!blink::MainThreadIsolate())
diff --git a/chromium/content/renderer/render_thread_impl.h b/chromium/content/renderer/render_thread_impl.h
index 5734290d5c3..301ea6a3055 100644
--- a/chromium/content/renderer/render_thread_impl.h
+++ b/chromium/content/renderer/render_thread_impl.h
@@ -16,6 +16,7 @@
 #include <vector>
 
 #include "base/cancelable_callback.h"
+#include "base/clang_profiling_buildflags.h"
 #include "base/macros.h"
 #include "base/memory/discardable_memory_allocator.h"
 #include "base/memory/memory_pressure_listener.h"
@@ -198,10 +199,7 @@ class CONTENT_EXPORT RenderThreadImpl
   bool IsGpuMemoryBufferCompositorResourcesEnabled() override;
   bool IsElasticOverscrollEnabled() override;
   bool IsUseZoomForDSFEnabled() override;
-  scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorMainThreadTaskRunner() override;
-  scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorImplThreadTaskRunner() override;
+  bool IsSingleThreaded() override;
   scoped_refptr<base::SingleThreadTaskRunner> GetCleanupTaskRunner() override;
   blink::scheduler::WebThreadScheduler* GetWebMainThreadScheduler() override;
   cc::TaskGraphRunner* GetTaskGraphRunner() override;
@@ -218,6 +216,8 @@ class CONTENT_EXPORT RenderThreadImpl
 #endif
 
   bool IsThreadedAnimationEnabled();
+  scoped_refptr<base::SingleThreadTaskRunner>
+  GetCompositorMainThreadTaskRunner();
 
   // viz::mojom::CompositingModeWatcher implementation.
   void CompositingModeFallbackToSoftware() override;
@@ -237,12 +237,6 @@ class CONTENT_EXPORT RenderThreadImpl
 
   blink::AssociatedInterfaceRegistry* GetAssociatedInterfaceRegistry();
 
-  // True if we are running web tests. This currently disables forwarding
-  // various status messages to the console, skips network error pages, and
-  // short circuits size update and focus events.
-  bool web_test_mode() const { return web_test_mode_; }
-  void enable_web_test_mode() { web_test_mode_ = true; }
-
   base::DiscardableMemoryAllocator* GetDiscardableMemoryAllocatorForTest()
       const {
     return discardable_memory_allocator_.get();
@@ -470,6 +464,7 @@ class CONTENT_EXPORT RenderThreadImpl
       int32_t opener_routing_id,
       int32_t parent_routing_id,
       const FrameReplicationState& replicated_state,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token) override;
   void OnNetworkConnectionChanged(
       net::NetworkChangeNotifier::ConnectionType type,
@@ -494,7 +489,10 @@ class CONTENT_EXPORT RenderThreadImpl
   void SetSchedulerKeepActive(bool keep_active) override;
   void SetIsLockedToSite() override;
   void EnableV8LowMemoryMode() override;
-
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+  void WriteClangProfilingProfile(
+      WriteClangProfilingProfileCallback callback) override;
+#endif
   void OnMemoryPressure(
       base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level);
 
@@ -554,9 +552,6 @@ class CONTENT_EXPORT RenderThreadImpl
   blink::WebString user_agent_;
   blink::UserAgentMetadata user_agent_metadata_;
 
-  // Used to control web test specific behavior.
-  bool web_test_mode_ = false;
-
   // Sticky once true, indicates that compositing is done without Gpu, so
   // resources given to the compositor or to the viz service should be
   // software-based.
@@ -626,30 +621,9 @@ class CONTENT_EXPORT RenderThreadImpl
   // Target rendering ColorSpace.
   gfx::ColorSpace rendering_color_space_;
 
-  class PendingFrameCreate : public base::RefCounted<PendingFrameCreate> {
-   public:
-    PendingFrameCreate(int routing_id,
-                       mojo::PendingReceiver<mojom::Frame> frame_receiver);
-
-    mojo::PendingReceiver<mojom::Frame> TakeFrameReceiver() {
-      return std::move(frame_receiver_);
-    }
-
-   private:
-    friend class base::RefCounted<PendingFrameCreate>;
-
-    ~PendingFrameCreate();
-
-    // Mojo error handler.
-    void OnConnectionError();
-
-    int routing_id_;
-    mojo::PendingReceiver<mojom::Frame> frame_receiver_;
-  };
-
-  using PendingFrameCreateMap =
-      std::map<int, scoped_refptr<PendingFrameCreate>>;
-  PendingFrameCreateMap pending_frame_creates_;
+  // Used when AddRoute() is called and the RenderFrameImpl hasn't been created
+  // yet.
+  std::map<int, mojo::PendingReceiver<mojom::Frame>> pending_frames_;
 
   mojo::AssociatedRemote<mojom::RendererHost> renderer_host_;
 
diff --git a/chromium/content/renderer/render_thread_impl_browsertest.cc b/chromium/content/renderer/render_thread_impl_browsertest.cc
index e009558e858..9add01eef49 100644
--- a/chromium/content/renderer/render_thread_impl_browsertest.cc
+++ b/chromium/content/renderer/render_thread_impl_browsertest.cc
@@ -38,17 +38,18 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/test/browser_task_environment.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_content_client_initializer.h"
 #include "content/public/test/test_launcher.h"
 #include "content/renderer/render_process_impl.h"
-#include "content/test/mock_render_process.h"
 #include "gpu/GLES2/gl2extchromium.h"
 #include "gpu/command_buffer/client/gpu_memory_buffer_manager.h"
 #include "gpu/config/gpu_switches.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 #include "third_party/blink/public/platform/scheduler/test/web_mock_thread_scheduler.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
@@ -163,7 +164,7 @@ class RenderThreadImplBrowserTest : public testing::Test,
         ChildProcessHost::Create(this, ChildProcessHost::IpcMode::kNormal);
     process_host_->CreateChannelMojo();
 
-    mock_process_.reset(new MockRenderProcess);
+    process_.reset(new RenderProcess);
     test_task_counter_ = base::MakeRefCounted<TestTaskCounter>();
 
     // RenderThreadImpl expects the browser to pass these flags.
@@ -179,6 +180,7 @@ class RenderThreadImplBrowserTest : public testing::Test,
     // in RenderThreadImpl::Init().
     cmd->AppendSwitch(switches::kIgnoreGpuBlacklist);
 
+    blink::Platform::InitializeBlink();
     auto main_thread_scheduler =
         blink::scheduler::CreateMockWebMainThreadSchedulerForTests();
     scoped_refptr<base::SingleThreadTaskRunner> test_task_counter(
@@ -205,11 +207,11 @@ class RenderThreadImplBrowserTest : public testing::Test,
   void TearDown() override {
     if (base::CommandLine::ForCurrentProcess()->HasSwitch(
             switches::kSingleProcessTests)) {
-      // In a single-process mode, we need to avoid destructing mock_process_
+      // In a single-process mode, we need to avoid destructing process_
       // because it will call _exit(0) and kill the process before the browser
       // side is ready to exit.
-      ANNOTATE_LEAKING_OBJECT_PTR(mock_process_.get());
-      mock_process_.release();
+      ANNOTATE_LEAKING_OBJECT_PTR(process_.get());
+      process_.release();
     }
   }
 
@@ -249,7 +251,7 @@ class RenderThreadImplBrowserTest : public testing::Test,
   const base::Process null_process_;
   std::unique_ptr<ChildProcessHost> process_host_;
 
-  std::unique_ptr<MockRenderProcess> mock_process_;
+  std::unique_ptr<RenderProcess> process_;
   scoped_refptr<QuitOnTestMsgFilter> test_msg_filter_;
 
   blink::scheduler::WebMockThreadScheduler* main_thread_scheduler_;
diff --git a/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc b/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
index 35e850d9958..c205b8e7172 100644
--- a/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
+++ b/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
@@ -25,6 +25,7 @@
 #include "components/discardable_memory/client/client_discardable_shared_memory_manager.h"
 #include "components/discardable_memory/service/discardable_shared_memory_manager.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/renderer/render_view_browsertest.cc b/chromium/content/renderer/render_view_browsertest.cc
index 490db5abcc8..d6f4b3560ae 100644
--- a/chromium/content/renderer/render_view_browsertest.cc
+++ b/chromium/content/renderer/render_view_browsertest.cc
@@ -18,6 +18,7 @@
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/gmock_callback_support.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -108,10 +109,10 @@
 #include "url/url_constants.h"
 
 #if defined(OS_ANDROID)
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_gesture_device.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #endif
 
 #if defined(OS_WIN)
@@ -124,15 +125,13 @@
 #include "ui/events/test/events_test_utils.h"
 #include "ui/events/test/events_test_utils_x11.h"
 #include "ui/events/x/x11_event_translation.h"
-#include "ui/gfx/x/x11.h"
+#include "ui/gfx/x/x11.h"  // nogncheck
 #endif
 
 #if defined(USE_OZONE)
 #include "ui/events/keycodes/keyboard_code_conversion.h"
 #endif
 
-#include "url/url_constants.h"
-
 using base::TimeDelta;
 using blink::WebFrame;
 using blink::WebFrameContentDumper;
@@ -206,8 +205,8 @@ FrameReplicationState ReconstructReplicationStateForTesting(
   blink::WebLocalFrame* frame = test_render_frame->GetWebFrame();
 
   FrameReplicationState result;
-  // can't recover result.scope - no way to get WebTreeScopeType via public
-  // blink API...
+  // can't recover result.scope - no way to get blink::mojom::TreeScopeType via
+  // public blink API...
   result.name = frame->AssignedName().Utf8();
   result.unique_name = test_render_frame->unique_name();
   result.frame_policy.sandbox_flags = frame->EffectiveSandboxFlagsForTesting();
@@ -392,7 +391,7 @@ class RenderViewImplTest : public RenderViewTest {
     NativeWebKeyboardEvent keyup_event(*event3);
     SendNativeKeyEvent(keyup_event);
 
-    long c = DomCodeToUsLayoutCharacter(
+    base::char16 c = DomCodeToUsLayoutCharacter(
         UsLayoutKeyboardCodeToDomCode(static_cast<ui::KeyboardCode>(key_code)),
         flags);
     output->assign(1, static_cast<base::char16>(c));
@@ -418,7 +417,7 @@ class RenderViewImplTest : public RenderViewTest {
     NativeWebKeyboardEvent keyup_web_event(keyup_event);
     SendNativeKeyEvent(keyup_web_event);
 
-    long c = DomCodeToUsLayoutCharacter(
+    base::char16 c = DomCodeToUsLayoutCharacter(
         UsLayoutKeyboardCodeToDomCode(static_cast<ui::KeyboardCode>(key_code)),
         flags);
     output->assign(1, static_cast<base::char16>(c));
@@ -579,7 +578,8 @@ TEST_F(RenderViewImplTest, IsPinchGestureActivePropagatesToProxies) {
           root_web_frame->FirstChild()->NextSibling()->ToWebLocalFrame()));
   ASSERT_TRUE(child_frame_2);
   child_frame_1->Unload(kProxyRoutingId, true,
-                        ReconstructReplicationStateForTesting(child_frame_1));
+                        ReconstructReplicationStateForTesting(child_frame_1),
+                        base::UnguessableToken::Create());
   EXPECT_TRUE(root_web_frame->FirstChild()->IsWebRemoteFrame());
   RenderFrameProxy* child_proxy_1 = RenderFrameProxy::FromWebFrame(
       root_web_frame->FirstChild()->ToWebRemoteFrame());
@@ -602,7 +602,8 @@ TEST_F(RenderViewImplTest, IsPinchGestureActivePropagatesToProxies) {
   // and registering of a new RenderFrameProxy, which should pick up the
   // existing setting.
   child_frame_2->Unload(kProxyRoutingId + 1, true,
-                        ReconstructReplicationStateForTesting(child_frame_2));
+                        ReconstructReplicationStateForTesting(child_frame_2),
+                        base::UnguessableToken::Create());
   EXPECT_TRUE(root_web_frame->FirstChild()->NextSibling()->IsWebRemoteFrame());
   RenderFrameProxy* child_proxy_2 = RenderFrameProxy::FromWebFrame(
       root_web_frame->FirstChild()->NextSibling()->ToWebRemoteFrame());
@@ -858,7 +859,14 @@ class RenderViewImplUpdateTitleTest : public RenderViewImplTest {
   }
 };
 
-TEST_F(RenderViewImplUpdateTitleTest, OnNavigationLoadDataWithBaseURL) {
+#if defined(OS_ANDROID)
+// Failing on Android: http://crbug.com/1080328
+#define MAYBE_OnNavigationLoadDataWithBaseURL \
+  DISABLED_OnNavigationLoadDataWithBaseURL
+#else
+#define MAYBE_OnNavigationLoadDataWithBaseURL OnNavigationLoadDataWithBaseURL
+#endif
+TEST_F(RenderViewImplUpdateTitleTest, MAYBE_OnNavigationLoadDataWithBaseURL) {
   auto common_params = CreateCommonNavigationParams();
   common_params->url = GURL("data:text/html,");
   common_params->navigation_type = mojom::NavigationType::DIFFERENT_DOCUMENT;
@@ -891,7 +899,7 @@ TEST_F(RenderViewImplTest, BeginNavigation) {
   blink::WebSecurityOrigin requestor_origin =
       blink::WebSecurityOrigin::Create(GURL("http://foo.com"));
 
-  // Navigations to normal HTTP URLs can be handled locally.
+  // Navigations to normal HTTP URLs.
   blink::WebURLRequest request(GURL("http://foo.com"));
   request.SetMode(network::mojom::RequestMode::kNavigate);
   request.SetCredentialsMode(network::mojom::CredentialsMode::kInclude);
@@ -910,10 +918,16 @@ TEST_F(RenderViewImplTest, BeginNavigation) {
   // stop and be sent to the browser.
   EXPECT_TRUE(frame()->IsBrowserSideNavigationPending());
 
-  // Verify that form posts to WebUI URLs will be sent to the browser process.
+  // Form posts to WebUI URLs.
   auto form_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   form_navigation_info->url_request = blink::WebURLRequest(GetWebUIURL("foo"));
   form_navigation_info->url_request.SetHttpMethod("POST");
+  form_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  form_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  form_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   blink::WebHTTPBody post_body;
   post_body.Initialize();
   post_body.AppendData("blah");
@@ -930,10 +944,16 @@ TEST_F(RenderViewImplTest, BeginNavigation) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Verify that popup links to WebUI URLs also are sent to browser.
+  // Popup links to WebUI URLs.
   blink::WebURLRequest popup_request(GetWebUIURL("foo"));
   auto popup_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   popup_navigation_info->url_request = blink::WebURLRequest(GetWebUIURL("foo"));
+  popup_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  popup_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  popup_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   popup_navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   popup_navigation_info->frame_type =
       blink::mojom::RequestContextFrameType::kAuxiliary;
@@ -984,9 +1004,14 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   blink::WebSecurityOrigin requestor_origin =
       blink::WebSecurityOrigin::Create(GURL("http://foo.com"));
 
-  // Navigations to normal HTTP URLs will be sent to browser process.
+  // Navigations to normal HTTP URLs.
   auto navigation_info = std::make_unique<blink::WebNavigationInfo>();
   navigation_info->url_request = blink::WebURLRequest(GURL("http://foo.com"));
+  navigation_info->url_request.SetMode(network::mojom::RequestMode::kNavigate);
+  navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   navigation_info->frame_type =
       blink::mojom::RequestContextFrameType::kTopLevel;
@@ -998,9 +1023,15 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Navigations to WebUI URLs will also be sent to browser process.
+  // Navigations to WebUI URLs.
   auto webui_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   webui_navigation_info->url_request = blink::WebURLRequest(GetWebUIURL("foo"));
+  webui_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  webui_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  webui_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   webui_navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   webui_navigation_info->frame_type =
       blink::mojom::RequestContextFrameType::kTopLevel;
@@ -1012,10 +1043,16 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Verify that form posts to data URLs will be sent to the browser process.
+  // Form posts to data URLs.
   auto data_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   data_navigation_info->url_request =
       blink::WebURLRequest(GURL("data:text/html,foo"));
+  data_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  data_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  data_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   data_navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   data_navigation_info->url_request.SetHttpMethod("POST");
   blink::WebHTTPBody post_body;
@@ -1033,15 +1070,17 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Verify that a popup that creates a view first and then navigates to a
-  // normal HTTP URL will be sent to the browser process, even though the
-  // new view does not have any enabled_bindings_.
+  // A popup that creates a view first and then navigates to a
+  // normal HTTP URL.
   blink::WebURLRequest popup_request(GURL("http://foo.com"));
   popup_request.SetRequestorOrigin(requestor_origin);
+  popup_request.SetMode(network::mojom::RequestMode::kNavigate);
+  popup_request.SetRedirectMode(network::mojom::RedirectMode::kManual);
+  popup_request.SetRequestContext(blink::mojom::RequestContextType::INTERNAL);
   blink::WebView* new_web_view = view()->CreateView(
       GetMainFrame(), popup_request, blink::WebWindowFeatures(), "foo",
       blink::kWebNavigationPolicyNewForegroundTab,
-      blink::mojom::WebSandboxFlags::kNone,
+      network::mojom::WebSandboxFlags::kNone,
       blink::FeaturePolicy::FeatureState(),
       blink::AllocateSessionStorageNamespaceId());
   RenderViewImpl* new_view = RenderViewImpl::FromWebView(new_web_view);
@@ -1080,7 +1119,8 @@ TEST_F(RenderViewImplScaleFactorTest, DeviceEmulationWithOOPIF) {
   ASSERT_TRUE(child_frame);
 
   child_frame->Unload(kProxyRoutingId + 1, true,
-                      ReconstructReplicationStateForTesting(child_frame));
+                      ReconstructReplicationStateForTesting(child_frame),
+                      base::UnguessableToken::Create());
   EXPECT_TRUE(web_frame->FirstChild()->IsWebRemoteFrame());
   RenderFrameProxy* child_proxy = RenderFrameProxy::FromWebFrame(
       web_frame->FirstChild()->ToWebRemoteFrame());
@@ -1123,7 +1163,8 @@ TEST_F(RenderViewImplTest, OriginReplicationForUnload) {
   content::FrameReplicationState replication_state =
       ReconstructReplicationStateForTesting(child_frame);
   replication_state.origin = url::Origin::Create(GURL("http://foo.com"));
-  child_frame->Unload(kProxyRoutingId, true, replication_state);
+  child_frame->Unload(kProxyRoutingId, true, replication_state,
+                      base::UnguessableToken::Create());
 
   // The child frame should now be a WebRemoteFrame.
   EXPECT_TRUE(web_frame->FirstChild()->IsWebRemoteFrame());
@@ -1140,7 +1181,8 @@ TEST_F(RenderViewImplTest, OriginReplicationForUnload) {
   TestRenderFrame* child_frame2 =
       static_cast<TestRenderFrame*>(RenderFrame::FromWebFrame(
           web_frame->FirstChild()->NextSibling()->ToWebLocalFrame()));
-  child_frame2->Unload(kProxyRoutingId + 1, true, replication_state);
+  child_frame2->Unload(kProxyRoutingId + 1, true, replication_state,
+                       base::UnguessableToken::Create());
   EXPECT_TRUE(web_frame->FirstChild()->NextSibling()->IsWebRemoteFrame());
   EXPECT_TRUE(
       web_frame->FirstChild()->NextSibling()->GetSecurityOrigin().IsOpaque());
@@ -1167,7 +1209,8 @@ TEST_F(RenderViewImplEnableZoomForDSFTest,
   content::FrameReplicationState replication_state =
       ReconstructReplicationStateForTesting(frame());
   // replication_state.origin = url::Origin(GURL("http://foo.com"));
-  frame()->Unload(kProxyRoutingId, true, replication_state);
+  frame()->Unload(kProxyRoutingId, true, replication_state,
+                  base::UnguessableToken::Create());
   EXPECT_TRUE(view()->GetWebView()->MainFrame()->IsWebRemoteFrame());
 
   // Do the remote-to-local transition for the proxy, which is to create a
@@ -1186,12 +1229,28 @@ TEST_F(RenderViewImplEnableZoomForDSFTest,
       mojom::CreateFrameWidgetParams::New();
   widget_params->routing_id = kProxyRoutingId + 2;
   widget_params->visual_properties = test_visual_properties;
+
+  mojo::AssociatedRemote<blink::mojom::FrameWidget> blink_frame_widget;
+  mojo::PendingAssociatedReceiver<blink::mojom::FrameWidget>
+      blink_frame_widget_receiver =
+          blink_frame_widget
+              .BindNewEndpointAndPassDedicatedReceiverForTesting();
+
+  mojo::AssociatedRemote<blink::mojom::FrameWidgetHost> blink_frame_widget_host;
+  mojo::PendingAssociatedReceiver<blink::mojom::FrameWidgetHost>
+      blink_frame_widget_host_receiver =
+          blink_frame_widget_host
+              .BindNewEndpointAndPassDedicatedReceiverForTesting();
+
+  widget_params->frame_widget = std::move(blink_frame_widget_receiver);
+  widget_params->frame_widget_host = blink_frame_widget_host.Unbind();
+
   RenderFrameImpl::CreateFrame(
       routing_id, std::move(stub_interface_provider),
       std::move(stub_browser_interface_broker), kProxyRoutingId,
       MSG_ROUTING_NONE, MSG_ROUTING_NONE, MSG_ROUTING_NONE,
-      base::UnguessableToken::Create(), replication_state,
-      compositor_deps_.get(), std::move(widget_params),
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      replication_state, compositor_deps_.get(), std::move(widget_params),
       blink::mojom::FrameOwnerProperties::New(),
       /*has_committed_real_load=*/true);
   TestRenderFrame* provisional_frame =
@@ -1240,7 +1299,8 @@ TEST_F(RenderViewImplTest, DetachingProxyAlsoDestroysProvisionalFrame) {
   // Unload the child frame.
   FrameReplicationState replication_state =
       ReconstructReplicationStateForTesting(child_frame);
-  child_frame->Unload(kProxyRoutingId, true, replication_state);
+  child_frame->Unload(kProxyRoutingId, true, replication_state,
+                      base::UnguessableToken::Create());
   EXPECT_TRUE(web_frame->FirstChild()->IsWebRemoteFrame());
 
   // Do the first step of a remote-to-local transition for the child proxy,
@@ -1257,7 +1317,8 @@ TEST_F(RenderViewImplTest, DetachingProxyAlsoDestroysProvisionalFrame) {
       routing_id, std::move(stub_interface_provider),
       std::move(stub_browser_interface_broker), kProxyRoutingId,
       MSG_ROUTING_NONE, frame()->GetRoutingID(), MSG_ROUTING_NONE,
-      base::UnguessableToken::Create(), replication_state, nullptr,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      replication_state, nullptr,
       /*widget_params=*/nullptr, blink::mojom::FrameOwnerProperties::New(),
       /*has_committed_real_load=*/true);
   {
@@ -1294,7 +1355,8 @@ TEST_F(RenderViewImplEnableZoomForDSFTest,
   TestRenderFrame* main_frame =
       static_cast<TestRenderFrame*>(view()->GetMainRenderFrame());
   main_frame->Unload(kProxyRoutingId, true,
-                     ReconstructReplicationStateForTesting(main_frame));
+                     ReconstructReplicationStateForTesting(main_frame),
+                     base::UnguessableToken::Create());
   EXPECT_TRUE(view()->GetWebView()->MainFrame()->IsWebRemoteFrame());
 }
 
@@ -1478,9 +1540,16 @@ TEST_F(RenderViewImplTest, EditContextGetLayoutBoundsAndInputPanelPolicy) {
   // panel policy to auto.
   ExecuteJavaScriptForTests(
       "const editContext = new EditContext(); "
-      "editContext.focus();editContext.inputPanelPolicy=\"auto\";editContext."
-      "updateLayout(new DOMRect(10, 20, 30, 40), new DOMRect(10,20, 1, 5));");
-  base::RunLoop().RunUntilIdle();
+      "editContext.focus();editContext.inputPanelPolicy=\"auto\"; "
+      "const control_bound = new DOMRect(10, 20, 30, 40); "
+      "const selection_bound = new DOMRect(10, 20, 1, 5); "
+      "editContext.updateLayout(control_bound, selection_bound);");
+  // This RunLoop is waiting for EditContext to be created and layout bounds
+  // to be updated in the EditContext.
+  base::RunLoop run_loop;
+  base::PostTask(FROM_HERE, run_loop.QuitClosure());
+  run_loop.Run();
+
   // Update the IME status and verify if our IME backend sends an IPC message
   // to notify layout bounds of the EditContext.
   main_widget()->UpdateTextInputState();
@@ -1501,6 +1570,49 @@ TEST_F(RenderViewImplTest, EditContextGetLayoutBoundsAndInputPanelPolicy) {
             actual_active_element_selection_bounds);
 }
 
+TEST_F(RenderViewImplTest, EditContextGetLayoutBoundsWithFloatingValues) {
+  // Load an HTML page.
+  LoadHTML(
+      "<html>"
+      "<head>"
+      "</head>"
+      "<body>"
+      "</body>"
+      "</html>");
+  render_thread_->sink().ClearMessages();
+  // Create an EditContext with control and selection bounds and set input
+  // panel policy to auto.
+  ExecuteJavaScriptForTests(
+      "const editContext = new EditContext(); "
+      "editContext.focus();editContext.inputPanelPolicy=\"auto\"; "
+      "const control_bound = new DOMRect(10.14, 20.25, 30.15, 40.50); "
+      "const selection_bound = new DOMRect(10, 20, 1, 5); "
+      "editContext.updateLayout(control_bound, selection_bound);");
+  // This RunLoop is waiting for EditContext to be created and layout bounds
+  // to be updated in the EditContext.
+  base::RunLoop run_loop;
+  base::PostTask(FROM_HERE, run_loop.QuitClosure());
+  run_loop.Run();
+  // Update the IME status and verify if our IME backend sends an IPC message
+  // to notify layout bounds of the EditContext.
+  main_widget()->UpdateTextInputState();
+  auto params = ProcessAndReadIPC<WidgetHostMsg_TextInputStateChanged>();
+  EXPECT_EQ(true, std::get<0>(params).show_ime_if_needed);
+  blink::WebRect edit_context_control_bounds_expected(10, 20, 31, 41);
+  blink::WebRect edit_context_selection_bounds_expected(10, 20, 1, 5);
+  main_widget()->ConvertViewportToWindow(&edit_context_control_bounds_expected);
+  main_widget()->ConvertViewportToWindow(
+      &edit_context_selection_bounds_expected);
+  blink::WebRect actual_active_element_control_bounds(
+      std::get<0>(params).edit_context_control_bounds.value());
+  blink::WebRect actual_active_element_selection_bounds(
+      std::get<0>(params).edit_context_selection_bounds.value());
+  EXPECT_EQ(edit_context_control_bounds_expected,
+            actual_active_element_control_bounds);
+  EXPECT_EQ(edit_context_selection_bounds_expected,
+            actual_active_element_selection_bounds);
+}
+
 TEST_F(RenderViewImplTest, ActiveElementGetLayoutBounds) {
   // Load an HTML page consisting of one input fields.
   LoadHTML(
@@ -1515,7 +1627,10 @@ TEST_F(RenderViewImplTest, ActiveElementGetLayoutBounds) {
   // Create an EditContext with control and selection bounds and set input
   // panel policy to auto.
   ExecuteJavaScriptForTests("document.getElementById('test').focus();");
-  base::RunLoop().RunUntilIdle();
+  // This RunLoop is waiting for focus to be processed for the active element.
+  base::RunLoop run_loop;
+  base::PostTask(FROM_HERE, run_loop.QuitClosure());
+  run_loop.Run();
   // Update the IME status and verify if our IME backend sends an IPC message
   // to notify layout bounds of the EditContext.
   main_widget()->UpdateTextInputState();
@@ -1762,7 +1877,7 @@ TEST_F(RenderViewImplTest, ContextMenu) {
 
   // Create a right click in the center of the iframe. (I'm hoping this will
   // make this a bit more robust in case of some other formatting or other bug.)
-  WebMouseEvent mouse_event(WebInputEvent::kMouseDown,
+  WebMouseEvent mouse_event(WebInputEvent::Type::kMouseDown,
                             WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   mouse_event.button = WebMouseEvent::Button::kRight;
   mouse_event.SetPositionInWidget(250, 250);
@@ -1771,7 +1886,7 @@ TEST_F(RenderViewImplTest, ContextMenu) {
   SendWebMouseEvent(mouse_event);
 
   // Now simulate the corresponding up event which should display the menu
-  mouse_event.SetType(WebInputEvent::kMouseUp);
+  mouse_event.SetType(WebInputEvent::Type::kMouseUp);
   SendWebMouseEvent(mouse_event);
 
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
@@ -1788,7 +1903,7 @@ TEST_F(RenderViewImplTest, AndroidContextMenuSelectionOrdering) {
 
   // Create a long press in the center of the iframe. (I'm hoping this will
   // make this a bit more robust in case of some other formatting or other bug.)
-  WebGestureEvent gesture_event(WebInputEvent::kGestureLongPress,
+  WebGestureEvent gesture_event(WebInputEvent::Type::kGestureLongPress,
                                 WebInputEvent::kNoModifiers,
                                 ui::EventTimeForNow());
   gesture_event.SetPositionInWidget(gfx::PointF(250, 250));
@@ -2183,7 +2298,8 @@ class RendererErrorPageTest : public RenderViewImplTest {
   class TestContentRendererClient : public ContentRendererClient {
    public:
     bool ShouldSuppressErrorPage(RenderFrame* render_frame,
-                                 const GURL& url) override {
+                                 const GURL& url,
+                                 int error_code) override {
       return url == "http://example.com/suppress";
     }
 
@@ -2609,7 +2725,8 @@ TEST_F(RenderViewImplTest, DispatchBeforeUnloadCanDetachFrame) {
 
         // Unloads the main frame.
         frame()->OnMessageReceived(UnfreezableFrameMsg_Unload(
-            frame()->GetRoutingID(), 1, false, FrameReplicationState()));
+            frame()->GetRoutingID(), 1, false, FrameReplicationState(),
+            base::UnguessableToken::Create()));
 
         was_callback_run = true;
         run_loop.Quit();
diff --git a/chromium/content/renderer/render_view_browsertest_mac.mm b/chromium/content/renderer/render_view_browsertest_mac.mm
index f8dee2b854c..60598036c03 100644
--- a/chromium/content/renderer/render_view_browsertest_mac.mm
+++ b/chromium/content/renderer/render_view_browsertest_mac.mm
@@ -100,8 +100,12 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   render_thread_->sink().ClearMessages();
 
   const char* kArrowDownScrollDown = "40,false,false,true,false\n9844";
+  auto arrow_down_scroll_down_command =
+      std::vector<blink::mojom::EditCommandPtr>();
+  arrow_down_scroll_down_command.push_back(
+      blink::mojom::EditCommand::New("moveToEndOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToEndOfDocument", "")));
+      std::move(arrow_down_scroll_down_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowDownKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
@@ -111,8 +115,11 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   EXPECT_EQ(kArrowDownScrollDown, output);
 
   const char* kArrowUpScrollUp = "38,false,false,true,false\n0";
+  auto arrow_up_scroll_up_command = std::vector<blink::mojom::EditCommandPtr>();
+  arrow_up_scroll_up_command.push_back(
+      blink::mojom::EditCommand::New("moveToBeginningOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToBeginningOfDocument", "")));
+      std::move(arrow_up_scroll_up_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowUpKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
@@ -127,8 +134,12 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   ExecuteJavaScriptForTests("allowKeyEvents = false; window.scrollTo(0, 100)");
 
   const char* kArrowDownNoScroll = "40,false,false,true,false\n100";
+  auto arrow_down_no_scroll_command =
+      std::vector<blink::mojom::EditCommandPtr>();
+  arrow_down_no_scroll_command.push_back(
+      blink::mojom::EditCommand::New("moveToEndOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToEndOfDocument", "")));
+      std::move(arrow_down_no_scroll_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowDownKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
@@ -138,8 +149,11 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   EXPECT_EQ(kArrowDownNoScroll, output);
 
   const char* kArrowUpNoScroll = "38,false,false,true,false\n100";
+  auto arrow_up_no_scroll_command = std::vector<blink::mojom::EditCommandPtr>();
+  arrow_down_no_scroll_command.push_back(
+      blink::mojom::EditCommand::New("moveToBeginningOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToBeginningOfDocument", "")));
+      std::move(arrow_down_no_scroll_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowUpKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
diff --git a/chromium/content/renderer/render_view_impl.cc b/chromium/content/renderer/render_view_impl.cc
index f0cb4833442..6fc04eb140e 100644
--- a/chromium/content/renderer/render_view_impl.cc
+++ b/chromium/content/renderer/render_view_impl.cc
@@ -447,17 +447,13 @@ void RenderViewImpl::Initialize(
   webview_ = WebView::Create(this, params->hidden,
                              /*compositing_enabled=*/true,
                              opener_frame ? opener_frame->View() : nullptr,
-                             params->blink_page_broadcast.PassHandle());
+                             std::move(params->blink_page_broadcast));
 
   g_view_map.Get().insert(std::make_pair(GetWebView(), this));
   g_routing_id_view_map.Get().insert(std::make_pair(GetRoutingID(), this));
 
   bool local_main_frame = params->main_frame_routing_id != MSG_ROUTING_NONE;
 
-  // TODO(danakj): Put this in with making the RenderFrame? Does order matter?
-  if (local_main_frame)
-    GetWebView()->SetDisplayMode(params->visual_properties.display_mode);
-
   ApplyWebPreferences(webkit_preferences_, GetWebView());
   ApplyCommandLineToSettings(GetWebView()->GetSettings());
 
@@ -465,10 +461,10 @@ void RenderViewImpl::Initialize(
     main_render_frame_ = RenderFrameImpl::CreateMainFrame(
         this, compositor_deps, opener_frame, &params, std::move(show_callback));
   } else {
-    RenderFrameProxy::CreateFrameProxy(params->proxy_routing_id, GetRoutingID(),
-                                       opener_frame, MSG_ROUTING_NONE,
-                                       params->replicated_frame_state,
-                                       params->devtools_main_frame_token);
+    RenderFrameProxy::CreateFrameProxy(
+        params->proxy_routing_id, GetRoutingID(), opener_frame,
+        MSG_ROUTING_NONE, params->replicated_frame_state,
+        params->main_frame_frame_token, params->devtools_main_frame_token);
   }
 
   // TODO(davidben): Move this state from Blink into content.
@@ -632,6 +628,9 @@ void RenderView::ApplyWebPreferences(const WebPreferences& prefs,
   WebRuntimeFeatures::EnableAccelerated2dCanvas(
       prefs.accelerated_2d_canvas_enabled);
 
+  // Enable new canvas 2d api features
+  WebRuntimeFeatures::EnableNewCanvas2DAPI(prefs.new_canvas_2d_api_enabled);
+
   // Disable antialiasing for 2d canvas if requested on the command line.
   settings->SetAntialiased2dCanvasEnabled(
       !prefs.antialiased_2d_canvas_disabled);
@@ -821,6 +820,8 @@ void RenderView::ApplyWebPreferences(const WebPreferences& prefs,
 #endif  // defined(OS_ANDROID)
   settings->SetForceDarkModeEnabled(prefs.force_dark_mode_enabled);
 
+  settings->SetAccessibilityAlwaysShowFocus(prefs.always_show_focus);
+
   switch (prefs.autoplay_policy) {
     case AutoplayPolicy::kNoUserGestureRequired:
       settings->SetAutoplayPolicy(
@@ -1048,11 +1049,6 @@ bool RenderViewImpl::ShouldAckSyntheticInputImmediately() {
   return false;
 }
 
-void RenderViewImpl::ApplyNewDisplayModeForWidget(
-    blink::mojom::DisplayMode new_display_mode) {
-  GetWebView()->SetDisplayMode(new_display_mode);
-}
-
 void RenderViewImpl::ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                                     const gfx::Size& max_size) {
   GetWebView()->EnableAutoResizeMode(min_size, max_size);
@@ -1187,7 +1183,6 @@ bool RenderViewImpl::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(ViewMsg_MoveOrResizeStarted, OnMoveOrResizeStarted)
 
     // Page messages.
-    IPC_MESSAGE_HANDLER(PageMsg_VisibilityChanged, OnPageVisibilityChanged)
     IPC_MESSAGE_HANDLER(PageMsg_SetHistoryOffsetAndLength,
                         OnSetHistoryOffsetAndLength)
     IPC_MESSAGE_HANDLER(PageMsg_AudioStateChanged, OnAudioStateChanged)
@@ -1219,7 +1214,7 @@ WebView* RenderViewImpl::CreateView(
     const WebWindowFeatures& features,
     const WebString& frame_name,
     WebNavigationPolicy policy,
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::FeaturePolicy::FeatureState& opener_feature_state,
     const blink::SessionStorageNamespaceId& session_storage_namespace_id) {
   RenderFrameImpl* creator_frame = RenderFrameImpl::FromWebFrame(creator);
@@ -1308,6 +1303,7 @@ WebView* RenderViewImpl::CreateView(
   view_params->renderer_preferences = renderer_preferences_.Clone();
   view_params->web_preferences = webkit_preferences_;
   view_params->view_id = reply->route_id;
+  view_params->main_frame_frame_token = reply->main_frame_frame_token;
   view_params->main_frame_routing_id = reply->main_frame_route_id;
   view_params->frame_widget_host = std::move(reply->frame_widget_host);
   view_params->frame_widget = std::move(reply->frame_widget);
@@ -1386,7 +1382,6 @@ blink::WebPagePopup* RenderViewImpl::CreatePopup(
 
   RenderWidget* popup_widget = RenderWidget::CreateForPopup(
       widget_routing_id, opener_render_widget->compositor_deps(),
-      blink::mojom::DisplayMode::kUndefined,
       /*hidden=*/false,
       /*never_composited=*/false, std::move(widget_channel_receiver));
 
@@ -1627,27 +1622,16 @@ bool RenderViewImpl::AllowPopupsDuringPageUnload() {
          base::FeatureList::IsEnabled(features::kAllowPopupsDuringPageUnload);
 }
 
-bool RenderViewImpl::CanUpdateLayout() {
-  return true;
-}
-
-void RenderViewImpl::SetEditCommandForNextKeyEvent(const std::string& name,
-                                                   const std::string& value) {
-  // This is test-only code. Only propagate the command if there is a main
-  // render frame.
-  if (main_render_frame_) {
-    RenderWidget* widget = main_render_frame_->GetLocalRootRenderWidget();
-    widget->SetEditCommandForNextKeyEvent(name, value);
-  }
+void RenderViewImpl::OnPageVisibilityChanged(PageVisibilityState visibility) {
+#if defined(OS_ANDROID)
+  SuspendVideoCaptureDevices(visibility != PageVisibilityState::kVisible);
+#endif
+  for (auto& observer : observers_)
+    observer.OnPageVisibilityChanged(visibility);
 }
 
-void RenderViewImpl::ClearEditCommands() {
-  // This is test-only code. Only propagate the command if there is a main
-  // render frame.
-  if (main_render_frame_) {
-    RenderWidget* widget = main_render_frame_->GetLocalRootRenderWidget();
-    widget->ClearEditCommands();
-  }
+bool RenderViewImpl::CanUpdateLayout() {
+  return true;
 }
 
 const std::string& RenderViewImpl::GetAcceptLanguages() {
@@ -1756,16 +1740,6 @@ void RenderViewImpl::OnMoveOrResizeStarted() {
     GetWebView()->CancelPagePopup();
 }
 
-void RenderViewImpl::OnPageVisibilityChanged(
-    PageVisibilityState visibility_state) {
-#if defined(OS_ANDROID)
-  SuspendVideoCaptureDevices(visibility_state != PageVisibilityState::kVisible);
-#endif
-
-  ApplyPageVisibilityState(visibility_state,
-                           /*initial_setting=*/false);
-}
-
 void RenderViewImpl::SetPageFrozen(bool frozen) {
   if (GetWebView())
     GetWebView()->SetPageFrozen(frozen);
@@ -1800,13 +1774,6 @@ void RenderViewImpl::OnSetInsidePortal(bool inside_portal) {
   GetWebView()->SetInsidePortal(inside_portal);
 }
 
-void RenderViewImpl::DidUpdateTextAutosizerPageInfo(
-    const blink::WebTextAutosizerPageInfo& page_info) {
-  DCHECK(GetWebView()->MainFrame()->IsWebLocalFrame());
-  Send(new ViewHostMsg_NotifyTextAutosizerPageInfoChangedInLocalMainFrame(
-      GetRoutingID(), page_info));
-}
-
 void RenderViewImpl::DidAutoResize(const blink::WebSize& newSize) {
   // Auto resize should only happen on local main frames.
   DCHECK(main_render_frame_);
@@ -1814,11 +1781,9 @@ void RenderViewImpl::DidAutoResize(const blink::WebSize& newSize) {
 }
 
 void RenderViewImpl::DidFocus(blink::WebLocalFrame* calling_frame) {
-  // TODO(jcivelli): when https://bugs.webkit.org/show_bug.cgi?id=33389 is fixed
-  //                 we won't have to test for user gesture anymore and we can
-  //                 move that code back to render_widget.cc
-  if (calling_frame && calling_frame->HasTransientUserActivation() &&
-      !RenderThreadImpl::current()->web_test_mode()) {
+  // We only allow focus to move to this RenderView when the request comes from
+  // a user gesture. (See also https://bugs.webkit.org/show_bug.cgi?id=33389.)
+  if (calling_frame && calling_frame->HasTransientUserActivation()) {
     Send(new ViewHostMsg_Focus(GetRoutingID()));
 
     // Tattle on the frame that called |window.focus()|.
@@ -1850,29 +1815,6 @@ unsigned RenderViewImpl::GetLocalSessionHistoryLengthForTesting() const {
   return history_list_length_;
 }
 
-void RenderViewImpl::SetFocusAndActivateForTesting(bool enable) {
-  // If the main frame is remote, return immediately. Page level focus
-  // should be set from the browser process, so if needed by tests it should
-  // be properly supported.
-  if (!main_render_frame_)
-    return;
-
-  RenderWidget* render_widget = main_render_frame_->GetLocalRootRenderWidget();
-
-  if (enable == render_widget->has_focus())
-    return;
-
-  if (enable) {
-    SetActiveForWidget(true);
-    // Fake an IPC message so go through the IPC handler.
-    render_widget->OnSetFocus(true);
-  } else {
-    // Fake an IPC message so go through the IPC handler.
-    render_widget->OnSetFocus(false);
-    SetActiveForWidget(false);
-  }
-}
-
 // static
 scoped_refptr<base::SingleThreadTaskRunner>
 RenderViewImpl::GetCleanupTaskRunner() {
diff --git a/chromium/content/renderer/render_view_impl.h b/chromium/content/renderer/render_view_impl.h
index 701aac4f786..c91cfca2f65 100644
--- a/chromium/content/renderer/render_view_impl.h
+++ b/chromium/content/renderer/render_view_impl.h
@@ -191,11 +191,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   // RenderView is the currently active RenderView of a WebContents.
   unsigned GetLocalSessionHistoryLengthForTesting() const;
 
-  // Invokes OnSetFocus and marks the widget as active depending on the value
-  // of |enable|. This is used for web tests that need to control the focus
-  // synchronously from the renderer.
-  void SetFocusAndActivateForTesting(bool enable);
-
   void UpdateBrowserControlsState(BrowserControlsState constraints,
                                   BrowserControlsState current,
                                   bool animate);
@@ -216,7 +211,7 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
       const blink::WebWindowFeatures& features,
       const blink::WebString& frame_name,
       blink::WebNavigationPolicy policy,
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::FeaturePolicy::FeatureState& opener_feature_state,
       const blink::SessionStorageNamespaceId& session_storage_namespace_id)
       override;
@@ -238,12 +233,11 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   blink::WebString AcceptLanguages() override;
   int HistoryBackListCount() override;
   int HistoryForwardListCount() override;
-  void DidUpdateTextAutosizerPageInfo(
-      const blink::WebTextAutosizerPageInfo& page_info) override;
   void DidAutoResize(const blink::WebSize& newSize) override;
   void DidFocus(blink::WebLocalFrame* calling_frame) override;
   bool CanHandleGestureEvent() override;
   bool AllowPopupsDuringPageUnload() override;
+  void OnPageVisibilityChanged(PageVisibilityState visibility) override;
 
   // RenderView implementation -------------------------------------------------
 
@@ -255,13 +249,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void SetWebkitPreferences(const WebPreferences& preferences) override;
   blink::WebView* GetWebView() override;
   bool GetContentStateImmediately() override;
-
-  // Only used for testing.
-  void SetEditCommandForNextKeyEvent(const std::string& name,
-                                     const std::string& value) override;
-  // Only used for testing.
-  void ClearEditCommands() override;
-
   const std::string& GetAcceptLanguages() override;
 
   // Please do not add your stuff randomly to the end here. If there is an
@@ -368,8 +355,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void SetActiveForWidget(bool active) override;
   bool SupportsMultipleWindowsForWidget() override;
   bool ShouldAckSyntheticInputImmediately() override;
-  void ApplyNewDisplayModeForWidget(
-      blink::mojom::DisplayMode new_display_mode) override;
   void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                       const gfx::Size& max_size) override;
   void DisableAutoResizeForWidget() override;
@@ -419,7 +404,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void OnAudioStateChanged(bool is_audio_playing);
 
   // Page message handlers -----------------------------------------------------
-  void OnPageVisibilityChanged(PageVisibilityState visibility_state);
   void SetPageFrozen(bool frozen);
   void PutPageIntoBackForwardCache();
   void RestorePageFromBackForwardCache(base::TimeTicks navigation_start);
diff --git a/chromium/content/renderer/render_widget.cc b/chromium/content/renderer/render_widget.cc
index 3010e98ca5f..1bec58e292d 100644
--- a/chromium/content/renderer/render_widget.cc
+++ b/chromium/content/renderer/render_widget.cc
@@ -54,9 +54,7 @@
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/renderer/render_thread.h"
-#include "content/renderer/compositor/layer_tree_view.h"
 #include "content/renderer/drop_data_builder.h"
-#include "content/renderer/external_popup_menu.h"
 #include "content/renderer/frame_swap_message_queue.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/main_thread_event_queue.h"
@@ -348,20 +346,6 @@ ui::TextInputMode ConvertWebTextInputMode(blink::WebTextInputMode mode) {
   return static_cast<ui::TextInputMode>(mode);
 }
 
-// Returns true if the device scale is high enough that losing subpixel
-// antialiasing won't have a noticeable effect on text quality.
-static bool DeviceScaleEnsuresTextQuality(float device_scale_factor) {
-#if defined(OS_ANDROID) || defined(OS_CHROMEOS)
-  // On Android, we never have subpixel antialiasing. On Chrome OS we prefer to
-  // composite all scrollers so that we get animated overlay scrollbars.
-  return true;
-#else
-  // 1.5 is a common touchscreen tablet device scale factor. For such
-  // devices main thread antialiasing is a heavy burden.
-  return device_scale_factor >= 1.5f;
-#endif
-}
-
 static bool ComputePreferCompositingToLCDText(
     CompositorDependencies* compositor_deps,
     float device_scale_factor) {
@@ -369,13 +353,25 @@ static bool ComputePreferCompositingToLCDText(
       *base::CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kDisablePreferCompositingToLCDText))
     return false;
+#if defined(OS_ANDROID) || defined(OS_CHROMEOS)
+  // On Android, we never have subpixel antialiasing. On Chrome OS we prefer to
+  // composite all scrollers for better scrolling performance.
+  return true;
+#else
+  // Prefer compositing if the device scale is high enough that losing subpixel
+  // antialiasing won't have a noticeable effect on text quality.
+  // Note: We should keep kHighDPIDeviceScaleFactorThreshold in
+  // cc/metrics/lcd_text_metrics_reporter.cc the same as the value below.
+  if (device_scale_factor >= 1.5f)
+    return true;
   if (command_line.HasSwitch(switches::kEnablePreferCompositingToLCDText))
     return true;
   if (!compositor_deps->IsLcdTextEnabled())
     return true;
   if (base::FeatureList::IsEnabled(features::kPreferCompositingToLCDText))
     return true;
-  return DeviceScaleEnsuresTextQuality(device_scale_factor);
+  return false;
+#endif
 }
 
 }  // namespace
@@ -391,33 +387,30 @@ void RenderWidget::InstallCreateForFrameHook(
 std::unique_ptr<RenderWidget> RenderWidget::CreateForFrame(
     int32_t widget_routing_id,
     CompositorDependencies* compositor_deps,
-    blink::mojom::DisplayMode display_mode,
     bool never_composited) {
   if (g_create_render_widget_for_frame) {
     return g_create_render_widget_for_frame(widget_routing_id, compositor_deps,
-                                            display_mode, never_composited,
+                                            /*hidden=*/true, never_composited,
                                             mojo::NullReceiver());
   }
 
-  return std::make_unique<RenderWidget>(
-      widget_routing_id, compositor_deps, display_mode,
-      /*hidden=*/true, never_composited, mojo::NullReceiver());
+  return std::make_unique<RenderWidget>(widget_routing_id, compositor_deps,
+                                        /*hidden=*/true, never_composited,
+                                        mojo::NullReceiver());
 }
 
 RenderWidget* RenderWidget::CreateForPopup(
     int32_t widget_routing_id,
     CompositorDependencies* compositor_deps,
-    blink::mojom::DisplayMode display_mode,
     bool hidden,
     bool never_composited,
     mojo::PendingReceiver<mojom::Widget> widget_receiver) {
-  return new RenderWidget(widget_routing_id, compositor_deps, display_mode,
-                          hidden, never_composited, std::move(widget_receiver));
+  return new RenderWidget(widget_routing_id, compositor_deps, hidden,
+                          never_composited, std::move(widget_receiver));
 }
 
 RenderWidget::RenderWidget(int32_t widget_routing_id,
                            CompositorDependencies* compositor_deps,
-                           blink::mojom::DisplayMode display_mode,
                            bool hidden,
                            bool never_composited,
                            mojo::PendingReceiver<mojom::Widget> widget_receiver)
@@ -425,7 +418,6 @@ RenderWidget::RenderWidget(int32_t widget_routing_id,
       compositor_deps_(compositor_deps),
       is_hidden_(hidden),
       never_composited_(never_composited),
-      display_mode_(display_mode),
       next_previous_flags_(kInvalidNextPreviousFlagsValue),
       frame_swap_message_queue_(new FrameSwapMessageQueue(routing_id_)),
       widget_receiver_(this, std::move(widget_receiver)) {
@@ -433,14 +425,6 @@ RenderWidget::RenderWidget(int32_t widget_routing_id,
   DCHECK(RenderThread::IsMainThread());
   DCHECK(compositor_deps_);
 
-  // In tests there may not be a RenderThreadImpl.
-  if (RenderThreadImpl::current()) {
-    render_widget_scheduling_state_ = RenderThreadImpl::current()
-                                          ->GetWebMainThreadScheduler()
-                                          ->NewRenderWidgetSchedulingState();
-    render_widget_scheduling_state_->SetHidden(is_hidden_);
-  }
-
   if (routing_id_ != MSG_ROUTING_NONE)
     g_routing_id_widget_map.Get().emplace(routing_id_, this);
 }
@@ -528,6 +512,10 @@ void RenderWidget::Initialize(ShowCallback show_callback,
 
   RenderThread::Get()->AddRoute(routing_id_, this);
 
+  webwidget_ = web_widget;
+  if (auto* scheduler_state = GetWebWidget()->RendererWidgetSchedulingState())
+    scheduler_state->SetHidden(is_hidden());
+
   InitCompositing(screen_info);
 
   // If the widget is hidden, delay starting the compositor until the user
@@ -535,14 +523,9 @@ void RenderWidget::Initialize(ShowCallback show_callback,
   // for a provisional frame, this importantly starts the compositor before
   // the frame is inserted into the frame tree, which impacts first paint
   // metrics.
-  if (!is_hidden_ && !never_composited_) {
+  if (!is_hidden_ && !never_composited_)
     web_widget->SetCompositorVisible(true);
-    layer_tree_view_->SetVisible(true);
-  }
 
-  webwidget_ = web_widget;
-  web_widget->SetCompositorHosts(layer_tree_view_->layer_tree_host(),
-                                 layer_tree_view_->animation_host());
   // Note that this calls into the WebWidget.
   UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
                              CompositorViewportRect(), screen_info);
@@ -590,11 +573,6 @@ bool RenderWidget::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(WidgetMsg_ForceRedraw, OnForceRedraw)
     IPC_MESSAGE_HANDLER(WidgetMsg_SetViewportIntersection,
                         OnSetViewportIntersection)
-    IPC_MESSAGE_HANDLER(WidgetMsg_SetIsInert, OnSetIsInert)
-    IPC_MESSAGE_HANDLER(WidgetMsg_SetInheritedEffectiveTouchAction,
-                        OnSetInheritedEffectiveTouchAction)
-    IPC_MESSAGE_HANDLER(WidgetMsg_UpdateRenderThrottlingStatus,
-                        OnUpdateRenderThrottlingStatus)
     IPC_MESSAGE_HANDLER(WidgetMsg_WaitForNextFrameForTests,
                         OnWaitNextFrameForTests)
     IPC_MESSAGE_HANDLER(DragMsg_TargetDragEnter, OnDragTargetDragEnter)
@@ -730,6 +708,13 @@ void RenderWidget::OnUpdateVisualProperties(
           visual_properties.screen_info.color_space);
   }
 
+  // TODO(danakj): In order to synchronize updates between local roots, the
+  // display mode should be propagated to RenderFrameProxies and down through
+  // their RenderWidgetHosts to child RenderWidgets via the VisualProperties
+  // waterfall, instead of coming to each RenderWidget independently.
+  // https://developer.mozilla.org/en-US/docs/Web/CSS/@media/display-mode
+  GetWebWidget()->SetDisplayMode(visual_properties.display_mode);
+
   if (delegate()) {
     if (size_ != visual_properties.new_size) {
       // Only hide popups when the size changes. Eg https://crbug.com/761908.
@@ -737,11 +722,6 @@ void RenderWidget::OnUpdateVisualProperties(
       web_view->CancelPagePopup();
     }
 
-    if (display_mode_ != visual_properties.display_mode) {
-      display_mode_ = visual_properties.display_mode;
-      delegate()->ApplyNewDisplayModeForWidget(visual_properties.display_mode);
-    }
-
     SetAutoResizeMode(visual_properties.auto_resize_enabled,
                       visual_properties.min_size_for_auto_resize,
                       visual_properties.max_size_for_auto_resize,
@@ -813,7 +793,6 @@ void RenderWidget::OnUpdateVisualProperties(
       // TODO(danakj): Isn't the display mode check redundant with the
       // fullscreen one?
       if (visual_properties.is_fullscreen_granted != is_fullscreen_granted_ ||
-          visual_properties.display_mode != display_mode_ ||
           visual_properties.screen_info.device_scale_factor !=
               screen_info_.device_scale_factor)
         ignore_resize_ipc = false;
@@ -859,7 +838,6 @@ void RenderWidget::OnUpdateVisualProperties(
       visible_viewport_size_ = visual_properties.visible_viewport_size;
 
       if (!auto_resize_mode_) {
-        display_mode_ = visual_properties.display_mode;
         size_ = visual_properties.new_size;
         ResizeWebWidget();
       }
@@ -1073,10 +1051,8 @@ viz::FrameSinkId RenderWidget::GetFrameSinkIdAtPoint(const gfx::PointF& point,
 
 bool RenderWidget::HandleInputEvent(
     const blink::WebCoalescedInputEvent& input_event,
-    const ui::LatencyInfo& latency_info,
     HandledEventCallback callback) {
-  input_handler_->HandleInputEvent(input_event, latency_info,
-                                   std::move(callback));
+  input_handler_->HandleInputEvent(input_event, std::move(callback));
   return true;
 }
 
@@ -1092,17 +1068,13 @@ void RenderWidget::OnCursorVisibilityChange(bool is_visible) {
   GetWebWidget()->SetCursorVisibilityState(is_visible);
 }
 
-void RenderWidget::OnFallbackCursorModeToggled(bool is_on) {
-  GetWebWidget()->OnFallbackCursorModeToggled(is_on);
-}
-
 void RenderWidget::OnMouseCaptureLost() {
   GetWebWidget()->MouseCaptureLost();
 }
 
 void RenderWidget::OnSetEditCommandsForNextKeyEvent(
-    const EditCommands& edit_commands) {
-  edit_commands_ = edit_commands;
+    std::vector<blink::mojom::EditCommandPtr> edit_commands) {
+  edit_commands_ = std::move(edit_commands);
 }
 
 void RenderWidget::OnSetActive(bool active) {
@@ -1122,34 +1094,6 @@ void RenderWidget::OnSetFocus(bool enable) {
     observer.RenderWidgetSetFocus(enable);
 }
 
-///////////////////////////////////////////////////////////////////////////////
-// LayerTreeViewDelegate
-
-void RenderWidget::ApplyViewportChanges(
-    const cc::ApplyViewportChangesArgs& args) {
-  GetWebWidget()->ApplyViewportChanges(args);
-}
-
-void RenderWidget::RecordManipulationTypeCounts(cc::ManipulationInfo info) {
-  GetWebWidget()->RecordManipulationTypeCounts(info);
-}
-
-void RenderWidget::SendOverscrollEventFromImplSide(
-    const gfx::Vector2dF& overscroll_delta,
-    cc::ElementId scroll_latched_element_id) {
-  GetWebWidget()->SendOverscrollEventFromImplSide(overscroll_delta,
-                                                  scroll_latched_element_id);
-}
-void RenderWidget::SendScrollEndEventFromImplSide(
-    cc::ElementId scroll_latched_element_id) {
-  GetWebWidget()->SendScrollEndEventFromImplSide(scroll_latched_element_id);
-}
-
-void RenderWidget::BeginMainFrame(base::TimeTicks frame_time) {
-  DCHECK(!IsForProvisionalFrame());
-  GetWebWidget()->BeginFrame(frame_time);
-}
-
 void RenderWidget::DispatchRafAlignedInput(base::TimeTicks frame_time) {
   input_event_queue_->DispatchRafAlignedInput(frame_time);
 }
@@ -1178,10 +1122,6 @@ void RenderWidget::OnDeferCommitsChanged(bool deferral_state) {
   widget_input_handler_manager_->OnDeferCommitsChanged(deferral_state);
 }
 
-void RenderWidget::DidBeginMainFrame() {
-  GetWebWidget()->DidBeginFrame();
-}
-
 void RenderWidget::RequestNewLayerTreeFrameSink(
     LayerTreeFrameSinkCallback callback) {
   // For widgets that are never visible, we don't start the compositor, so we
@@ -1211,19 +1151,11 @@ void RenderWidget::DidCommitAndDrawCompositorFrame() {
 
   for (auto& observer : render_frames_)
     observer.DidCommitAndDrawCompositorFrame();
-
-  // Notify subclasses that we initiated the paint operation.
-  DidInitiatePaint();
-}
-
-void RenderWidget::WillCommitCompositorFrame() {
-  GetWebWidget()->BeginCommitCompositorFrame();
 }
 
 void RenderWidget::DidCommitCompositorFrame(base::TimeTicks commit_start_time) {
   if (delegate())
     delegate()->DidCommitCompositorFrameForWidget();
-  GetWebWidget()->EndCommitCompositorFrame(commit_start_time);
 }
 
 void RenderWidget::DidCompletePageScaleAnimation() {
@@ -1238,11 +1170,6 @@ void RenderWidget::ScheduleAnimation() {
   layer_tree_host_->SetNeedsAnimate();
 }
 
-void RenderWidget::UpdateVisualState() {
-  DCHECK(!IsForProvisionalFrame());
-  GetWebWidget()->UpdateVisualState();
-}
-
 void RenderWidget::RecordTimeToFirstActivePaint(base::TimeDelta duration) {
   RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
   if (render_thread_impl->NeedsToRecordFirstActivePaint(TTFAP_AFTER_PURGED)) {
@@ -1258,34 +1185,9 @@ void RenderWidget::RecordTimeToFirstActivePaint(base::TimeDelta duration) {
   }
 }
 
-void RenderWidget::RecordStartOfFrameMetrics() {
-  GetWebWidget()->RecordStartOfFrameMetrics();
-}
-
-void RenderWidget::RecordEndOfFrameMetrics(
-    base::TimeTicks frame_begin_time,
-    cc::ActiveFrameSequenceTrackers trackers) {
-  GetWebWidget()->RecordEndOfFrameMetrics(frame_begin_time, trackers);
-}
-
-std::unique_ptr<cc::BeginMainFrameMetrics>
-RenderWidget::GetBeginMainFrameMetrics() {
-  return GetWebWidget()->GetBeginMainFrameMetrics();
-}
-
-void RenderWidget::BeginUpdateLayers() {
-  GetWebWidget()->BeginUpdateLayers();
-}
-
-void RenderWidget::EndUpdateLayers() {
-  GetWebWidget()->EndUpdateLayers();
-}
-
-void RenderWidget::WillBeginCompositorFrame() {
+void RenderWidget::WillBeginMainFrame() {
   TRACE_EVENT0("gpu", "RenderWidget::willBeginCompositorFrame");
 
-  GetWebWidget()->WillBeginCompositorFrame();
-
   // The UpdateTextInputState can result in further layout and possibly
   // enable GPU acceleration so they need to be called before any painting
   // is done.
@@ -1333,17 +1235,18 @@ void RenderWidget::OnDidHandleKeyEvent() {
 void RenderWidget::SetEditCommandForNextKeyEvent(const std::string& name,
                                                  const std::string& value) {
   ClearEditCommands();
-  edit_commands_.emplace_back(name, value);
+  edit_commands_.push_back(blink::mojom::EditCommand::New(name, value));
 }
 
 void RenderWidget::ClearEditCommands() {
   edit_commands_.clear();
 }
 
-void RenderWidget::OnDidOverscroll(const ui::DidOverscrollParams& params) {
+void RenderWidget::OnDidOverscroll(
+    blink::mojom::DidOverscrollParamsPtr params) {
   if (mojom::WidgetInputHandlerHost* host =
           widget_input_handler_manager_->GetWidgetInputHandlerHost()) {
-    host->DidOverscroll(params);
+    host->DidOverscroll(std::move(params));
   }
 }
 
@@ -1614,11 +1517,6 @@ void RenderWidget::SetScreenRects(const gfx::Rect& widget_screen_rect,
 ///////////////////////////////////////////////////////////////////////////////
 // WebWidgetClient
 
-void RenderWidget::IntrinsicSizingInfoChanged(
-    const blink::WebIntrinsicSizingInfo& sizing_info) {
-  Send(new WidgetHostMsg_IntrinsicSizingInfoChanged(routing_id_, sizing_info));
-}
-
 void RenderWidget::DidMeaningfulLayout(blink::WebMeaningfulLayout layout_type) {
   if (layout_type == blink::WebMeaningfulLayout::kVisuallyNonEmpty) {
     QueueMessage(std::make_unique<WidgetHostMsg_DidFirstVisuallyNonEmptyPaint>(
@@ -1665,23 +1563,9 @@ void RenderWidget::QueueMessage(std::unique_ptr<IPC::Message> msg) {
 }
 
 void RenderWidget::DidChangeCursor(const ui::Cursor& cursor) {
-  // TODO(darin): Eliminate this temporary.
-  WebCursor webcursor(cursor);
   // Only send a SetCursor message if we need to make a change.
-  if (input_handler_->DidChangeCursor(webcursor))
-    Send(new WidgetHostMsg_SetCursor(routing_id_, webcursor));
-}
-
-void RenderWidget::AutoscrollStart(const gfx::PointF& point) {
-  Send(new WidgetHostMsg_AutoscrollStart(routing_id_, point));
-}
-
-void RenderWidget::AutoscrollFling(const gfx::Vector2dF& velocity) {
-  Send(new WidgetHostMsg_AutoscrollFling(routing_id_, velocity));
-}
-
-void RenderWidget::AutoscrollEnd() {
-  Send(new WidgetHostMsg_AutoscrollEnd(routing_id_));
+  if (input_handler_->DidChangeCursor(cursor))
+    GetWebWidget()->SetCursor(cursor);
 }
 
 // We are supposed to get a single call to Show for a newly created RenderWidget
@@ -1719,18 +1603,13 @@ void RenderWidget::Show(WebNavigationPolicy policy) {
 void RenderWidget::InitCompositing(const ScreenInfo& screen_info) {
   TRACE_EVENT0("blink", "RenderWidget::InitializeLayerTreeView");
 
-  layer_tree_view_ = std::make_unique<LayerTreeView>(
-      this, compositor_deps_->GetCompositorMainThreadTaskRunner(),
-      compositor_deps_->GetCompositorImplThreadTaskRunner(),
+  layer_tree_host_ = webwidget_->InitializeCompositing(
       compositor_deps_->GetTaskGraphRunner(),
-      compositor_deps_->GetWebMainThreadScheduler());
-  layer_tree_view_->Initialize(
       GenerateLayerTreeSettings(compositor_deps_, for_child_local_root_frame_,
                                 screen_info.rect.size(),
                                 screen_info.device_scale_factor),
       compositor_deps_->CreateUkmRecorderFactory());
-  layer_tree_host_ = layer_tree_view_->layer_tree_host();
-
+  DCHECK(layer_tree_host_);
   blink::scheduler::WebThreadScheduler* main_thread_scheduler =
       compositor_deps_->GetWebMainThreadScheduler();
 
@@ -1812,29 +1691,25 @@ void RenderWidget::Close(std::unique_ptr<RenderWidget> widget) {
     g_routing_id_widget_map.Get().erase(routing_id_);
   }
 
-  webwidget_->Close();
-  webwidget_ = nullptr;
-
   // The |input_event_queue_| is refcounted and will live while an event is
   // being handled. This drops the connection back to this RenderWidget which
   // is being destroyed.
   input_event_queue_->ClearClient();
 
-  // The LayerTreeHost may already be in the call stack, if this RenderWidget
-  // is being destroyed during an animation callback for instance. We can not
-  // delete it here and unwind the stack back up to it, or it will crash. So
-  // we post the deletion to another task, but disconnect the LayerTreeHost
-  // (via the LayerTreeView) from the destroying RenderWidget. The
-  // LayerTreeView owns the LayerTreeHost, and is its client, so they are kept
-  // alive together for a clean call stack.
-  layer_tree_view_->Disconnect();
-  compositor_deps_->GetCleanupTaskRunner()->DeleteSoon(
-      FROM_HERE, std::move(layer_tree_view_));
-  // The |widget_input_handler_manager_| is referenced through the
-  // LayerTreeHost on the compositor thread, so must outlive the
-  // LayerTreeHost.
-  compositor_deps_->GetCleanupTaskRunner()->ReleaseSoon(
-      FROM_HERE, std::move(widget_input_handler_manager_));
+  // The |widget_input_handler_manager_| needs to outlive the LayerTreeHost,
+  // which is destroyed asynchronously by Close(). We pass ownership of it to
+  // Close() for it to destroy the LayerTreeHost and
+  // |widget_input_handler_manager_| together on the cleanup TaskRunner.
+  webwidget_->Close(
+      compositor_deps_->GetCleanupTaskRunner(),
+      base::BindOnce([](scoped_refptr<WidgetInputHandlerManager> manager) {},
+                     std::move(widget_input_handler_manager_)));
+  webwidget_ = nullptr;
+
+  // |layer_tree_host_| is valid only when |webwidget_| is valid. Close may
+  // use the WebWidgetClient while unloading the Frame so we clear this
+  // after.
+  layer_tree_host_ = nullptr;
 
   // Note the ACK is a control message going to the RenderProcessHost.
   RenderThread::Get()->Send(new WidgetHostMsg_Close_ACK(routing_id()));
@@ -2140,6 +2015,14 @@ void RenderWidget::UpdateSurfaceAndScreenInfo(
     render_frame->SetDeviceScaleFactorOnRenderView(
         compositor_deps_->IsUseZoomForDSFEnabled(),
         screen_info_.device_scale_factor);
+    // When the device scale changes, the size and position of the popup would
+    // need to be adjusted, which we can't do. Just close the popup, which is
+    // also consistent with page zoom and resize behavior.
+    if (previous_original_screen_info.device_scale_factor !=
+        screen_info_.device_scale_factor) {
+      blink::WebView* web_view = GetFrameWidget()->LocalRoot()->View();
+      web_view->CancelPagePopup();
+    }
   }
 
   // Propagate changes down to child local root RenderWidgets and BrowserPlugins
@@ -2208,23 +2091,6 @@ void RenderWidget::OnSetViewportIntersection(
   }
 }
 
-void RenderWidget::OnSetIsInert(bool inert) {
-  if (auto* frame_widget = GetFrameWidget())
-    frame_widget->SetIsInert(inert);
-}
-
-void RenderWidget::OnSetInheritedEffectiveTouchAction(
-    cc::TouchAction touch_action) {
-  if (auto* frame_widget = GetFrameWidget())
-    frame_widget->SetInheritedEffectiveTouchAction(touch_action);
-}
-
-void RenderWidget::OnUpdateRenderThrottlingStatus(bool is_throttled,
-                                                  bool subtree_throttled) {
-  if (auto* frame_widget = GetFrameWidget())
-    frame_widget->UpdateRenderThrottlingStatus(is_throttled, subtree_throttled);
-}
-
 void RenderWidget::OnDragTargetDragEnter(
     const std::vector<DropData::Metadata>& drop_meta_data,
     const gfx::PointF& client_point,
@@ -2420,18 +2286,16 @@ void RenderWidget::SetHidden(bool hidden) {
   // throttled acks are released in case frame production ceases.
   is_hidden_ = hidden;
 
-  if (render_widget_scheduling_state_)
-    render_widget_scheduling_state_->SetHidden(hidden);
+  if (auto* scheduler_state = GetWebWidget()->RendererWidgetSchedulingState())
+    scheduler_state->SetHidden(hidden);
 
   // If the renderer was hidden, resolve any pending synthetic gestures so they
   // aren't blocked waiting for a compositor frame to be generated.
   if (is_hidden_)
     widget_input_handler_manager_->InvokeInputProcessedCallback();
 
-  if (!never_composited_) {
+  if (!never_composited_)
     webwidget_->SetCompositorVisible(!is_hidden_);
-    layer_tree_view_->SetVisible(!is_hidden_);
-  }
 }
 
 void RenderWidget::OnImeEventGuardStart(ImeEventGuard* guard) {
@@ -2614,9 +2478,9 @@ void RenderWidget::DidHandleGestureEvent(const WebGestureEvent& event,
   }
 
 #if defined(OS_ANDROID) || defined(USE_AURA)
-  if (event.GetType() == WebInputEvent::kGestureTap) {
+  if (event.GetType() == WebInputEvent::Type::kGestureTap) {
     ShowVirtualKeyboard();
-  } else if (event.GetType() == WebInputEvent::kGestureLongPress) {
+  } else if (event.GetType() == WebInputEvent::Type::kGestureLongPress) {
     DCHECK(GetWebWidget());
     blink::WebInputMethodController* controller = GetInputMethodController();
     if (!controller || controller->TextInputInfo().value.IsEmpty())
@@ -2659,8 +2523,7 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
     bool is_for_subframe,
     const gfx::Size& initial_screen_size,
     float initial_device_scale_factor) {
-  const bool is_threaded =
-      !!compositor_deps->GetCompositorImplThreadTaskRunner();
+  const bool is_threaded = !compositor_deps->IsSingleThreaded();
 
   const base::CommandLine& cmd = *base::CommandLine::ForCurrentProcess();
   cc::LayerTreeSettings settings;
@@ -2687,8 +2550,10 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
       !cmd.HasSwitch(cc::switches::kDisableCheckerImaging) && is_threaded;
 
 #if defined(OS_ANDROID)
-  if (!viz::AlwaysUseWideColorGamut())
-    settings.prefer_raster_in_srgb = true;
+  // WebView should always raster in the default color space.
+  // Synchronous compositing indicates WebView.
+  if (!compositor_deps->UsingSynchronousCompositing())
+    settings.prefer_raster_in_srgb = features::IsDynamicColorGamutEnabled();
 
   // We can use a more aggressive limit on Android since decodes tend to take
   // longer on these devices.
@@ -2849,6 +2714,8 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
       cmd.HasSwitch(cc::switches::kShowSurfaceDamageRects);
   settings.initial_debug_state.show_screen_space_rects =
       cmd.HasSwitch(cc::switches::kShowScreenSpaceRects);
+  settings.initial_debug_state.highlight_non_lcd_text_layers =
+      cmd.HasSwitch(cc::switches::kHighlightNonLCDTextLayers);
 
   settings.initial_debug_state.SetRecordRenderingStats(
       cmd.HasSwitch(cc::switches::kEnableGpuBenchmarking));
@@ -3137,16 +3004,6 @@ void RenderWidget::SetHasPointerRawUpdateEventHandlers(bool has_handlers) {
   input_event_queue_->HasPointerRawUpdateEventHandlers(has_handlers);
 }
 
-void RenderWidget::SetHasTouchEventHandlers(bool has_handlers) {
-  if (has_touch_handlers_ && *has_touch_handlers_ == has_handlers)
-    return;
-
-  has_touch_handlers_ = has_handlers;
-  if (render_widget_scheduling_state_)
-    render_widget_scheduling_state_->SetHasTouchHandler(has_handlers);
-  Send(new WidgetHostMsg_HasTouchEventHandlers(routing_id_, has_handlers));
-}
-
 void RenderWidget::SetNeedsLowLatencyInput(bool needs_low_latency) {
   input_event_queue_->SetNeedsLowLatency(needs_low_latency);
 }
@@ -3155,35 +3012,6 @@ void RenderWidget::SetNeedsUnbufferedInputForDebugger(bool unbuffered) {
   input_event_queue_->SetNeedsUnbufferedInputForDebugger(unbuffered);
 }
 
-void RenderWidget::AnimateDoubleTapZoomInMainFrame(
-    const gfx::Point& point,
-    const blink::WebRect& rect_to_zoom) {
-  // Only oopif subframes should be sending this message.
-  DCHECK(!delegate());
-  Send(new WidgetHostMsg_AnimateDoubleTapZoomInMainFrame(routing_id(), point,
-                                                         rect_to_zoom));
-}
-
-void RenderWidget::ZoomToFindInPageRectInMainFrame(
-    const blink::WebRect& rect_to_zoom) {
-  // Only oopif subframes should be sending this message.
-  DCHECK(!delegate_);
-  Send(new WidgetHostMsg_ZoomToFindInPageRectInMainFrame(routing_id(),
-                                                         rect_to_zoom));
-}
-
-void RenderWidget::FallbackCursorModeLockCursor(bool left,
-                                                bool right,
-                                                bool up,
-                                                bool down) {
-  widget_input_handler_manager_->FallbackCursorModeLockCursor(left, right, up,
-                                                              down);
-}
-
-void RenderWidget::FallbackCursorModeSetCursorVisibility(bool visible) {
-  widget_input_handler_manager_->FallbackCursorModeSetCursorVisibility(visible);
-}
-
 void RenderWidget::SetPageScaleStateAndLimits(float page_scale_factor,
                                               bool is_pinch_gesture_active,
                                               float minimum,
@@ -3224,12 +3052,6 @@ viz::FrameSinkId RenderWidget::GetFrameSinkId() {
   return viz::FrameSinkId(RenderThread::Get()->GetClientId(), routing_id());
 }
 
-void RenderWidget::AddPresentationCallback(
-    uint32_t frame_token,
-    base::OnceCallback<void(base::TimeTicks)> callback) {
-  layer_tree_view_->AddPresentationCallback(frame_token, std::move(callback));
-}
-
 void RenderWidget::RequestUnbufferedInputEvents() {
   input_event_queue_->RequestUnbufferedInputEvents();
 }
@@ -3309,10 +3131,6 @@ bool RenderWidget::RequestPointerLockChange(
       request_unadjusted_movement);
 }
 
-void RenderWidget::PointerLockLost() {
-  mouse_lock_dispatcher_->OnMouseLockLost();
-}
-
 void RenderWidget::RequestPointerUnlock() {
   mouse_lock_dispatcher_->UnlockMouse(webwidget_mouse_lock_target_.get());
 }
@@ -3395,7 +3213,14 @@ blink::WebHitTestResult RenderWidget::GetHitTestResultAtPoint(
 }
 
 void RenderWidget::SetDeviceScaleFactorForTesting(float factor) {
-  DCHECK_GT(factor, 0.f);
+  DCHECK_GE(factor, 0.f);
+
+  // Receiving a 0 is used to reset between tests, it removes the override in
+  // order to listen to the browser for the next test.
+  if (!factor) {
+    device_scale_factor_for_testing_ = 0;
+    return;
+  }
 
   // We are changing the device scale factor from the renderer, so allocate a
   // new viz::LocalSurfaceId to avoid surface invariants violations in tests.
diff --git a/chromium/content/renderer/render_widget.h b/chromium/content/renderer/render_widget.h
index a17e429dd96..a62c46d27fb 100644
--- a/chromium/content/renderer/render_widget.h
+++ b/chromium/content/renderer/render_widget.h
@@ -34,10 +34,8 @@
 #include "content/common/content_export.h"
 #include "content/common/content_to_visible_time_reporter.h"
 #include "content/common/drag_event_source_info.h"
-#include "content/common/edit_command.h"
 #include "content/common/widget.mojom.h"
 #include "content/public/common/drop_data.h"
-#include "content/renderer/compositor/layer_tree_view_delegate.h"
 #include "content/renderer/input/main_thread_event_queue.h"
 #include "content/renderer/input/render_widget_input_handler.h"
 #include "content/renderer/input/render_widget_input_handler_delegate.h"
@@ -53,7 +51,7 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/referrer_policy.mojom.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
-#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_text_input_info.h"
@@ -81,7 +79,6 @@ class SyncMessageFilter;
 
 namespace blink {
 namespace scheduler {
-class WebRenderWidgetSchedulingState;
 class WebWidgetScheduler;
 }
 struct WebDeviceEmulationParams;
@@ -94,7 +91,6 @@ class WebPagePopup;
 }  // namespace blink
 
 namespace cc {
-struct ApplyViewportChangesArgs;
 class SwapPromise;
 }
 
@@ -105,14 +101,13 @@ class Range;
 }
 
 namespace ui {
-struct DidOverscrollParams;
+class Cursor;
 }
 
 namespace content {
 class CompositorDependencies;
 class FrameSwapMessageQueue;
 class ImeEventGuard;
-class LayerTreeView;
 class MainThreadEventQueue;
 class PepperPluginInstanceImpl;
 class RenderFrameImpl;
@@ -146,14 +141,12 @@ class CONTENT_EXPORT RenderWidget
       public IPC::Sender,
       public blink::WebPagePopupClient,  // Is-a WebWidgetClient also.
       public mojom::Widget,
-      public LayerTreeViewDelegate,
       public RenderWidgetInputHandlerDelegate,
       public RenderWidgetScreenMetricsEmulatorDelegate,
       public MainThreadEventQueueClient {
  public:
   RenderWidget(int32_t widget_routing_id,
                CompositorDependencies* compositor_deps,
-               blink::mojom::DisplayMode display_mode,
                bool hidden,
                bool never_composited,
                mojo::PendingReceiver<mojom::Widget> widget_receiver);
@@ -174,9 +167,9 @@ class CONTENT_EXPORT RenderWidget
   // Convenience type for creation method taken by InstallCreateForFrameHook().
   // The method signature matches the RenderWidget constructor.
   using CreateRenderWidgetFunction = std::unique_ptr<RenderWidget> (*)(
-      int32_t,
+      int32_t routing_id,
       CompositorDependencies*,
-      blink::mojom::DisplayMode display_mode,
+      bool hidden,
       bool never_composited,
       mojo::PendingReceiver<mojom::Widget> widget_receiver);
   // Overrides the implementation of CreateForFrame() function below. Used by
@@ -190,7 +183,6 @@ class CONTENT_EXPORT RenderWidget
   static std::unique_ptr<RenderWidget> CreateForFrame(
       int32_t widget_routing_id,
       CompositorDependencies* compositor_deps,
-      blink::mojom::DisplayMode display_mode,
       bool never_composited);
 
   // Creates a RenderWidget for a popup. This is separate from CreateForFrame()
@@ -201,7 +193,6 @@ class CONTENT_EXPORT RenderWidget
   static RenderWidget* CreateForPopup(
       int32_t widget_routing_id,
       CompositorDependencies* compositor_deps,
-      blink::mojom::DisplayMode display_mode,
       bool hidden,
       bool never_composited,
       mojo::PendingReceiver<mojom::Widget> widget_receiver);
@@ -263,7 +254,6 @@ class CONTENT_EXPORT RenderWidget
 
   const gfx::Size& size() const { return size_; }
   bool is_fullscreen_granted() const { return is_fullscreen_granted_; }
-  blink::mojom::DisplayMode display_mode() const { return display_mode_; }
   bool is_hidden() const { return is_hidden_; }
   bool has_host_context_menu_location() const {
     return has_host_context_menu_location_;
@@ -284,7 +274,9 @@ class CONTENT_EXPORT RenderWidget
   bool IsForProvisionalFrame() const;
 
   // Manage edit commands to be used for the next keyboard event.
-  const EditCommands& edit_commands() const { return edit_commands_; }
+  const std::vector<blink::mojom::EditCommandPtr>& edit_commands() const {
+    return edit_commands_;
+  }
   void SetEditCommandForNextKeyEvent(const std::string& name,
                                      const std::string& value);
   void ClearEditCommands();
@@ -304,36 +296,6 @@ class CONTENT_EXPORT RenderWidget
   // IPC::Sender
   bool Send(IPC::Message* msg) override;
 
-  // LayerTreeViewDelegate
-  void ApplyViewportChanges(const cc::ApplyViewportChangesArgs& args) override;
-  void RecordManipulationTypeCounts(cc::ManipulationInfo info) override;
-  void SendOverscrollEventFromImplSide(
-      const gfx::Vector2dF& overscroll_delta,
-      cc::ElementId scroll_latched_element_id) override;
-  void SendScrollEndEventFromImplSide(
-      cc::ElementId scroll_latched_element_id) override;
-  void BeginMainFrame(base::TimeTicks frame_time) override;
-  void OnDeferMainFrameUpdatesChanged(bool) override;
-  void OnDeferCommitsChanged(bool) override;
-  void DidBeginMainFrame() override;
-  void RequestNewLayerTreeFrameSink(
-      LayerTreeFrameSinkCallback callback) override;
-  void DidCommitAndDrawCompositorFrame() override;
-  void WillCommitCompositorFrame() override;
-  void DidCommitCompositorFrame(base::TimeTicks commit_start_time) override;
-  void DidCompletePageScaleAnimation() override;
-  void RecordStartOfFrameMetrics() override;
-  void RecordEndOfFrameMetrics(
-      base::TimeTicks frame_begin_time,
-      cc::ActiveFrameSequenceTrackers trackers) override;
-  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
-      override;
-
-  void BeginUpdateLayers() override;
-  void EndUpdateLayers() override;
-  void UpdateVisualState() override;
-  void WillBeginCompositorFrame() override;
-
   // RenderWidgetInputHandlerDelegate
   void FocusChangeComplete() override;
   void ObserveGestureEventAndResult(
@@ -343,7 +305,7 @@ class CONTENT_EXPORT RenderWidget
       bool event_processed) override;
 
   void OnDidHandleKeyEvent() override;
-  void OnDidOverscroll(const ui::DidOverscrollParams& params) override;
+  void OnDidOverscroll(blink::mojom::DidOverscrollParamsPtr params) override;
   void SetInputHandler(RenderWidgetInputHandler* input_handler) override;
   void ShowVirtualKeyboard() override;
   void UpdateTextInputState() override;
@@ -364,13 +326,8 @@ class CONTENT_EXPORT RenderWidget
 
   // blink::WebWidgetClient
   void ScheduleAnimation() override;
-  void IntrinsicSizingInfoChanged(
-      const blink::WebIntrinsicSizingInfo&) override;
   void DidMeaningfulLayout(blink::WebMeaningfulLayout layout_type) override;
   void DidChangeCursor(const ui::Cursor& cursor) override;
-  void AutoscrollStart(const gfx::PointF& point) override;
-  void AutoscrollFling(const gfx::Vector2dF& velocity) override;
-  void AutoscrollEnd() override;
   void ClosePopupWidgetSoon() override;
   void Show(blink::WebNavigationPolicy) override;
   blink::WebScreenInfo GetScreenInfo() override;
@@ -402,7 +359,6 @@ class CONTENT_EXPORT RenderWidget
       blink::WebLocalFrame* requester_frame,
       blink::WebWidgetClient::PointerLockCallback callback,
       bool request_unadjusted_movement) override;
-  void PointerLockLost();
   void RequestPointerUnlock() override;
   bool IsPointerLocked() override;
   void StartDragging(network::mojom::ReferrerPolicy policy,
@@ -413,18 +369,8 @@ class CONTENT_EXPORT RenderWidget
   void SetTouchAction(cc::TouchAction touch_action) override;
   void RequestUnbufferedInputEvents() override;
   void SetHasPointerRawUpdateEventHandlers(bool has_handlers) override;
-  void SetHasTouchEventHandlers(bool has_handlers) override;
   void SetNeedsLowLatencyInput(bool) override;
   void SetNeedsUnbufferedInputForDebugger(bool) override;
-  void AnimateDoubleTapZoomInMainFrame(const gfx::Point& point,
-                                       const blink::WebRect& bounds) override;
-  void ZoomToFindInPageRectInMainFrame(
-      const blink::WebRect& rect_to_zoom) override;
-  void FallbackCursorModeLockCursor(bool left,
-                                    bool right,
-                                    bool up,
-                                    bool down) override;
-  void FallbackCursorModeSetCursorVisibility(bool visible) override;
   void SetPageScaleStateAndLimits(float page_scale_factor,
                                   bool is_pinch_gesture_active,
                                   float minimum,
@@ -433,16 +379,21 @@ class CONTENT_EXPORT RenderWidget
   void RequestDecode(const cc::PaintImage& image,
                      base::OnceCallback<void(bool)> callback) override;
   viz::FrameSinkId GetFrameSinkId() override;
-  void AddPresentationCallback(
-      uint32_t frame_token,
-      base::OnceCallback<void(base::TimeTicks)> callback) override;
   void RecordTimeToFirstActivePaint(base::TimeDelta duration) override;
+  void OnDeferMainFrameUpdatesChanged(bool) override;
+  void OnDeferCommitsChanged(bool) override;
+  void DidCommitAndDrawCompositorFrame() override;
+  void DidCommitCompositorFrame(base::TimeTicks commit_start_time) override;
+  void DidCompletePageScaleAnimation() override;
+  void WillBeginMainFrame() override;
+  void RequestNewLayerTreeFrameSink(
+      LayerTreeFrameSinkCallback callback) override;
 
   // Returns the scale being applied to the document in blink by the device
   // emulator. Returns 1 if there is no emulation active. Use this to position
   // things when the coordinates did not come from blink, such as from the mouse
   // position.
-  float GetEmulatorScale() const;
+  float GetEmulatorScale() const override;
 
   // Override point to obtain that the current input method state and caret
   // position.
@@ -543,7 +494,6 @@ class CONTENT_EXPORT RenderWidget
 
   // MainThreadEventQueueClient overrides.
   bool HandleInputEvent(const blink::WebCoalescedInputEvent& input_event,
-                        const ui::LatencyInfo& latency_info,
                         HandledEventCallback callback) override;
   void SetNeedsMainFrame() override;
 
@@ -563,8 +513,8 @@ class CONTENT_EXPORT RenderWidget
   void OnSetFocus(bool enable);
   void OnMouseCaptureLost();
   void OnCursorVisibilityChange(bool is_visible);
-  void OnFallbackCursorModeToggled(bool is_on);
-  void OnSetEditCommandsForNextKeyEvent(const EditCommands& edit_commands);
+  void OnSetEditCommandsForNextKeyEvent(
+      std::vector<blink::mojom::EditCommandPtr> edit_commands);
   void OnImeSetComposition(
       const base::string16& text,
       const std::vector<blink::WebImeTextSpan>& ime_text_spans,
@@ -615,9 +565,6 @@ class CONTENT_EXPORT RenderWidget
   base::WeakPtr<RenderWidget> AsWeakPtr();
 
  protected:
-  // Notify subclasses that we initiated the paint operation.
-  virtual void DidInitiatePaint() {}
-
   // Notify subclasses that we handled OnUpdateVisualProperties.
   virtual void AfterUpdateVisualProperties() {}
 
@@ -700,10 +647,6 @@ class CONTENT_EXPORT RenderWidget
                            const gfx::Rect& window_screen_rect);
   void OnSetViewportIntersection(
       const blink::ViewportIntersectionState& intersection_state);
-  void OnSetIsInert(bool);
-  void OnSetInheritedEffectiveTouchAction(cc::TouchAction touch_action);
-  void OnUpdateRenderThrottlingStatus(bool is_throttled,
-                                      bool subtree_throttled);
   void OnDragTargetDragEnter(
       const std::vector<DropData::Metadata>& drop_meta_data,
       const gfx::PointF& client_pt,
@@ -723,7 +666,6 @@ class CONTENT_EXPORT RenderWidget
   void OnDragSourceEnded(const gfx::PointF& client_point,
                          const gfx::PointF& screen_point,
                          blink::WebDragOperation drag_operation);
-  void OnDragSourceSystemDragEnded();
   void OnOrientationChange();
   void OnWaitNextFrameForTests(int routing_id);
 
@@ -821,20 +763,17 @@ class CONTENT_EXPORT RenderWidget
   // features.
   CompositorDependencies* const compositor_deps_;
 
-  // We are responsible for destroying this object via its Close method, unless
-  // the RenderWidget is associated with a RenderViewImpl through |delegate_|.
-  // Becomes null once close is initiated on the RenderWidget.
-  blink::WebWidget* webwidget_ = nullptr;
-
   // The delegate for this object which is just a RenderViewImpl.
   // This member is non-null if and only if the RenderWidget is associated with
   // a RenderViewImpl.
   RenderWidgetDelegate* delegate_ = nullptr;
 
-  // Wraps the LayerTreeHost, providing clients for it with the ability to
-  // outlive RenderWidget during shutdown and keep the client pointers valid.
-  std::unique_ptr<LayerTreeView> layer_tree_view_;
-  // This is valid while |layer_tree_view_| is valid.
+  // We are responsible for destroying this object via its Close method, unless
+  // the RenderWidget is associated with a RenderViewImpl through |delegate_|.
+  // Becomes null once close is initiated on the RenderWidget.
+  blink::WebWidget* webwidget_ = nullptr;
+
+  // This is valid while |webwidget_| is valid.
   cc::LayerTreeHost* layer_tree_host_ = nullptr;
 
   // Present when emulation is enabled, only in a main frame RenderWidget. Used
@@ -898,9 +837,6 @@ class CONTENT_EXPORT RenderWidget
   // Indicates whether tab-initiated fullscreen was granted.
   bool is_fullscreen_granted_ = false;
 
-  // Indicates the display mode.
-  blink::mojom::DisplayMode display_mode_;
-
   // It is possible that one ImeEventGuard is nested inside another
   // ImeEventGuard. We keep track of the outermost one, and update it as needed.
   ImeEventGuard* ime_event_guard_ = nullptr;
@@ -998,9 +934,6 @@ class CONTENT_EXPORT RenderWidget
   bool has_host_context_menu_location_ = false;
   gfx::Point host_context_menu_location_;
 
-  std::unique_ptr<blink::scheduler::WebRenderWidgetSchedulingState>
-      render_widget_scheduling_state_;
-
   // Mouse Lock dispatcher attached to this view.
   std::unique_ptr<RenderWidgetMouseLockDispatcher> mouse_lock_dispatcher_;
 
@@ -1036,7 +969,7 @@ class CONTENT_EXPORT RenderWidget
 
   // Stores edit commands associated to the next key event.
   // Will be cleared as soon as the next key event is processed.
-  EditCommands edit_commands_;
+  std::vector<blink::mojom::EditCommandPtr> edit_commands_;
 
   // This field stores drag/drop related info for the event that is currently
   // being handled. If the current event results in starting a drag/drop
@@ -1062,10 +995,6 @@ class CONTENT_EXPORT RenderWidget
 
   gfx::Rect compositor_visible_rect_;
 
-  // Different consumers in the browser process makes different assumptions, so
-  // must always send the first IPC regardless of value.
-  base::Optional<bool> has_touch_handlers_;
-
   uint32_t last_capture_sequence_number_ = 0u;
 
   std::unique_ptr<blink::scheduler::WebWidgetScheduler> widget_scheduler_;
diff --git a/chromium/content/renderer/render_widget_browsertest.cc b/chromium/content/renderer/render_widget_browsertest.cc
index 1f6958648b9..c4f7ecee747 100644
--- a/chromium/content/renderer/render_widget_browsertest.cc
+++ b/chromium/content/renderer/render_widget_browsertest.cc
@@ -248,28 +248,40 @@ TEST_F(RenderWidgetTest, CompositorIdHitTestAPIWithImplicitRootScroller) {
 
 TEST_F(RenderWidgetTest, FrameSinkIdHitTestAPI) {
   LoadHTML(
-      "<body style='padding: 0px; margin: 0px'>"
-      "<div style='background: green; padding: 100px; margin: 0px;'>"
-      "<iframe style='width: 200px; height: 100px;'"
-      "srcdoc='<body style=\"margin: 0px; height: 100px; width: 200px;\">"
-      "</body>'></iframe><div></body>");
+      R"HTML(
+      <style>
+      html, body {
+        margin :0px;
+        padding: 0px;
+      }
+      </style>
+
+      <div style='background: green; padding: 100px; margin: 0px;'>
+        <iframe style='width: 200px; height: 100px;'
+          srcdoc='<body style="margin : 0px; height : 100px; width : 200px;">
+          </body>'>
+        </iframe>
+      </div>
+
+      )HTML");
+
   gfx::PointF point;
   viz::FrameSinkId main_frame_sink_id =
-      widget()->GetFrameSinkIdAtPoint(gfx::PointF(10, 10), &point);
+      widget()->GetFrameSinkIdAtPoint(gfx::PointF(10.43, 10.74), &point);
   EXPECT_EQ(static_cast<uint32_t>(widget()->routing_id()),
             main_frame_sink_id.sink_id());
   EXPECT_EQ(static_cast<uint32_t>(RenderThreadImpl::Get()->GetClientId()),
             main_frame_sink_id.client_id());
-  EXPECT_EQ(gfx::PointF(10, 10), point);
+  EXPECT_EQ(gfx::PointF(10.43, 10.74), point);
 
   // Targeting a child frame should also return the FrameSinkId for the main
   // widget.
   viz::FrameSinkId frame_sink_id =
-      widget()->GetFrameSinkIdAtPoint(gfx::PointF(150, 150), &point);
+      widget()->GetFrameSinkIdAtPoint(gfx::PointF(150.27, 150.25), &point);
   EXPECT_EQ(static_cast<uint32_t>(widget()->routing_id()),
             frame_sink_id.sink_id());
   EXPECT_EQ(main_frame_sink_id.client_id(), frame_sink_id.client_id());
-  EXPECT_EQ(gfx::PointF(150, 150), point);
+  EXPECT_EQ(gfx::PointF(150.27, 150.25), point);
 }
 
 TEST_F(RenderWidgetTest, GetCompositionRangeValidComposition) {
diff --git a/chromium/content/renderer/render_widget_delegate.h b/chromium/content/renderer/render_widget_delegate.h
index bd7d3623e69..50bc8b8c717 100644
--- a/chromium/content/renderer/render_widget_delegate.h
+++ b/chromium/content/renderer/render_widget_delegate.h
@@ -38,11 +38,6 @@ class CONTENT_EXPORT RenderWidgetDelegate {
   // These methods called during handling of a SynchronizeVisualProperties
   // message to handle updating state on the delegate.
   //
-  // Called during handling a SynchronizeVisualProperties message, with the new
-  // display mode that will be applied to the RenderWidget. The display mode in
-  // the RenderWidget is already changed when this method is called.
-  virtual void ApplyNewDisplayModeForWidget(
-      blink::mojom::DisplayMode new_display_mode) = 0;
   // Called during handling a SynchronizeVisualProperties message, if auto
   // resize is enabled, with the new auto size limits.
   virtual void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
diff --git a/chromium/content/renderer/render_widget_fullscreen_pepper.cc b/chromium/content/renderer/render_widget_fullscreen_pepper.cc
index 8622d65389a..e1ed89aa710 100644
--- a/chromium/content/renderer/render_widget_fullscreen_pepper.cc
+++ b/chromium/content/renderer/render_widget_fullscreen_pepper.cc
@@ -55,7 +55,6 @@ class FullscreenMouseLockDispatcher : public MouseLockDispatcher {
   // MouseLockDispatcher implementation.
   void SendLockMouseRequest(blink::WebLocalFrame* requester_frame,
                             bool request_unadjusted_movement) override;
-  void SendUnlockMouseRequest() override;
 
   RenderWidgetFullscreenPepper* widget_;
 
@@ -71,23 +70,23 @@ WebMouseEvent WebMouseEventFromGestureEvent(const WebGestureEvent& gesture) {
   if (gesture.SourceDevice() != blink::WebGestureDevice::kTouchscreen)
     return WebMouseEvent();
 
-  WebInputEvent::Type type = WebInputEvent::kUndefined;
+  WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (gesture.GetType()) {
-    case WebInputEvent::kGestureScrollBegin:
-      type = WebInputEvent::kMouseDown;
+    case WebInputEvent::Type::kGestureScrollBegin:
+      type = WebInputEvent::Type::kMouseDown;
       break;
-    case WebInputEvent::kGestureScrollUpdate:
-      type = WebInputEvent::kMouseMove;
+    case WebInputEvent::Type::kGestureScrollUpdate:
+      type = WebInputEvent::Type::kMouseMove;
       break;
-    case WebInputEvent::kGestureFlingStart:
+    case WebInputEvent::Type::kGestureFlingStart:
       // A scroll gesture on the touchscreen may end with a GestureScrollEnd
       // when there is no velocity, or a GestureFlingStart when it has a
       // velocity. In both cases, it should end the drag that was initiated by
       // the GestureScrollBegin (and subsequent GestureScrollUpdate) events.
-      type = WebInputEvent::kMouseUp;
+      type = WebInputEvent::Type::kMouseUp;
       break;
-    case WebInputEvent::kGestureScrollEnd:
-      type = WebInputEvent::kMouseUp;
+    case WebInputEvent::Type::kGestureScrollEnd:
+      type = WebInputEvent::Type::kMouseUp;
       break;
     default:
       return WebMouseEvent();
@@ -97,8 +96,8 @@ WebMouseEvent WebMouseEventFromGestureEvent(const WebGestureEvent& gesture) {
                       gesture.GetModifiers() | WebInputEvent::kLeftButtonDown,
                       gesture.TimeStamp());
   mouse.button = WebMouseEvent::Button::kLeft;
-  mouse.click_count = (mouse.GetType() == WebInputEvent::kMouseDown ||
-                       mouse.GetType() == WebInputEvent::kMouseUp);
+  mouse.click_count = (mouse.GetType() == WebInputEvent::Type::kMouseDown ||
+                       mouse.GetType() == WebInputEvent::Type::kMouseUp);
 
   mouse.SetPositionInWidget(gesture.PositionInWidget());
   mouse.SetPositionInScreen(gesture.PositionInScreen());
@@ -127,12 +126,6 @@ void FullscreenMouseLockDispatcher::SendLockMouseRequest(
   }
 }
 
-void FullscreenMouseLockDispatcher::SendUnlockMouseRequest() {
-  auto* host = widget_->GetInputHandlerHost();
-  if (host)
-    host->UnlockMouse();
-}
-
 }  // anonymous namespace
 
 // We place the WebExternalWidgetClient interface on a separate class because
@@ -157,10 +150,19 @@ class PepperExternalWidgetClient : public blink::WebExternalWidgetClient {
 
   void DidResize(const gfx::Size& size) override { widget_->DidResize(size); }
 
+  void RequestNewLayerTreeFrameSink(
+      LayerTreeFrameSinkCallback callback) override {
+    widget_->RequestNewLayerTreeFrameSink(std::move(callback));
+  }
+
   void RecordTimeToFirstActivePaint(base::TimeDelta duration) override {
     widget_->RecordTimeToFirstActivePaint(duration);
   }
 
+  void DidCommitAndDrawCompositorFrame() override {
+    widget_->DidInitiatePaint();
+  }
+
  private:
   RenderWidgetFullscreenPepper* widget_;
 };
@@ -199,7 +201,6 @@ RenderWidgetFullscreenPepper::RenderWidgetFullscreenPepper(
     blink::WebURL main_frame_url)
     : RenderWidget(routing_id,
                    compositor_deps,
-                   /*display_mode=*/blink::mojom::DisplayMode::kUndefined,
                    /*hidden=*/false,
                    /*never_composited=*/false,
                    std::move(widget_receiver)),
@@ -307,8 +308,8 @@ WebInputEventResult RenderWidgetFullscreenPepper::ProcessInputEvent(
     const WebGestureEvent* gesture_event =
         static_cast<const WebGestureEvent*>(&event);
     switch (event.GetType()) {
-      case WebInputEvent::kGestureTap: {
-        WebMouseEvent mouse(WebInputEvent::kMouseMove,
+      case WebInputEvent::Type::kGestureTap: {
+        WebMouseEvent mouse(WebInputEvent::Type::kMouseMove,
                             gesture_event->GetModifiers(),
                             gesture_event->TimeStamp());
         mouse.SetPositionInWidget(gesture_event->PositionInWidget());
@@ -317,19 +318,19 @@ WebInputEventResult RenderWidgetFullscreenPepper::ProcessInputEvent(
         mouse.movement_y = 0;
         result |= plugin()->HandleInputEvent(mouse, &cursor);
 
-        mouse.SetType(WebInputEvent::kMouseDown);
+        mouse.SetType(WebInputEvent::Type::kMouseDown);
         mouse.button = WebMouseEvent::Button::kLeft;
         mouse.click_count = gesture_event->data.tap.tap_count;
         result |= plugin()->HandleInputEvent(mouse, &cursor);
 
-        mouse.SetType(WebInputEvent::kMouseUp);
+        mouse.SetType(WebInputEvent::Type::kMouseUp);
         result |= plugin()->HandleInputEvent(mouse, &cursor);
         break;
       }
 
       default: {
         WebMouseEvent mouse = WebMouseEventFromGestureEvent(*gesture_event);
-        if (mouse.GetType() != WebInputEvent::kUndefined)
+        if (mouse.GetType() != WebInputEvent::Type::kUndefined)
           result |= plugin()->HandleInputEvent(mouse, &cursor);
         break;
       }
@@ -351,22 +352,22 @@ WebInputEventResult RenderWidgetFullscreenPepper::ProcessInputEvent(
     // On Windows, we handle it on mouse up.
 #if defined(OS_WIN)
     send_context_menu_event =
-        mouse_event.GetType() == WebInputEvent::kMouseUp &&
+        mouse_event.GetType() == WebInputEvent::Type::kMouseUp &&
         mouse_event.button == WebMouseEvent::Button::kRight;
 #elif defined(OS_MACOSX)
     send_context_menu_event =
-        mouse_event.GetType() == WebInputEvent::kMouseDown &&
+        mouse_event.GetType() == WebInputEvent::Type::kMouseDown &&
         (mouse_event.button == WebMouseEvent::Button::kRight ||
          (mouse_event.button == WebMouseEvent::Button::kLeft &&
           mouse_event.GetModifiers() & WebMouseEvent::kControlKey));
 #else
     send_context_menu_event =
-        mouse_event.GetType() == WebInputEvent::kMouseDown &&
+        mouse_event.GetType() == WebInputEvent::Type::kMouseDown &&
         mouse_event.button == WebMouseEvent::Button::kRight;
 #endif
     if (send_context_menu_event) {
       WebMouseEvent context_menu_event(mouse_event);
-      context_menu_event.SetType(WebInputEvent::kContextMenu);
+      context_menu_event.SetType(WebInputEvent::Type::kContextMenu);
       plugin()->HandleInputEvent(context_menu_event, &cursor);
     }
   }
diff --git a/chromium/content/renderer/render_widget_fullscreen_pepper.h b/chromium/content/renderer/render_widget_fullscreen_pepper.h
index d8c82c0b647..8c5f31d55e0 100644
--- a/chromium/content/renderer/render_widget_fullscreen_pepper.h
+++ b/chromium/content/renderer/render_widget_fullscreen_pepper.h
@@ -71,13 +71,13 @@ class RenderWidgetFullscreenPepper : public RenderWidget,
   ~RenderWidgetFullscreenPepper() override;
 
   // RenderWidget API.
-  void DidInitiatePaint() override;
   void Close(std::unique_ptr<RenderWidget> widget) override;
   void AfterUpdateVisualProperties() override;
 
  private:
   friend class PepperExternalWidgetClient;
 
+  void DidInitiatePaint();
   void UpdateLayerBounds();
   void DidResize(const gfx::Size& size);
   blink::WebInputEventResult ProcessInputEvent(
diff --git a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc
index ac4d4534c40..4e288565b9e 100644
--- a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc
+++ b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc
@@ -25,35 +25,19 @@ void RenderWidgetMouseLockDispatcher::SendLockMouseRequest(
       requester_frame ? requester_frame->HasTransientUserActivation() : false;
   auto* host = render_widget_->GetInputHandlerHost();
   if (host) {
-    host->RequestMouseLock(has_transient_user_activation, /*privileged=*/false,
-                           request_unadjusted_movement,
-                           base::BindOnce(&MouseLockDispatcher::OnLockMouseACK,
-                                          this->AsWeakPtr()));
-  }
-}
-
-void RenderWidgetMouseLockDispatcher::SendChangeLockRequest(
-    blink::WebLocalFrame* requester_frame,
-    bool request_unadjusted_movement) {
-  auto* host = render_widget_->GetInputHandlerHost();
-  if (host) {
-    host->RequestMouseLockChange(
+    host->RequestMouseLock(
+        has_transient_user_activation, /*privileged=*/false,
         request_unadjusted_movement,
-        base::BindOnce(&MouseLockDispatcher::OnChangeLockAck,
-                       this->AsWeakPtr()));
+        base::BindOnce(&RenderWidgetMouseLockDispatcher::OnMouseLocked,
+                       weak_ptr_factory_.GetWeakPtr()));
   }
 }
 
-void RenderWidgetMouseLockDispatcher::SendUnlockMouseRequest() {
-  auto* host = render_widget_->GetInputHandlerHost();
-  if (host)
-    host->UnlockMouse();
-}
-
-void RenderWidgetMouseLockDispatcher::OnLockMouseACK(
-    blink::mojom::PointerLockResult result) {
+void RenderWidgetMouseLockDispatcher::OnMouseLocked(
+    blink::mojom::PointerLockResult result,
+    mojo::PendingRemote<blink::mojom::PointerLockContext> context) {
   // Notify the base class.
-  MouseLockDispatcher::OnLockMouseACK(result);
+  MouseLockDispatcher::OnLockMouseACK(result, std::move(context));
 
   // Mouse Lock removes the system cursor and provides all mouse motion as
   // .movementX/Y values on events all sent to a fixed target. This requires
diff --git a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h
index 85d14a82ab9..c2f969f4caf 100644
--- a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h
+++ b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h
@@ -30,12 +30,9 @@ class RenderWidgetMouseLockDispatcher : public MouseLockDispatcher {
   void SendLockMouseRequest(blink::WebLocalFrame* requester_frame,
                             bool request_unadjusted_movement) override;
 
-  void SendChangeLockRequest(blink::WebLocalFrame* requester_frame,
-                             bool request_unadjusted_movement) override;
-
-  void SendUnlockMouseRequest() override;
-
-  void OnLockMouseACK(blink::mojom::PointerLockResult result);
+  void OnMouseLocked(
+      blink::mojom::PointerLockResult result,
+      mojo::PendingRemote<blink::mojom::PointerLockContext> context);
 
   RenderWidget* render_widget_;
 
diff --git a/chromium/content/renderer/render_widget_unittest.cc b/chromium/content/renderer/render_widget_unittest.cc
index f03bffc1780..4f520250ce7 100644
--- a/chromium/content/renderer/render_widget_unittest.cc
+++ b/chromium/content/renderer/render_widget_unittest.cc
@@ -5,6 +5,7 @@
 #include "content/renderer/render_widget.h"
 
 #include <tuple>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ -21,25 +22,27 @@
 #include "cc/trees/layer_tree_host.h"
 #include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
 #include "content/common/frame_replication_state.h"
-#include "content/common/input/input_handler.mojom.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/common/input_messages.h"
 #include "content/common/view_messages.h"
 #include "content/common/visual_properties.h"
 #include "content/common/widget_messages.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/fake_render_widget_host.h"
 #include "content/public/test/mock_render_thread.h"
 #include "content/renderer/input/widget_input_handler_manager.h"
 #include "content/renderer/render_frame_proxy.h"
+#include "content/renderer/render_process.h"
 #include "content/renderer/render_widget_delegate.h"
 #include "content/renderer/render_widget_screen_metrics_emulator.h"
 #include "content/test/fake_compositor_dependencies.h"
-#include "content/test/mock_render_process.h"
 #include "ipc/ipc_test_sink.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/mojom/page/widget.mojom-test-utils.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/web/web_device_emulation_params.h"
 #include "third_party/blink/public/web/web_external_widget.h"
 #include "third_party/blink/public/web/web_external_widget_client.h"
@@ -49,17 +52,18 @@
 #include "third_party/blink/public/web/web_view.h"
 #include "third_party/blink/public/web/web_view_client.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/web_input_event_traits.h"
 #include "ui/gfx/geometry/rect.h"
 
 using testing::_;
 
-namespace ui {
+namespace blink {
+namespace mojom {
 
-bool operator==(const ui::DidOverscrollParams& lhs,
-                const ui::DidOverscrollParams& rhs) {
+bool operator==(const DidOverscrollParams& lhs,
+                const DidOverscrollParams& rhs) {
   return lhs.accumulated_overscroll == rhs.accumulated_overscroll &&
          lhs.latest_overscroll_delta == rhs.latest_overscroll_delta &&
          lhs.current_fling_velocity == rhs.current_fling_velocity &&
@@ -67,7 +71,8 @@ bool operator==(const ui::DidOverscrollParams& lhs,
          lhs.overscroll_behavior == rhs.overscroll_behavior;
 }
 
-}  // namespace ui
+}  // namespace mojom
+}  // namespace blink
 
 namespace cc {
 class AnimationHost;
@@ -95,18 +100,14 @@ enum {
 class MockWidgetInputHandlerHost : public mojom::WidgetInputHandlerHost {
  public:
   MockWidgetInputHandlerHost() {}
-#if defined(OS_ANDROID)
-  MOCK_METHOD4(FallbackCursorModeLockCursor, void(bool, bool, bool, bool));
-
-  MOCK_METHOD1(FallbackCursorModeSetCursorVisibility, void(bool));
-#endif
-
   MOCK_METHOD1(SetTouchActionFromMain, void(cc::TouchAction));
 
   MOCK_METHOD3(SetWhiteListedTouchAction,
-               void(cc::TouchAction, uint32_t, content::InputEventAckState));
+               void(cc::TouchAction,
+                    uint32_t,
+                    blink::mojom::InputEventResultState));
 
-  MOCK_METHOD1(DidOverscroll, void(const ui::DidOverscrollParams&));
+  MOCK_METHOD1(DidOverscroll, void(blink::mojom::DidOverscrollParamsPtr));
 
   MOCK_METHOD0(DidStopFlinging, void());
 
@@ -148,9 +149,9 @@ class MockHandledEventCallback {
  public:
   MockHandledEventCallback() = default;
   MOCK_METHOD4_T(Run,
-                 void(InputEventAckState,
+                 void(blink::mojom::InputEventResultState,
                       const ui::LatencyInfo&,
-                      std::unique_ptr<ui::DidOverscrollParams>&,
+                      blink::mojom::DidOverscrollParams* overscroll,
                       base::Optional<cc::TouchAction>));
 
   HandledEventCallback GetCallback() {
@@ -159,11 +160,11 @@ class MockHandledEventCallback {
   }
 
  private:
-  void HandleCallback(InputEventAckState ack_state,
+  void HandleCallback(blink::mojom::InputEventResultState ack_state,
                       const ui::LatencyInfo& latency_info,
-                      std::unique_ptr<ui::DidOverscrollParams> overscroll,
+                      blink::mojom::DidOverscrollParamsPtr overscroll,
                       base::Optional<cc::TouchAction> touch_action) {
-    Run(ack_state, latency_info, overscroll, touch_action);
+    Run(ack_state, latency_info, overscroll.get(), touch_action);
   }
 
   DISALLOW_COPY_AND_ASSIGN(MockHandledEventCallback);
@@ -179,6 +180,8 @@ class MockWebExternalWidgetClient : public blink::WebExternalWidgetClient {
   MOCK_METHOD1(
       HandleInputEvent,
       blink::WebInputEventResult(const blink::WebCoalescedInputEvent&));
+  MOCK_METHOD1(RequestNewLayerTreeFrameSink, void(LayerTreeFrameSinkCallback));
+  MOCK_METHOD0(DidCommitAndDrawCompositorFrame, void());
 };
 
 }  // namespace
@@ -188,7 +191,6 @@ class InteractiveRenderWidget : public RenderWidget {
   explicit InteractiveRenderWidget(CompositorDependencies* compositor_deps)
       : RenderWidget(++next_routing_id_,
                      compositor_deps,
-                     blink::mojom::DisplayMode::kUndefined,
                      /*is_hidden=*/false,
                      /*never_composited=*/false,
                      mojo::NullReceiver()) {}
@@ -207,16 +209,21 @@ class InteractiveRenderWidget : public RenderWidget {
 
   void SendInputEvent(const blink::WebInputEvent& event,
                       HandledEventCallback callback) {
-    HandleInputEvent(blink::WebCoalescedInputEvent(
-                         event, std::vector<const blink::WebInputEvent*>(),
-                         std::vector<const blink::WebInputEvent*>()),
-                     ui::LatencyInfo(), std::move(callback));
+    HandleInputEvent(
+        blink::WebCoalescedInputEvent(event.Clone(), {}, {}, ui::LatencyInfo()),
+        std::move(callback));
   }
 
   void set_always_overscroll(bool overscroll) {
     always_overscroll_ = overscroll;
   }
 
+  MOCK_METHOD4(ObserveGestureEventAndResult,
+               void(const blink::WebGestureEvent& gesture_event,
+                    const gfx::Vector2dF& unused_delta,
+                    const cc::OverscrollBehavior& overscroll_behavior,
+                    bool event_processed));
+
   IPC::TestSink* sink() { return &sink_; }
 
   MockWidgetInputHandlerHost* mock_input_handler_host() {
@@ -232,7 +239,7 @@ class InteractiveRenderWidget : public RenderWidget {
   // Overridden from RenderWidget:
   bool WillHandleGestureEvent(const blink::WebGestureEvent& event) override {
     if (always_overscroll_ &&
-        event.GetType() == blink::WebInputEvent::kGestureScrollUpdate) {
+        event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate) {
       DidOverscroll(gfx::Vector2dF(event.data.scroll_update.delta_x,
                                    event.data.scroll_update.delta_y),
                     gfx::Vector2dF(event.data.scroll_update.delta_x,
@@ -269,10 +276,11 @@ class RenderWidgetUnittest : public testing::Test {
     web_view_ = blink::WebView::Create(/*client=*/&web_view_client_,
                                        /*is_hidden=*/false,
                                        /*compositing_enabled=*/true, nullptr,
-                                       mojo::ScopedInterfaceEndpointHandle());
+                                       mojo::NullAssociatedReceiver());
     widget_ = std::make_unique<InteractiveRenderWidget>(&compositor_deps_);
     web_local_frame_ = blink::WebLocalFrame::CreateMainFrame(
-        web_view_, &web_frame_client_, nullptr, nullptr);
+        web_view_, &web_frame_client_, nullptr,
+        base::UnguessableToken::Create(), nullptr);
     web_frame_widget_ = blink::WebFrameWidget::CreateForMainFrame(
         widget_.get(), web_local_frame_,
         blink::CrossVariantMojoAssociatedRemote<
@@ -313,7 +321,7 @@ class RenderWidgetUnittest : public testing::Test {
 
  private:
   base::test::TaskEnvironment task_environment_;
-  MockRenderProcess render_process_;
+  RenderProcess render_process_;
   MockRenderThread render_thread_;
   blink::WebViewClient web_view_client_;
   blink::WebView* web_view_;
@@ -328,12 +336,13 @@ class RenderWidgetUnittest : public testing::Test {
 class RenderWidgetExternalWidgetUnittest : public testing::Test {
  public:
   void SetUp() override {
+    mojo::PendingAssociatedRemote<blink::mojom::WidgetHost> widget_host_remote;
+    mojo::PendingAssociatedReceiver<blink::mojom::Widget> widget_receiver;
+    std::tie(widget_host_remote, widget_receiver) =
+        render_widget_host_.BindNewWidgetInterfaces();
     external_web_widget_ = blink::WebExternalWidget::Create(
         &mock_web_external_widget_client_, blink::WebURL(),
-        blink::CrossVariantMojoAssociatedRemote<
-            blink::mojom::WidgetHostInterfaceBase>(),
-        blink::CrossVariantMojoAssociatedReceiver<
-            blink::mojom::WidgetInterfaceBase>());
+        std::move(widget_host_remote), std::move(widget_receiver));
 
     widget_ = std::make_unique<InteractiveRenderWidget>(&compositor_deps_);
     widget_->Init(external_web_widget_.get(), ScreenInfo());
@@ -358,6 +367,8 @@ class RenderWidgetExternalWidgetUnittest : public testing::Test {
     return external_web_widget_.get();
   }
 
+  FakeRenderWidgetHost* render_widget_host() { return &render_widget_host_; }
+
   const base::HistogramTester& histogram_tester() const {
     return histogram_tester_;
   }
@@ -368,8 +379,9 @@ class RenderWidgetExternalWidgetUnittest : public testing::Test {
 
  private:
   base::test::TaskEnvironment task_environment_;
-  MockRenderProcess render_process_;
+  RenderProcess render_process_;
   MockRenderThread render_thread_;
+  FakeRenderWidgetHost render_widget_host_;
   FakeCompositorDependencies compositor_deps_;
   MockWebExternalWidgetClient mock_web_external_widget_client_;
   std::unique_ptr<blink::WebExternalWidget> external_web_widget_;
@@ -377,29 +389,51 @@ class RenderWidgetExternalWidgetUnittest : public testing::Test {
   base::HistogramTester histogram_tester_;
 };
 
+class SetCursorInterceptor
+    : public blink::mojom::WidgetHostInterceptorForTesting {
+ public:
+  explicit SetCursorInterceptor(FakeRenderWidgetHost* render_widget_host)
+      : render_widget_host_(render_widget_host) {
+    render_widget_host_->widget_host_receiver_for_testing().SwapImplForTesting(
+        this);
+  }
+  ~SetCursorInterceptor() override = default;
+
+  WidgetHost* GetForwardingInterface() override { return render_widget_host_; }
+
+  void SetCursor(const ui::Cursor& cursor) override { set_cursor_count_++; }
+
+  int set_cursor_count() { return set_cursor_count_; }
+
+ private:
+  FakeRenderWidgetHost* render_widget_host_;
+  int set_cursor_count_ = 0;
+};
+
 TEST_F(RenderWidgetExternalWidgetUnittest, CursorChange) {
   ui::Cursor cursor;
 
+  auto set_cursor_interceptor =
+      std::make_unique<SetCursorInterceptor>(render_widget_host());
   widget()->DidChangeCursor(cursor);
-  EXPECT_EQ(widget()->sink()->message_count(), 1U);
-  EXPECT_EQ(widget()->sink()->GetMessageAt(0)->type(),
-            WidgetHostMsg_SetCursor::ID);
-  widget()->sink()->ClearMessages();
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 1);
 
   widget()->DidChangeCursor(cursor);
-  EXPECT_EQ(widget()->sink()->message_count(), 0U);
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 1);
 
   EXPECT_CALL(*mock_web_external_widget_client(), HandleInputEvent(_))
       .WillOnce(::testing::Return(blink::WebInputEventResult::kNotHandled));
   widget()->SendInputEvent(SyntheticWebMouseEventBuilder::Build(
                                blink::WebInputEvent::Type::kMouseLeave),
                            HandledEventCallback());
-  EXPECT_EQ(widget()->sink()->message_count(), 0U);
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 1);
 
   widget()->DidChangeCursor(cursor);
-  EXPECT_EQ(widget()->sink()->message_count(), 1U);
-  EXPECT_EQ(widget()->sink()->GetMessageAt(0)->type(),
-            WidgetHostMsg_SetCursor::ID);
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 2);
 }
 
 TEST_F(RenderWidgetExternalWidgetUnittest, EventOverscroll) {
@@ -409,14 +443,14 @@ TEST_F(RenderWidgetExternalWidgetUnittest, EventOverscroll) {
       .WillRepeatedly(
           ::testing::Return(blink::WebInputEventResult::kNotHandled));
 
-  blink::WebGestureEvent scroll(blink::WebInputEvent::kGestureScrollUpdate,
-                                blink::WebInputEvent::kNoModifiers,
-                                ui::EventTimeForNow());
+  blink::WebGestureEvent scroll(
+      blink::WebInputEvent::Type::kGestureScrollUpdate,
+      blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   scroll.SetPositionInWidget(gfx::PointF(-10, 0));
   scroll.data.scroll_update.delta_y = 10;
   MockHandledEventCallback handled_event;
 
-  ui::DidOverscrollParams expected_overscroll;
+  blink::mojom::DidOverscrollParams expected_overscroll;
   expected_overscroll.latest_overscroll_delta = gfx::Vector2dF(0, 10);
   expected_overscroll.accumulated_overscroll = gfx::Vector2dF(0, 10);
   expected_overscroll.causal_event_viewport_point = gfx::PointF(-10, 0);
@@ -424,8 +458,8 @@ TEST_F(RenderWidgetExternalWidgetUnittest, EventOverscroll) {
 
   // Overscroll notifications received while handling an input event should
   // be bundled with the event ack IPC.
-  EXPECT_CALL(handled_event, Run(INPUT_EVENT_ACK_STATE_CONSUMED, _,
-                                 testing::Pointee(expected_overscroll), _))
+  EXPECT_CALL(handled_event, Run(blink::mojom::InputEventResultState::kConsumed,
+                                 _, testing::Pointee(expected_overscroll), _))
       .Times(1);
 
   widget()->SendInputEvent(scroll, handled_event.GetCallback());
@@ -500,6 +534,47 @@ TEST_F(RenderWidgetExternalWidgetUnittest, RenderWidgetInputEventUmaMetrics) {
       PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED, 1);
 }
 
+// Ensures that the compositor thread gets sent the gesture event & overscroll
+// amount for an overscroll initiated by a touchpad.
+TEST_F(RenderWidgetExternalWidgetUnittest, SendElasticOverscrollForTouchpad) {
+  blink::WebGestureEvent scroll(
+      blink::WebInputEvent::Type::kGestureScrollUpdate,
+      blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow(),
+      blink::WebGestureDevice::kTouchpad);
+  scroll.SetPositionInWidget(gfx::PointF(-10, 0));
+  scroll.data.scroll_update.delta_y = 10;
+
+  // We only really care that ObserveGestureEventAndResult was called; we
+  // therefore suppress the warning for the call to
+  // mock_webwidget()->HandleInputEvent().
+  EXPECT_CALL(*widget(), ObserveGestureEventAndResult(_, _, _, _)).Times(1);
+  EXPECT_CALL(*mock_web_external_widget_client(), HandleInputEvent(_))
+      .Times(testing::AnyNumber());
+
+  widget()->SendInputEvent(scroll, HandledEventCallback());
+}
+
+// Ensures that the compositor thread gets sent the gesture event & overscroll
+// amount for an overscroll initiated by a touchscreen.
+TEST_F(RenderWidgetExternalWidgetUnittest,
+       SendElasticOverscrollForTouchscreen) {
+  blink::WebGestureEvent scroll(
+      blink::WebInputEvent::Type::kGestureScrollUpdate,
+      blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow(),
+      blink::WebGestureDevice::kTouchscreen);
+  scroll.SetPositionInWidget(gfx::PointF(-10, 0));
+  scroll.data.scroll_update.delta_y = 10;
+
+  // We only really care that ObserveGestureEventAndResult was called; we
+  // therefore suppress the warning for the call to
+  // mock_webwidget()->HandleInputEvent().
+  EXPECT_CALL(*widget(), ObserveGestureEventAndResult(_, _, _, _)).Times(1);
+  EXPECT_CALL(*mock_web_external_widget_client(), HandleInputEvent(_))
+      .Times(testing::AnyNumber());
+
+  widget()->SendInputEvent(scroll, HandledEventCallback());
+}
+
 // Tests that if a RenderWidget is auto-resized, it requests a new
 // viz::LocalSurfaceId to be allocated on the impl thread.
 TEST_F(RenderWidgetUnittest, AutoResizeAllocatedLocalSurfaceId) {
@@ -538,8 +613,6 @@ class StubRenderWidgetDelegate : public RenderWidgetDelegate {
   void SetActiveForWidget(bool active) override {}
   bool SupportsMultipleWindowsForWidget() override { return true; }
   bool ShouldAckSyntheticInputImmediately() override { return true; }
-  void ApplyNewDisplayModeForWidget(
-      blink::mojom::DisplayMode new_display_mode) override {}
   void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                       const gfx::Size& max_size) override {}
   void DisableAutoResizeForWidget() override {}
diff --git a/chromium/content/renderer/renderer_blink_platform_impl.cc b/chromium/content/renderer/renderer_blink_platform_impl.cc
index 8c641e6e3a6..9b6fb9c13ed 100644
--- a/chromium/content/renderer/renderer_blink_platform_impl.cc
+++ b/chromium/content/renderer/renderer_blink_platform_impl.cc
@@ -36,7 +36,6 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/gpu_stream_constants.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/common/webplugininfo.h"
 #include "content/public/renderer/content_renderer_client.h"
@@ -815,7 +814,7 @@ RendererBlinkPlatformImpl::CreateWebGPUGraphicsContext3DProvider(
 
   constexpr bool automatic_flushes = true;
   constexpr bool support_locking = false;
-  constexpr bool support_grcontext = false;
+  constexpr bool support_grcontext = true;
 
   scoped_refptr<viz::ContextProviderCommandBuffer> provider(
       new viz::ContextProviderCommandBuffer(
diff --git a/chromium/content/renderer/renderer_main.cc b/chromium/content/renderer/renderer_main.cc
index 222cc589473..0c7dd6cecc0 100644
--- a/chromium/content/renderer/renderer_main.cc
+++ b/chromium/content/renderer/renderer_main.cc
@@ -24,7 +24,6 @@
 #include "build/build_config.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/content_switches_internal.h"
-#include "content/common/service_manager/service_manager_connection_impl.h"
 #include "content/common/skia_utils.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
@@ -37,8 +36,8 @@
 #include "mojo/public/cpp/bindings/mojo_buildflags.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/service_manager/sandbox/switches.h"
-#include "services/tracing/public/cpp/stack_sampling/tracing_sampler_profiler.h"
 #include "services/tracing/public/cpp/trace_startup.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 #include "third_party/webrtc_overrides/init_webrtc.h"  // nogncheck
 #include "ui/base/ui_base_switches.h"
@@ -57,6 +56,10 @@
 #include "third_party/blink/public/web/web_view.h"
 #endif  // OS_MACOSX
 
+#if defined(OS_CHROMEOS)
+#include "chromeos/system/core_scheduling.h"
+#endif  // OS_CHROMEOS
+
 #if BUILDFLAG(ENABLE_PLUGINS)
 #include "content/renderer/pepper/pepper_plugin_registry.h"
 #endif
@@ -121,6 +124,10 @@ int RendererMain(const MainFunctionParams& parameters) {
         command_line.GetSwitchValueASCII(switches::kLang);
     base::i18n::SetICUDefaultLocale(locale);
   }
+
+  // When we start the renderer on ChromeOS if the system has core scheduling
+  // available we want to turn it on.
+  chromeos::system::EnableCoreSchedulingIfAvailable();
 #endif
 
   InitializeSkia();
@@ -154,6 +161,7 @@ int RendererMain(const MainFunctionParams& parameters) {
     }
   }
 
+  blink::Platform::InitializeBlink();
   std::unique_ptr<blink::scheduler::WebThreadScheduler> main_thread_scheduler =
       blink::scheduler::WebThreadScheduler::CreateMainThreadScheduler(
           CreateMainThreadMessagePump(), initial_virtual_time);
@@ -204,10 +212,6 @@ int RendererMain(const MainFunctionParams& parameters) {
     }
 #endif  // OS_POSIX && !OS_ANDROID && !!OS_MACOSX
 
-    // Setup tracing sampler profiler as early as possible.
-    auto tracing_sampler_profiler =
-        tracing::TracingSamplerProfiler::CreateOnMainThread();
-
     if (need_sandbox)
       should_run_loop = platform.EnableSandbox();
 
diff --git a/chromium/content/renderer/renderer_main_platform_delegate_linux.cc b/chromium/content/renderer/renderer_main_platform_delegate_linux.cc
index 43ea0af7278..ca87fed75a0 100644
--- a/chromium/content/renderer/renderer_main_platform_delegate_linux.cc
+++ b/chromium/content/renderer/renderer_main_platform_delegate_linux.cc
@@ -7,9 +7,9 @@
 #include <errno.h>
 #include <sys/stat.h>
 
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
-#include "base/logging.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/sandbox_init.h"
diff --git a/chromium/content/renderer/renderer_main_platform_delegate_mac.mm b/chromium/content/renderer/renderer_main_platform_delegate_mac.mm
index e59ac93d0e1..28ca1646af0 100644
--- a/chromium/content/renderer/renderer_main_platform_delegate_mac.mm
+++ b/chromium/content/renderer/renderer_main_platform_delegate_mac.mm
@@ -6,7 +6,7 @@
 
 #import <Cocoa/Cocoa.h>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "sandbox/mac/seatbelt.h"
 #include "sandbox/mac/system_services.h"
 
diff --git a/chromium/content/renderer/renderer_main_platform_delegate_win.cc b/chromium/content/renderer/renderer_main_platform_delegate_win.cc
index f59a53dbc38..fa4440117e3 100644
--- a/chromium/content/renderer/renderer_main_platform_delegate_win.cc
+++ b/chromium/content/renderer/renderer_main_platform_delegate_win.cc
@@ -9,7 +9,6 @@
 #include <memory>
 
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/strings/string16.h"
 #include "base/win/win_util.h"
 #include "base/win/windows_version.h"
diff --git a/chromium/content/renderer/savable_resources.cc b/chromium/content/renderer/savable_resources.cc
index 79cf744b86c..c6515bc5550 100644
--- a/chromium/content/renderer/savable_resources.cc
+++ b/chromium/content/renderer/savable_resources.cc
@@ -7,7 +7,6 @@
 #include <set>
 
 #include "base/compiler_specific.h"
-#include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "content/public/common/url_utils.h"
 #include "content/renderer/render_frame_impl.h"
diff --git a/chromium/content/renderer/savable_resources_browsertest.cc b/chromium/content/renderer/savable_resources_browsertest.cc
index ceade9d4c24..c8638aae2c7 100644
--- a/chromium/content/renderer/savable_resources_browsertest.cc
+++ b/chromium/content/renderer/savable_resources_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_frame.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/renderer/savable_resources.h"
diff --git a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
index f480ec6d127..1e7bb540976 100644
--- a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
+++ b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
@@ -50,7 +50,7 @@ class CONTENT_EXPORT EmbeddedWorkerInstanceClientImpl
           receiver);
 
   // TODO(https://crbug.com/955171): Remove this method and use Create once
-  // RenderFrameHostImpl uses service_manager::BinderMap instead of
+  // RenderFrameHostImpl uses mojo::BinderMap instead of
   // service_manager::BinderRegistry.
   static void CreateForRequest(
       scoped_refptr<base::SingleThreadTaskRunner> initiator_task_runner,
diff --git a/chromium/content/renderer/service_worker/service_worker_context_client.cc b/chromium/content/renderer/service_worker/service_worker_context_client.cc
index bb8048c87ba..a6f1f799c44 100644
--- a/chromium/content/renderer/service_worker/service_worker_context_client.cc
+++ b/chromium/content/renderer/service_worker/service_worker_context_client.cc
@@ -11,9 +11,9 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/debug/alias.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/sequenced_task_runner.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc b/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
index d2767d68f40..59b2ded1431 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
@@ -705,6 +705,7 @@ void ServiceWorkerSubresourceLoader::RecordTimingMetrics(bool handled) {
 void ServiceWorkerSubresourceLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   TRACE_EVENT_WITH_FLOW1(
       "ServiceWorker", "ServiceWorkerSubresourceLoader::FollowRedirect",
@@ -715,8 +716,8 @@ void ServiceWorkerSubresourceLoader::FollowRedirect(
   // TODO(arthursonzogni, juncai): This seems to be correctly implemented, but
   // not used so far. Add tests and remove this DCHECK to support this feature
   // if needed. See https://crbug.com/845683.
-  DCHECK(removed_headers.empty() && modified_headers.IsEmpty())
-      << "Redirect with removed or modified headers is not supported yet. See "
+  DCHECK(modified_headers.IsEmpty() && modified_cors_exempt_headers.IsEmpty())
+      << "Redirect with modified headers is not supported yet. See "
          "https://crbug.com/845683";
   DCHECK(!new_url.has_value()) << "Redirect with modified url was not "
                                   "supported yet. crbug.com/845683";
@@ -727,6 +728,10 @@ void ServiceWorkerSubresourceLoader::FollowRedirect(
       resource_request_.url, resource_request_.method, *redirect_info_,
       removed_headers, modified_headers, &resource_request_.headers,
       &should_clear_upload);
+  resource_request_.cors_exempt_headers.MergeFrom(modified_cors_exempt_headers);
+  for (const std::string& name : removed_headers)
+    resource_request_.cors_exempt_headers.RemoveHeader(name);
+
   if (should_clear_upload)
     resource_request_.request_body = nullptr;
 
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader.h b/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
index e31a69369ad..0dfce4ed99d 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
@@ -113,9 +113,11 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
                      blink::mojom::ServiceWorkerStreamHandlePtr body_as_stream);
 
   // network::mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc b/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
index 5bf2b2951b8..2d4094787b7 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
@@ -1247,7 +1247,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, RedirectResponse) {
 
   // Redirect once more.
   fake_controller_.RespondWithRedirect("https://other.example.com/baz.png");
-  loader->FollowRedirect({}, {}, base::nullopt);
+  loader->FollowRedirect({}, {}, {}, base::nullopt);
   client->RunUntilRedirectReceived();
 
   EXPECT_EQ(net::OK, client->completion_status().error_code);
@@ -1267,7 +1267,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, RedirectResponse) {
   fake_controller_.RespondWithStream(
       stream_callback.BindNewPipeAndPassReceiver(),
       std::move(data_pipe.consumer_handle));
-  loader->FollowRedirect({}, {}, base::nullopt);
+  loader->FollowRedirect({}, {}, {}, base::nullopt);
   client->RunUntilResponseReceived();
 
   auto& info = client->response_head();
@@ -1337,7 +1337,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, TooManyRedirects) {
     redirect_location = std::string("https://www.example.com/redirect_") +
                         base::NumberToString(count);
     fake_controller_.RespondWithRedirect(redirect_location);
-    loader->FollowRedirect({}, {}, base::nullopt);
+    loader->FollowRedirect({}, {}, {}, base::nullopt);
   }
   client->RunUntilComplete();
 
diff --git a/chromium/content/renderer/service_worker/service_worker_type_converters.cc b/chromium/content/renderer/service_worker/service_worker_type_converters.cc
index 418a442a632..a8804a4a1a9 100644
--- a/chromium/content/renderer/service_worker/service_worker_type_converters.cc
+++ b/chromium/content/renderer/service_worker/service_worker_type_converters.cc
@@ -4,7 +4,8 @@
 
 #include "content/renderer/service_worker/service_worker_type_converters.h"
 
-#include "base/logging.h"
+#include <utility>
+
 #include "mojo/public/cpp/bindings/associated_interface_ptr_info.h"
 #include "mojo/public/cpp/bindings/associated_interface_request.h"
 
@@ -13,29 +14,27 @@ namespace mojo {
 blink::WebServiceWorkerObjectInfo
 TypeConverter<blink::WebServiceWorkerObjectInfo,
               blink::mojom::ServiceWorkerObjectInfoPtr>::
-    Convert(const blink::mojom::ServiceWorkerObjectInfoPtr& input) {
+    Convert(blink::mojom::ServiceWorkerObjectInfoPtr input) {
   if (!input) {
     return blink::WebServiceWorkerObjectInfo(
         blink::mojom::kInvalidServiceWorkerVersionId,
         blink::mojom::ServiceWorkerState::kParsed, blink::WebURL(),
-        mojo::ScopedInterfaceEndpointHandle() /* host_remote */,
-        mojo::ScopedInterfaceEndpointHandle() /* receiver */);
+        {} /* host_remote */, {} /* receiver */);
   }
   return blink::WebServiceWorkerObjectInfo(
       input->version_id, input->state, input->url,
-      input->host_remote.PassHandle(), input->receiver.PassHandle());
+      std::move(input->host_remote), std::move(input->receiver));
 }
 
 blink::WebServiceWorkerRegistrationObjectInfo
 TypeConverter<blink::WebServiceWorkerRegistrationObjectInfo,
               blink::mojom::ServiceWorkerRegistrationObjectInfoPtr>::
-    Convert(const blink::mojom::ServiceWorkerRegistrationObjectInfoPtr& input) {
+    Convert(blink::mojom::ServiceWorkerRegistrationObjectInfoPtr input) {
   if (!input) {
     return blink::WebServiceWorkerRegistrationObjectInfo(
         blink::mojom::kInvalidServiceWorkerRegistrationId, blink::WebURL(),
         blink::mojom::ServiceWorkerUpdateViaCache::kImports,
-        mojo::ScopedInterfaceEndpointHandle() /* host_remote */,
-        mojo::ScopedInterfaceEndpointHandle() /* receiver */,
+        {} /* host_remote */, {} /* receiver */,
         blink::mojom::ServiceWorkerObjectInfoPtr()
             .To<blink::WebServiceWorkerObjectInfo>() /* installing */,
         blink::mojom::ServiceWorkerObjectInfoPtr()
@@ -45,10 +44,10 @@ TypeConverter<blink::WebServiceWorkerRegistrationObjectInfo,
   }
   return blink::WebServiceWorkerRegistrationObjectInfo(
       input->registration_id, input->scope, input->update_via_cache,
-      input->host_remote.PassHandle(), input->receiver.PassHandle(),
-      input->installing.To<blink::WebServiceWorkerObjectInfo>(),
-      input->waiting.To<blink::WebServiceWorkerObjectInfo>(),
-      input->active.To<blink::WebServiceWorkerObjectInfo>());
+      std::move(input->host_remote), std::move(input->receiver),
+      std::move(input->installing).To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(input->waiting).To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(input->active).To<blink::WebServiceWorkerObjectInfo>());
 }
 
 }  // namespace mojo
diff --git a/chromium/content/renderer/service_worker/service_worker_type_converters.h b/chromium/content/renderer/service_worker/service_worker_type_converters.h
index d49816207a2..55354081fdf 100644
--- a/chromium/content/renderer/service_worker/service_worker_type_converters.h
+++ b/chromium/content/renderer/service_worker/service_worker_type_converters.h
@@ -21,14 +21,14 @@ template <>
 struct TypeConverter<blink::WebServiceWorkerObjectInfo,
                      blink::mojom::ServiceWorkerObjectInfoPtr> {
   static blink::WebServiceWorkerObjectInfo Convert(
-      const blink::mojom::ServiceWorkerObjectInfoPtr& input);
+      blink::mojom::ServiceWorkerObjectInfoPtr input);
 };
 
 template <>
 struct TypeConverter<blink::WebServiceWorkerRegistrationObjectInfo,
                      blink::mojom::ServiceWorkerRegistrationObjectInfoPtr> {
   static blink::WebServiceWorkerRegistrationObjectInfo Convert(
-      const blink::mojom::ServiceWorkerRegistrationObjectInfoPtr& input);
+      blink::mojom::ServiceWorkerRegistrationObjectInfoPtr input);
 };
 
 }  // namespace
diff --git a/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc b/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc
index c62ec2e5cb1..b1f3087729c 100644
--- a/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc
+++ b/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc
@@ -192,7 +192,7 @@ void WebServiceWorkerProviderImpl::SetController(
   for (blink::mojom::WebFeature feature : features)
     provider_client_->CountFeature(feature);
   provider_client_->SetController(
-      controller.To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(controller).To<blink::WebServiceWorkerObjectInfo>(),
       should_notify_controller_change);
 }
 
@@ -203,7 +203,8 @@ void WebServiceWorkerProviderImpl::PostMessageToClient(
     return;
 
   provider_client_->ReceiveMessage(
-      source.To<blink::WebServiceWorkerObjectInfo>(), std::move(message));
+      std::move(source).To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(message));
 }
 
 void WebServiceWorkerProviderImpl::CountFeature(
@@ -235,7 +236,8 @@ void WebServiceWorkerProviderImpl::OnRegistered(
   DCHECK_NE(blink::mojom::kInvalidServiceWorkerRegistrationId,
             registration->registration_id);
   callbacks->OnSuccess(
-      registration.To<blink::WebServiceWorkerRegistrationObjectInfo>());
+      std::move(registration)
+          .To<blink::WebServiceWorkerRegistrationObjectInfo>());
 }
 
 void WebServiceWorkerProviderImpl::OnDidGetRegistration(
@@ -262,7 +264,8 @@ void WebServiceWorkerProviderImpl::OnDidGetRegistration(
          registration->registration_id !=
              blink::mojom::kInvalidServiceWorkerRegistrationId);
   callbacks->OnSuccess(
-      registration.To<blink::WebServiceWorkerRegistrationObjectInfo>());
+      std::move(registration)
+          .To<blink::WebServiceWorkerRegistrationObjectInfo>());
 }
 
 void WebServiceWorkerProviderImpl::OnDidGetRegistrations(
@@ -292,7 +295,8 @@ void WebServiceWorkerProviderImpl::OnDidGetRegistrations(
     DCHECK_NE(blink::mojom::kInvalidServiceWorkerRegistrationId,
               (*infos)[i]->registration_id);
     registrations.emplace_back(
-        (*infos)[i].To<blink::WebServiceWorkerRegistrationObjectInfo>());
+        std::move((*infos)[i])
+            .To<blink::WebServiceWorkerRegistrationObjectInfo>());
   }
   callbacks->OnSuccess(std::move(registrations));
 }
@@ -316,7 +320,8 @@ void WebServiceWorkerProviderImpl::OnDidGetRegistrationForReady(
   DCHECK_NE(blink::mojom::kInvalidServiceWorkerRegistrationId,
             registration->registration_id);
   std::move(callback).Run(
-      registration.To<blink::WebServiceWorkerRegistrationObjectInfo>());
+      std::move(registration)
+          .To<blink::WebServiceWorkerRegistrationObjectInfo>());
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/stream_texture_host_android.cc b/chromium/content/renderer/stream_texture_host_android.cc
index 749ebcc8ef3..f56e4bf36a3 100644
--- a/chromium/content/renderer/stream_texture_host_android.cc
+++ b/chromium/content/renderer/stream_texture_host_android.cc
@@ -48,8 +48,8 @@ bool StreamTextureHost::BindToCurrentThread(Listener* listener) {
 bool StreamTextureHost::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(StreamTextureHost, message)
-    IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameWithYcbcrInfoAvailable,
-                        OnFrameWithYcbcrInfoAvailable);
+    IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameWithInfoAvailable,
+                        OnFrameWithInfoAvailable);
     IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameAvailable, OnFrameAvailable);
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -61,10 +61,14 @@ void StreamTextureHost::OnChannelError() {
   channel_ = nullptr;
 }
 
-void StreamTextureHost::OnFrameWithYcbcrInfoAvailable(
-    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
+void StreamTextureHost::OnFrameWithInfoAvailable(
+    const gpu::Mailbox& mailbox,
+    const gfx::Size& coded_size,
+    const gfx::Rect& visible_rect,
+    const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) {
   if (listener_)
-    listener_->OnFrameWithYcbcrInfoAvailable(std::move(ycbcr_info));
+    listener_->OnFrameWithInfoAvailable(mailbox, coded_size, visible_rect,
+                                        ycbcr_info);
 }
 
 void StreamTextureHost::OnFrameAvailable() {
@@ -80,14 +84,11 @@ void StreamTextureHost::ForwardStreamTextureForSurfaceRequest(
   }
 }
 
-gpu::Mailbox StreamTextureHost::CreateSharedImage(const gfx::Size& size) {
-  if (!channel_)
-    return gpu::Mailbox();
-
-  auto mailbox = gpu::Mailbox::GenerateForSharedImage();
-  channel_->EnqueueDeferredMessage(GpuStreamTextureMsg_CreateSharedImage(
-      route_id_, mailbox, size, ++release_id_));
-  return mailbox;
+void StreamTextureHost::UpdateRotatedVisibleSize(const gfx::Size& size) {
+  if (channel_) {
+    channel_->Send(
+        new GpuStreamTextureMsg_UpdateRotatedVisibleSize(route_id_, size));
+  }
 }
 
 gpu::SyncToken StreamTextureHost::GenUnverifiedSyncToken() {
diff --git a/chromium/content/renderer/stream_texture_host_android.h b/chromium/content/renderer/stream_texture_host_android.h
index 7ccd0f60097..0510125b73c 100644
--- a/chromium/content/renderer/stream_texture_host_android.h
+++ b/chromium/content/renderer/stream_texture_host_android.h
@@ -18,6 +18,7 @@ class UnguessableToken;
 }
 
 namespace gfx {
+class Rect;
 class Size;
 }
 
@@ -43,8 +44,11 @@ class CONTENT_EXPORT StreamTextureHost : public IPC::Listener {
   class Listener {
    public:
     virtual void OnFrameAvailable() = 0;
-    virtual void OnFrameWithYcbcrInfoAvailable(
-        base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) = 0;
+    virtual void OnFrameWithInfoAvailable(
+        const gpu::Mailbox& mailbox,
+        const gfx::Size& coded_size,
+        const gfx::Rect& visible_rect,
+        const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) = 0;
     virtual ~Listener() {}
   };
 
@@ -56,14 +60,17 @@ class CONTENT_EXPORT StreamTextureHost : public IPC::Listener {
 
   void ForwardStreamTextureForSurfaceRequest(
       const base::UnguessableToken& request_token);
-  gpu::Mailbox CreateSharedImage(const gfx::Size& size);
+  void UpdateRotatedVisibleSize(const gfx::Size& size);
   gpu::SyncToken GenUnverifiedSyncToken();
 
  private:
   // Message handlers:
   void OnFrameAvailable();
-  void OnFrameWithYcbcrInfoAvailable(
-      base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info);
+  void OnFrameWithInfoAvailable(
+      const gpu::Mailbox& mailbox,
+      const gfx::Size& coded_size,
+      const gfx::Rect& visible_rect,
+      const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info);
 
   int32_t route_id_;
   Listener* listener_;
diff --git a/chromium/content/renderer/text_input_client_observer.cc b/chromium/content/renderer/text_input_client_observer.cc
index 1beba3805fe..e0129cefaf3 100644
--- a/chromium/content/renderer/text_input_client_observer.cc
+++ b/chromium/content/renderer/text_input_client_observer.cc
@@ -8,7 +8,6 @@
 
 #include <memory>
 
-#include "build/build_config.h"
 #include "content/common/text_input_client_messages.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
@@ -16,24 +15,13 @@
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/render_widget.h"
 #include "ipc/ipc_message.h"
-#include "ppapi/buildflags/buildflags.h"
-#include "third_party/blink/public/platform/web_rect.h"
-#include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/web/mac/web_substring_util.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_view.h"
-#include "ui/gfx/geometry/rect.h"
 
 namespace content {
 
-namespace {
-uint32_t GetCurrentCursorPositionInFrame(blink::WebLocalFrame* local_frame) {
-  blink::WebRange range = local_frame->SelectionRange();
-  return range.IsNull() ? 0U : static_cast<uint32_t>(range.StartOffset());
-}
-}
-
 TextInputClientObserver::TextInputClientObserver(RenderWidget* render_widget)
     : render_widget_(render_widget) {}
 
@@ -44,10 +32,6 @@ bool TextInputClientObserver::OnMessageReceived(const IPC::Message& message) {
   IPC_BEGIN_MESSAGE_MAP(TextInputClientObserver, message)
     IPC_MESSAGE_HANDLER(TextInputClientMsg_StringAtPoint,
                         OnStringAtPoint)
-    IPC_MESSAGE_HANDLER(TextInputClientMsg_CharacterIndexForPoint,
-                        OnCharacterIndexForPoint)
-    IPC_MESSAGE_HANDLER(TextInputClientMsg_FirstRectForCharacterRange,
-                        OnFirstRectForCharacterRange)
     IPC_MESSAGE_HANDLER(TextInputClientMsg_StringForRange, OnStringForRange)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -74,16 +58,6 @@ blink::WebLocalFrame* TextInputClientObserver::GetFocusedFrame() const {
   return nullptr;
 }
 
-#if BUILDFLAG(ENABLE_PLUGINS)
-PepperPluginInstanceImpl* TextInputClientObserver::GetFocusedPepperPlugin()
-    const {
-  blink::WebLocalFrame* frame = GetFocusedFrame();
-  if (!frame)
-    return nullptr;
-  return RenderFrameImpl::FromWebFrame(frame)->focused_pepper_plugin();
-}
-#endif
-
 void TextInputClientObserver::OnStringAtPoint(gfx::Point point) {
   gfx::Point baseline_point;
   NSAttributedString* string = nil;
@@ -99,41 +73,6 @@ void TextInputClientObserver::OnStringAtPoint(gfx::Point point) {
       MSG_ROUTING_NONE, *encoded.get(), baseline_point));
 }
 
-void TextInputClientObserver::OnCharacterIndexForPoint(gfx::Point point) {
-  uint32_t index = 0U;
-  if (auto* frame = GetFocusedFrame())
-    index = static_cast<uint32_t>(frame->CharacterIndexForPoint(point));
-
-  Send(new TextInputClientReplyMsg_GotCharacterIndexForPoint(MSG_ROUTING_NONE,
-                                                             index));
-}
-
-void TextInputClientObserver::OnFirstRectForCharacterRange(gfx::Range range) {
-  gfx::Rect rect;
-#if BUILDFLAG(ENABLE_PLUGINS)
-  PepperPluginInstanceImpl* focused_plugin = GetFocusedPepperPlugin();
-  if (focused_plugin) {
-    rect = focused_plugin->GetCaretBounds();
-  } else
-#endif
-  {
-    blink::WebLocalFrame* frame = GetFocusedFrame();
-    // TODO(yabinh): Null check should not be necessary.
-    // See crbug.com/304341
-    if (frame) {
-      blink::WebRect web_rect;
-      // When request range is invalid we will try to obtain it from current
-      // frame selection. The fallback value will be 0.
-      uint32_t start = range.IsValid() ? range.start()
-                                       : GetCurrentCursorPositionInFrame(frame);
-      frame->FirstRectForCharacterRange(start, range.length(), web_rect);
-      rect = web_rect;
-    }
-  }
-  Send(
-      new TextInputClientReplyMsg_GotFirstRectForRange(MSG_ROUTING_NONE, rect));
-}
-
 void TextInputClientObserver::OnStringForRange(gfx::Range range) {
   gfx::Point baseline_point;
   NSAttributedString* string = nil;
diff --git a/chromium/content/renderer/text_input_client_observer.h b/chromium/content/renderer/text_input_client_observer.h
index 21c636130c7..af8b5074a70 100644
--- a/chromium/content/renderer/text_input_client_observer.h
+++ b/chromium/content/renderer/text_input_client_observer.h
@@ -56,8 +56,6 @@ class TextInputClientObserver : public IPC::Listener, public IPC::Sender {
 
   // IPC Message handlers:
   void OnStringAtPoint(gfx::Point point);
-  void OnCharacterIndexForPoint(gfx::Point point);
-  void OnFirstRectForCharacterRange(gfx::Range range);
   void OnStringForRange(gfx::Range range);
 
   // The RenderWidget owning this instance of the observer.
diff --git a/chromium/content/renderer/visual_state_browsertest.cc b/chromium/content/renderer/visual_state_browsertest.cc
index 8c206d8f526..1b3814f763c 100644
--- a/chromium/content/renderer/visual_state_browsertest.cc
+++ b/chromium/content/renderer/visual_state_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_view.h"
 #include "content/public/renderer/render_view_observer.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/renderer/webclipboard_impl_browsertest.cc b/chromium/content/renderer/webclipboard_impl_browsertest.cc
index 889ebc35152..c7deb2a4b0e 100644
--- a/chromium/content/renderer/webclipboard_impl_browsertest.cc
+++ b/chromium/content/renderer/webclipboard_impl_browsertest.cc
@@ -7,6 +7,7 @@
 #include "build/build_config.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc b/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc
index 3d699f6695b..07df0308691 100644
--- a/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc
+++ b/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc
@@ -60,6 +60,11 @@ WebGraphicsContext3DProviderImpl::WebGPUInterface() {
   return provider_->WebGPUInterface();
 }
 
+bool WebGraphicsContext3DProviderImpl::IsContextLost() {
+  return RasterInterface() &&
+         RasterInterface()->GetGraphicsResetStatusKHR() != GL_NO_ERROR;
+}
+
 GrContext* WebGraphicsContext3DProviderImpl::GetGrContext() {
   return provider_->GrContext();
 }
diff --git a/chromium/content/renderer/webgraphicscontext3d_provider_impl.h b/chromium/content/renderer/webgraphicscontext3d_provider_impl.h
index b9d65cbd87a..5f48d81523c 100644
--- a/chromium/content/renderer/webgraphicscontext3d_provider_impl.h
+++ b/chromium/content/renderer/webgraphicscontext3d_provider_impl.h
@@ -43,6 +43,7 @@ class CONTENT_EXPORT WebGraphicsContext3DProviderImpl
   gpu::gles2::GLES2Interface* ContextGL() override;
   gpu::raster::RasterInterface* RasterInterface() override;
   gpu::webgpu::WebGPUInterface* WebGPUInterface() override;
+  bool IsContextLost() override;
   GrContext* GetGrContext() override;
   const gpu::Capabilities& GetCapabilities() const override;
   const gpu::GpuFeatureInfo& GetGpuFeatureInfo() const override;
diff --git a/chromium/content/renderer/worker/embedded_shared_worker_stub.cc b/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
index 9ecaf561527..66c5f9877cb 100644
--- a/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
+++ b/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
@@ -18,6 +18,7 @@
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/loader/url_loader_factory_bundle.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
+#include "third_party/blink/public/common/messaging/message_port_descriptor.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
 #include "third_party/blink/public/platform/web_fetch_client_settings_object.h"
@@ -185,7 +186,6 @@ EmbeddedSharedWorkerStub::CreateWorkerFetchContext() {
   // https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-07#section-2.1.2
   worker_fetch_context->set_site_for_cookies(
       net::SiteForCookies::FromUrl(url_));
-  worker_fetch_context->set_origin_url(url_.GetOrigin());
 
   DCHECK(response_override_);
   worker_fetch_context->SetResponseOverrideForMainScript(
@@ -202,7 +202,7 @@ void EmbeddedSharedWorkerStub::ConnectToChannel(
 }
 
 void EmbeddedSharedWorkerStub::Connect(int connection_request_id,
-                                       mojo::ScopedMessagePipeHandle port) {
+                                       blink::MessagePortDescriptor port) {
   blink::MessagePortChannel channel(std::move(port));
   if (running_) {
     ConnectToChannel(connection_request_id, std::move(channel));
diff --git a/chromium/content/renderer/worker/embedded_shared_worker_stub.h b/chromium/content/renderer/worker/embedded_shared_worker_stub.h
index b7786434217..ee4cb15a962 100644
--- a/chromium/content/renderer/worker/embedded_shared_worker_stub.h
+++ b/chromium/content/renderer/worker/embedded_shared_worker_stub.h
@@ -38,6 +38,7 @@ class WebSharedWorker;
 
 namespace blink {
 class MessagePortChannel;
+class MessagePortDescriptor;
 class PendingURLLoaderFactoryBundle;
 }  // namespace blink
 
@@ -99,7 +100,7 @@ class EmbeddedSharedWorkerStub : public blink::WebSharedWorkerClient,
 
   // mojom::SharedWorker methods:
   void Connect(int connection_request_id,
-               mojo::ScopedMessagePipeHandle port) override;
+               blink::MessagePortDescriptor port) override;
   void Terminate() override;
 
   mojo::Receiver<blink::mojom::SharedWorker> receiver_;
diff --git a/chromium/content/renderer/worker/worker_thread_registry.cc b/chromium/content/renderer/worker/worker_thread_registry.cc
index bcfe2158479..800b374981a 100644
--- a/chromium/content/renderer/worker/worker_thread_registry.cc
+++ b/chromium/content/renderer/worker/worker_thread_registry.cc
@@ -8,9 +8,9 @@
 #include <memory>
 #include <utility>
 
+#include "base/check.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/observer_list.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/worker/worker_thread_registry_unittest.cc b/chromium/content/renderer/worker/worker_thread_registry_unittest.cc
index 302426e48e6..1a2c3056adc 100644
--- a/chromium/content/renderer/worker/worker_thread_registry_unittest.cc
+++ b/chromium/content/renderer/worker/worker_thread_registry_unittest.cc
@@ -4,7 +4,6 @@
 
 #include "content/renderer/worker/worker_thread_registry.h"
 
-#include "base/logging.h"
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
 #include "content/public/renderer/worker_thread.h"